Canadian privacy & access decisions

The Office of the Privacy Commissioner (OPC) investigated complaints against the NSIRA Secretariat regarding its access to sensitive polygraph records during a review of the Communications Security Establishment's (CSE) Internal Security Program. Complainants questioned whether the collection of personal information complied with section 4 of the Privacy Act and if the Secretariat met its Personal Information Bank (PIB) obligations under section 10. The OPC found that while some un-redacted elements in security screening files posed a re-identification risk, the polygraph recordings themselves were sufficiently anonymized. Given NSIRA's broad mandate and right of access, the OPC concluded the collection issue was not well-founded. However, the Secretariat's delay in requesting approval for PIB changes was found well-founded, though resolved by subsequent submission. The OPC recommended the Secretariat prioritize PIB approvals and publish its Info Source page for transparency. The Secretariat committed to these actions.

• Whether the NSIRA Secretariat's collection of personal information (polygraph records) complied with section 4 of the Privacy Act.
• Whether the anonymization measures applied to polygraph records were sufficient to prevent re-identification.
• Whether the NSIRA Secretariat's viewing of personal information, even if not recorded, constituted a 'collection' under section 4.
• Whether the NSIRA Secretariat met its obligations under section 10 of the Privacy Act regarding Personal Information Banks (PIBs).
• Whether the NSIRA Secretariat's request for PIB approval was timely.
• Whether the NSIRA Secretariat published its Info Source page as required by TBS policy.