Canadian privacy & access decisions

The complainant alleged that the Canadian Food Inspection Agency (CFIA) failed to respond to an access request within the 30-day statutory period. The request sought records related to the cull of ostriches at Universal Ostrich Farms. The CFIA was deemed to have refused access due to the delay, which it attributed to ongoing RCMP investigations, safety and security concerns, and the volume of records. The Information Commissioner found the CFIA's delay in searching and gathering records to be irresponsible and a blatant disregard for the Act. The Commissioner noted that the Act does not permit an institution to 'pause' a request due to sensitivity or a strategic plan for multiple requests. The Commissioner ordered the CFIA to provide a complete response within 36 business days of the final report. The CFIA confirmed it would implement the order and had already begun retrieving and reviewing records.

• Whether the institution responded to the access request within the 30-day period set out in section 7 of the Access to Information Act
• Whether the institution's reasons for delay (ongoing RCMP investigations, safety/security concerns, volume of records) justified the failure to respond within statutory timelines
• Whether the Access to Information Act authorizes an institution to 'pause' a response to an access request

The Office of the Privacy Commissioner of Canada (OPC) launched a systemic investigation into the Canada Revenue Agency (CRA) following media reports and a complaint regarding widespread unauthorized disclosures and modifications of taxpayer personal information. The investigation, a Special Report to Parliament, examined whether the CRA had adequate safeguards to protect taxpayer data from identity theft and fraudulent activities. The OPC found that the CRA contravened subsections 6(2) and 8(2) of the Privacy Act due to shortcomings in its prevention, monitoring, detection, remediation, and governance practices. While acknowledging the CRA's efforts to improve its security posture, the OPC identified specific weaknesses, such as delayed implementation of mandatory multi-factor authentication (MFA) and insufficient tracking of individual breaches. The OPC issued nine recommendations to the CRA, covering areas like strengthening MFA, enhancing phone authentication, adopting zero-trust principles, improving attack surface management, and refining breach tracking and governance. The CRA accepted eight recommendations in full and one in part, leading to a "well-founded and conditionally resolved" outcome.

• Whether the CRA adequately protected personal information against unauthorized disclosure and modification
• Whether the CRA contravened subsection 6(2) of the Privacy Act regarding accuracy of personal information
• Whether the CRA contravened subsection 8(2) of the Privacy Act regarding disclosure of personal information
• Whether the CRA's prevention measures were adequate
• Whether the CRA implemented mandatory multi-factor authentication (MFA) in a timely manner and with sufficient strength
• Whether the CRA's authentication processes by phone were strong enough
• Whether the CRA considered and integrated a zero-trust approach into its security measures
• Whether the CRA had sufficient visibility over its attack surface and managed it effectively
• Whether the CRA's vetting, training, and awareness tools were effective for employees and third parties
• Whether the CRA's monitoring and detection approach was tailored to the threats and risks leading to Unauthorized Use of Taxpayer Information by a Third Party (UUTP)
• Whether the CRA's remediation efforts for individual UUTPs were adequate, including root cause analysis
• Whether the CRA's governance processes for addressing UUTPs were coordinated, comprehensive, and efficient