Canadian privacy & access decisions

The complainant alleged that Parks Canada improperly withheld information under various sections of the Access to Information Act in response to a request for records related to Benga Mining or the Grassy Mountain Coal Project. The institution withheld information under subsection 19(1) (personal information), paragraphs 21(1)(a), (b), (c) (advice, consultations, plans), and section 23 (litigation privilege). During the investigation, Parks Canada disclosed a portion of the record initially withheld under paragraph 21(1)(a) due to the passage of time. The Commissioner found that the remaining information withheld under subsection 19(1), paragraph 21(1)(a), and section 23 met the criteria for exemption and that the institution had reasonably exercised its discretion. The Commissioner also addressed the complainant's concern about records marked as "not relevant," finding that Parks Canada was justified in not processing these records given the complainant's prior agreement to narrow the scope of the request. Despite upholding the institution's application of most exemptions, the complaint was found to be well-founded because the institution initially improperly withheld information under paragraph 21(1)(a) that was later released.

• Whether s.19(1) personal information exemption was properly applied
• Whether discretion under s.19(2) was reasonably exercised
• Whether s.21(1)(a) advice or recommendations exemption was properly applied
• Whether discretion under s.21(1)(a) was reasonably exercised
• Whether s.21(1)(b) accounts of consultations or deliberations exemption was properly applied
• Whether s.21(1)(c) positions or plans developed for negotiations exemption was properly applied
• Whether s.23 litigation privilege exemption was properly applied
• Whether discretion under s.23 was reasonably exercised
• Whether Parks Canada was justified in not processing records deemed 'not relevant' based on complainant's prior agreement

The complainant alleged that Immigration, Refugees and Citizenship Canada (IRCC) failed to disclose all information sought under the Privacy Act, specifically regarding the cancellation and reissuing of visas for the complainant and her children. The investigation found that IRCC initially narrowed the scope of the request without the complainant's approval and did not conduct a sufficiently broad search for records. The OPC determined that IRCC did not initially conduct a reasonable search for records. However, during the investigation, IRCC expanded its search to include additional offices and a specific former employee's correspondence. Although no additional records were found, IRCC's subsequent efforts satisfied the OPC that it had met its obligations under the Act.

• Whether IRCC conducted a reasonable search for records responsive to the access request
• Whether IRCC improperly reduced the scope of the request without the complainant's approval
• Whether IRCC tasked all appropriate Offices of Primary Interest (OPIs) in its initial search

An individual complained that Canada Post (CPC) was using personal information gathered from the outside of delivered envelopes and parcels to create mail marketing lists, which it then rented to the private sector. The Office of the Privacy Commissioner (OPC) investigated whether CPC's Smartmail Marketing Program (SMM Program) complied with the Privacy Act. The OPC found that CPC's collection of personal information for the SMM Program was directly related to an operating program (s.4) and that its use and disclosure were for an original purpose of collection (s.7 and s.8), thus compliant with these sections. However, the OPC determined that the SMM Program constituted an "administrative purpose" under the Act, and CPC had failed to obtain individuals' authorization for the indirect collection of their personal information, contravening section 5. CPC disagreed with this finding and refused to implement the OPC's recommendation to cease the practice without authorization, proposing only enhanced transparency measures which the OPC deemed insufficient. Consequently, the complaint was found to be well-founded and not resolved.

• Whether Canada Post's collection of personal information for marketing mail list services complies with section 4 of the Privacy Act (related directly to an operating program or activity).
• Whether Canada Post's use and disclosure of personal information for marketing mail list services complies with sections 7 and 8 of the Privacy Act (for the purpose obtained or consistent use, or with consent).
• Whether Canada Post's collection of personal information for marketing mail list services complies with section 5 of the Privacy Act (direct collection for administrative purpose, or with authorization).
• Whether the use of an individual's information to provide mail marketing services constitutes an "administrative purpose" under section 3 of the Privacy Act.
• Whether individuals implicitly authorized Canada Post to indirectly collect their personal information for the SMM Program by accepting mail delivery or through the availability of an opt-out mechanism.
• Whether the exceptions under subsection 5(3) of the Privacy Act apply.

The complainant alleged that Fisheries and Oceans Canada (DFO) improperly withheld information under subsections 19(1), 20(1)(a), 20(1)(b), and 20(1)(c) of the Access to Information Act in response to a request for correspondence between DFO and Deep Water Recovery. During the investigation, the application of subsection 19(1) was removed from the scope of the complaint, and both DFO and the third party conceded that paragraphs 20(1)(a) and 20(1)(c) should not have been applied. The investigation therefore focused on paragraph 20(1)(b). The Commissioner found that neither DFO nor Deep Water Recovery demonstrated that the information met all the requirements for confidentiality under paragraph 20(1)(b), specifically that the information was not publicly available and that there was a reasonable expectation of confidentiality. Consequently, the Commissioner concluded that the information did not meet the requirements of paragraph 20(1)(b). The complaint was found to be well founded, and DFO was ordered to disclose the information.

• Whether s.19(1) personal information exemption was properly applied
• Whether s.20(1)(a) third-party trade secrets exemption was properly applied
• Whether s.20(1)(b) confidential third-party financial, commercial, scientific or technical information exemption was properly applied
• Whether s.20(1)(c) financial impact on a third party exemption was properly applied
• Whether the information is financial, commercial, scientific or technical under s.20(1)(b)
• Whether the information is confidential under s.20(1)(b)
• Whether the information was supplied by a third party under s.20(1)(b)
• Whether the third party consistently treated the information as confidential under s.20(1)(b)
• Whether the information was available from sources otherwise accessible by the public (confidentiality criterion)
• Whether the information was communicated with a reasonable expectation that it would not be disclosed (confidentiality criterion)
• Whether the information was communicated in a relationship fostered for public benefit by its confidentiality (confidentiality criterion)
• Whether the OIC's notice to third parties under s.36.3 breached natural justice and procedural fairness

The complainant alleged that Immigration, Refugees and Citizenship Canada (IRCC) inappropriately disclosed his Permanent Resident Card (PRC) renewal paperwork to the Canada Border Services Agency (CBSA), which was then used in a cessation application, contrary to the purpose for which it was collected. The OPC investigated whether IRCC was authorized to disclose this personal information to the CBSA under paragraph 8(2)(a) of the Privacy Act, which permits disclosure for a consistent use. IRCC and CBSA argued that their information sharing for the administration and enforcement of the Immigration and Refugee Protection Act (IRPA) constitutes a consistent use. The OPC found that the privacy notice on the PRC renewal application and the relevant Personal Information Bank (PIB) explicitly stated that information might be shared with CBSA for investigations related to immigration legislation. Therefore, the OPC concluded that the disclosure was for a consistent use, and the complaints against both departments were not well-founded.

• Whether IRCC's disclosure of the complainant's personal information to CBSA was authorized under paragraph 8(2)(a) of the Privacy Act
• Whether the use of the personal information by CBSA in a cessation application was consistent with the purpose for which it was collected by IRCC
• Whether the complainant could reasonably expect the disclosure of his PRC renewal application to CBSA for immigration investigations

The complainant alleged that the Public Health Agency of Canada (PHAC) failed to conduct a reasonable search for records related to the fee schedule or dispersal of payments to provinces and territories under the Budget Implementation Act, 2021. During the investigation, the OIC requested information from PHAC regarding its search parameters and program areas involved. In response, PHAC re-tasked its program areas, which led to the retrieval of approximately 104 additional responsive pages. Although PHAC initially failed to conduct a reasonable search, the subsequent efforts satisfied the Commissioner that a reasonable search had ultimately been performed. The Commissioner ordered PHAC to complete the retrieval and processing of these newly identified records and issue a new response to the complainant within 60 days. PHAC agreed to implement the order.

• Whether the institution conducted a reasonable search for records

The complainant sought rail industry workplace fatality investigation reports from Employment and Social Development Canada (ESDC) between 2000 and 2020. ESDC withheld information under several exemptions, including those for law enforcement, personal information, third-party commercial information, financial impact on third parties, and advice/recommendations. The Commissioner found that ESDC improperly applied the law enforcement exemption and most of the third-party exemptions, noting a lack of demonstrated harm or failure to meet exemption requirements. While some information was genuinely personal, ESDC failed to justify withholding information about individuals deceased for over 20 years or general report titles, and did not reasonably exercise its discretion regarding publicly available information or public interest. Furthermore, ESDC did not properly apply severance to all records and failed to reasonably exercise discretion for the advice/recommendations exemption. Consequently, the complaint was found to be well founded. The Commissioner ordered ESDC to disclose information not properly exempted, re-exercise discretion where appropriate, and conduct a proper severance exercise. ESDC subsequently notified the Commissioner that it would implement the order.

• Whether s.16(1)(c) law-enforcement harm was reasonably expected from disclosing photographs taken during investigations
• Whether information met the requirements of s.19(1) personal information, particularly for individuals deceased for over 20 years or general report titles
• Whether ESDC reasonably exercised its discretion under s.19(2)(a) regarding consent for personal information disclosure
• Whether ESDC reasonably exercised its discretion under s.19(2)(b) regarding publicly available personal information
• Whether ESDC reasonably exercised its discretion under s.19(2)(c) by properly weighing public interest against invasion of privacy for personal information
• Whether information met the requirements of s.20(1)(b) confidential third-party financial, commercial, scientific or technical information, specifically regarding its commercial/technical nature, confidentiality, and whether it was 'supplied by' a third party
• Whether information met the requirements of s.20(1)(c) financial impact on a third party, particularly regarding speculative harm arguments
• Whether ESDC reasonably exercised its discretion under s.20(6) by properly weighing public interest against potential harm to third parties for commercial information
• Whether information met the requirements of s.21(1)(b) accounts of consultations or deliberations
• Whether ESDC reasonably exercised its discretion under s.21(1)(b) for accounts of consultations or deliberations
• Whether ESDC adhered to s.25 severance by failing to apply it to records related to CN

The complainant alleged that the National Capital Commission (NCC) improperly withheld information under paragraphs 16(2)(c), 18(d), and subsection 19(1) of the Access to Information Act concerning renovation projects at Rideau Hall. During the investigation, the NCC disclosed some information previously withheld under subsection 19(1), and the application of paragraphs 16(2)(c) and 18(d) was removed from the scope of the complaint. The Commissioner found that the name, title, and contact information of an NCC employee did not meet the requirements for exemption under subsection 19(1) as it fell under an exception for business contact information. For other personal information, the NCC failed to demonstrate that it had reasonably exercised its discretion to disclose publicly available personal information. The Commissioner ordered the NCC to disclose the NCC employee's information and to properly exercise its discretion regarding publicly available personal information. The NCC agreed to implement the order, and the complaint was found to be well founded.

• Whether s.16(2)(c) ATIA (facilitating the commission of an offence) was properly applied
• Whether s.18(d) ATIA (negotiations by government institutions) was properly applied
• Whether s.19(1) ATIA (personal information) was properly applied to the name, title, and contact information of an NCC employee
• Whether the information about an NCC employee is excluded from the definition of personal information under paragraph 3(j) of the Privacy Act
• Whether the NCC reasonably exercised its discretion under s.19(2)(a) ATIA (consent to disclosure)
• Whether the NCC reasonably exercised its discretion under s.19(2)(b) ATIA (publicly available personal information)
• Whether the NCC reasonably exercised its discretion under s.19(2)(c) ATIA (disclosure consistent with s.8 of the Privacy Act)

The complainant alleged that the Canada Mortgage and Housing Corporation (CMHC) improperly withheld information under several sections of the Access to Information Act related to the Canada Mortgage Bonds (CMB) program and National Housing Act Mortgage-Backed Securities (NHA MBS) programs. During the investigation, CMHC disclosed some information previously withheld under paragraphs 18(a), 18(b), 21(1)(a), and 21(1)(b), citing the passage of time. The OIC found that CMHC appropriately applied paragraph 68(a) to exclude information available for purchase and that CMHC's application of paragraphs 18(a) and 21(1)(a) was justified, including a reasonable exercise of discretion. However, CMHC failed to demonstrate that the information withheld under paragraph 20(1)(b) met the exemption's requirements, particularly because the relevant third parties (Cornerstone and AKA) did not provide representations to support the claim. Consequently, the Information Commissioner ordered CMHC to disclose the information withheld under paragraph 20(1)(b). CMHC agreed to implement the order.

• Whether s.18(a) ATIA (government financial, commercial, scientific or technical information) was properly applied
• Whether CMHC reasonably exercised its discretion under s.18(a) ATIA
• Whether s.18(b) ATIA (competitive position of government institutions, negotiations by government institutions) was properly applied
• Whether s.20(1)(a) ATIA (third-party trade secrets) was properly applied
• Whether s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information) was properly applied
• Whether s.21(1)(a) ATIA (advice or recommendations) was properly applied
• Whether CMHC reasonably exercised its discretion under s.21(1)(a) ATIA
• Whether s.21(1)(b) ATIA (accounts of consultations or deliberations) was properly applied
• Whether s.68(a) ATIA (material available for purchase) applied to exclude information

The complainant alleged that Agriculture and Agri-Food Canada (AAFC) improperly withheld information under subsection 19(1) (personal information) and paragraph 20(1)(b) (confidential third-party information) of the Access to Information Act. The request sought communications with the National Farm Animal Care Council (NFACC) regarding a Five-Year Review Summary Report and proposed amendments to the Code of Practice for the Care and Handling of Pigs. During the investigation, AAFC disclosed some records, and the complainant narrowed the scope of the complaint. The Information Commissioner found that the information remaining under subsection 19(1) was properly withheld as personal information. However, the Commissioner determined that the information withheld under paragraph 20(1)(b) did not meet the criteria for exemption, specifically, it was not financial, commercial, scientific, or technical. The complaint was found to be well founded, and AAFC was ordered to disclose the information withheld under paragraph 20(1)(b). AAFC subsequently notified the Commissioner that it would not implement the order and intended to apply to the Federal Court.

• Whether records were under the control of the institution
• Whether information met the criteria for exemption under s.19(1) ATIA (personal information)
• Whether the institution reasonably exercised its discretion under s.19(2) ATIA
• Whether information met the criteria for exemption under s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information)
• Whether the information was financial, commercial, scientific, or technical

The complainant alleged that the Social Sciences and Humanities Research Council (SSHRC) improperly withheld information under paragraph 20(1)(b) of the Access to Information Act. The request sought records related to a virtual town hall meeting and other contacts between SSHRC and Memorial University of Newfoundland and Labrador (MUN) officials. SSHRC withheld technical information for WebEx meetings and data on MUN's application and success rates for SSHRC funding programs, citing confidentiality. The Commissioner found that while the WebEx access information was technical, neither SSHRC nor MUN demonstrated that it met the confidentiality criteria, particularly given the large number of potential attendees and lack of measures to prevent sharing. Furthermore, the Commissioner determined that MUN's application and success rates were not financial, commercial, scientific, or technical information, and SSHRC later confirmed some of this information was publicly available. Consequently, the Commissioner concluded that the information did not meet the requirements for exemption under paragraph 20(1)(b).

• Whether the withheld information is financial, commercial, scientific, or technical under s.20(1)(b) ATIA
• Whether the WebEx access information is confidential under s.20(1)(b) ATIA
• Whether MUN's application and success rates are confidential under s.20(1)(b) ATIA
• Whether the information was consistently treated as confidential by the third party
• Whether the relationship between the institution and third party was fostered for public benefit by confidential communication

The complainant alleged that the Canadian Institutes of Health Research (CIHR) improperly withheld information under subsections 18(a), 19(1), and 20(1)(b) of the Access to Information Act, concerning an individual's role on the Pfizer Lyme Disease Advisory Board and their research project. During the investigation, the complainant narrowed the scope to three specific sections of records withheld under paragraph 20(1)(b). The OIC sought representations from the third party (Nominated Principal Investigator via Queen's University), who had no concerns with disclosure. CIHR subsequently conceded that the threshold for paragraph 20(1)(b) had not been met and indicated preparedness to release the information. The Commissioner found that the information at issue, describing aspects of a proposed research network, was not financial, commercial, scientific, or technical as required by paragraph 20(1)(b). Therefore, the Commissioner concluded that the exemption did not apply. The complaint was found to be well founded, and CIHR was ordered to disclose the information.

• Whether the withheld information was financial, commercial, scientific, or technical under s.20(1)(b) ATIA
• Whether the information was confidential under s.20(1)(b) ATIA
• Whether the information was supplied by a third party to a government institution under s.20(1)(b) ATIA
• Whether the third party consistently treated the information as confidential under s.20(1)(b) ATIA

A federal institution applied to the Information Commissioner for approval to decline to act on two access to information requests, arguing they were vexatious and an abuse of the right of access under subsection 6.1(1) of the Access to Information Act. The institution claimed the requester submitted a high volume of requests, refused to narrow their scope, and engaged in intimidating communications, thereby diverting public resources and harassing the department. The Commissioner found that the institution failed to fulfill its duty to assist the requester under subsection 4(2.1) of the Act, as its communication was solely aimed at reducing scope without offering other assistance. Furthermore, the Commissioner determined that the institution did not provide clear and compelling evidence to support its claims that the requests were vexatious or an abuse of the right of access. The Commissioner denied the institution's application, requiring it to process the access requests.

• Whether the institution fulfilled its duty to assist obligations under subsection 4(2.1) of the Act
• Whether the access requests were vexatious under subsection 6.1(1) of the Act
• Whether the access requests constituted an abuse of the right to make a request under subsection 6.1(1) of the Act

The Office of the Privacy Commissioner of Canada (OPC) investigated Agronomy Company of Canada Ltd. following a complaint alleging inadequate safeguards, lack of accountability, and invalid consent for personal information collection and use, stemming from a data breach. A malicious actor gained access to Agronomy's systems, exfiltrating sensitive personal information of 845 individuals, including SINs, financial details, and identification documents, before deploying ransomware. The OPC found Agronomy failed to implement appropriate safeguards, citing a lack of multifactor authentication, network segregation, data encryption, and detection tools, which contributed to the breach. Furthermore, Agronomy lacked a comprehensive privacy policy, a designated privacy officer, and adequate staff training, indicating a failure in accountability. While these two aspects were found well-founded, Agronomy committed to significant improvements, leading to a conditionally resolved outcome. However, the OPC found the complaint regarding invalid consent for credit services not well-founded, as the complainant had signed a clearly labelled credit application and utilized the extended credit.

• Whether Agronomy implemented appropriate safeguards to adequately protect personal information under its control, as per PIPEDA Principle 4.7.
• Whether Agronomy's technical safeguards (multifactor authentication, network segregation, data encryption, detection and response tools) were appropriate for the sensitivity of the information.
• Whether Agronomy's organizational safeguards (incident response protocols, information management, security documentation, staff training) were adequate.
• Whether Agronomy was accountable for personal information under its control, including designating an individual for PIPEDA compliance and implementing policies and practices, as per PIPEDA Principle 4.1.
• Whether Agronomy obtained valid and meaningful consent for the collection and use of personal information for credit services, particularly sensitive information, as per PIPEDA Principle 4.3.

The complainant alleged that Employment and Social Development Canada (ESDC) improperly withheld information under subsections 19(1), 20(1)(b), and section 23 of the Access to Information Act, related to an Occupational Health and Safety Tribunal decision concerning a Canadian National Railway (CN Rail) employee's death. The Commissioner found that ESDC and CN Rail did not demonstrate that all requirements for paragraph 20(1)(b) were met, particularly regarding confidentiality and whether the information was truly commercial or technical. While ESDC met the requirements for subsection 19(1) and section 23, the Commissioner determined that ESDC failed to reasonably exercise its discretion to decide whether to disclose the information, especially for publicly available personal information. Consequently, the Commissioner ordered ESDC to disclose the information withheld under paragraph 20(1)(b) and to re-exercise its discretion for information withheld under subsection 19(1) and section 23, considering all relevant factors for and against disclosure. ESDC agreed to implement the order.

• Whether s.19(1) personal information exemption was properly applied
• Whether the institution reasonably exercised its discretion under s.19(2) for personal information
• Whether the information is financial, commercial, scientific or technical under s.20(1)(b)
• Whether the information is confidential under s.20(1)(b)
• Whether the third party supplied the information to a government institution under s.20(1)(b)
• Whether the third party consistently treated the information as confidential under s.20(1)(b)
• Whether s.23 solicitor-client privilege exemption was properly applied
• Whether the institution reasonably exercised its discretion for s.23 solicitor-client privileged information