Canadian Privacy Decisions

The complainant alleged that the Social Sciences and Humanities Research Council (SSHRC) improperly withheld information related to a virtual town hall and SSHRC funding applications under paragraph 20(1)(b) of the Access to Information Act. The OIC found that SSHRC and the third party (Memorial University) failed to demonstrate that the withheld information met the requirements for exemption. Specifically, the OIC determined that the information did not meet the confidentiality criteria under the Act. As a result, the Information Commissioner ordered SSHRC to release all the withheld information.

• Whether the withheld information meets the definition of 'technical information' under paragraph 20(1)(b).
• Whether the withheld information meets the 'confidentiality' criteria under paragraph 20(1)(b).
• Whether the institution and third party met the burden of proof to justify withholding the information.
• Whether the information related to application success rates is financial or commercial information.

The complainant alleged that the Canadian Institutes of Health Research (CIHR) improperly withheld information concerning a research project and an individual's role on an advisory board. The request focused on specific pages of records previously withheld under paragraph 20(1)(b) of the Access to Information Act, relating to a seed grant program, a sentinel site, and a research network's governance structure. The Commissioner found that the information did not meet the criteria for exemption under paragraph 20(1)(b) as it was neither financial, commercial, scientific, nor technical. Consequently, the complaint was well founded, and the CIHR was ordered to disclose the information.

• Whether the withheld information meets the criteria for exemption under paragraph 20(1)(b) of the ATIA.
• Whether the information constitutes financial, commercial, scientific, or technical information as defined by the ATIA.
• Whether the third party provided sufficient representations to support the exemption.

The Office of the Privacy Commissioner of Canada investigated a complaint against Agronomy Company of Canada Ltd. (Agronomy) following a significant data breach. The investigation found that Agronomy lacked appropriate safeguards, including multi-factor authentication, network segregation, and encryption, which contributed to the breach affecting 845 individuals. The OPC also found Agronomy lacked accountability structures. However, the complaint regarding valid consent for credit services was found not well-founded. Agronomy has since made significant improvements to its security measures and accountability practices.

• Adequacy of security safeguards
• Accountability for personal information
• Validity of consent for collection and use of personal information

The complainant alleged that Employment and Social Development Canada (ESDC) improperly withheld information related to an Occupational Health and Safety Tribunal decision concerning the death of an employee. The exemptions claimed were for personal information (subsection 19(1)), confidential third-party financial, commercial, scientific or technical information (paragraph 20(1)(b)), and solicitor-client privilege (section 23). The Information Commissioner found that ESDC failed to justify withholding information under paragraph 20(1)(b) and did not properly exercise discretion for information withheld under subsection 19(1) and section 23. ESDC was ordered to disclose information withheld under paragraph 20(1)(b) and to reconsider the disclosure of information withheld under subsection 19(1) and section 23.

• Justification for withholding personal information under subsection 19(1) ATIA
• Confidentiality and commercial/technical nature of information under paragraph 20(1)(b) ATIA
• Applicability of solicitor-client privilege under section 23 ATIA
• Reasonable exercise of discretion by the institution before withholding information

The complainant alleged that Employment and Social Development Canada (ESDC) improperly withheld fatality investigation reports under the personal information (subsection 19(1)) and third-party commercial/technical information (paragraph 20(1)(b)) exemptions. The Information Commissioner found that some withheld information did not meet the requirements of subsection 19(1), and that ESDC failed to properly consider its discretion for disclosure under subsection 19(2)(b). The Commissioner also found that much of the information claimed under paragraph 20(1)(b) did not meet the criteria for being commercial/technical or confidential, and that ESDC failed to exercise its discretion properly regarding information related to a third party that had consented to disclosure. The complaint was found to be well-founded.

• Whether information withheld under subsection 19(1) meets the definition of personal information.
• Whether ESDC exercised its discretion reasonably under subsection 19(2) for publicly available information.
• Whether information withheld under paragraph 20(1)(b) meets the definition of confidential third-party commercial or technical information.
• Whether ESDC exercised its discretion reasonably under subsection 20(5) for information related to a consenting third party.

The complainant alleged that Library and Archives Canada (LAC) improperly withheld information related to submarine operations in the Arctic region under exemptions for confidential government information and national security. The Information Commissioner found that LAC did not provide sufficient evidence to justify withholding the information under either exemption. The Commissioner recommended that LAC disclose the records in their entirety, but LAC stated it would not implement this recommendation.

• Justification for withholding information under subsection 13(1) (confidential information from government bodies).
• Justification for withholding information under subsection 15(1) (national security, defence).
• Whether the institution met the 'harm test' for exemption 15(1).
• Whether the institution met the 'confidentiality' requirement for exemption 13(1).

The complainant alleged that Indigenous Services Canada (ISC) did not conduct a reasonable search for records related to various infrastructure investment plans and frameworks. The investigation found that ISC's initial search was insufficient, as the Offices of Primary Interest tasked may not have been appropriate and other offices might hold responsive records. The Information Commissioner ordered ISC to conduct a new, broader search for records.

• Reasonableness of the search conducted by the institution
• Identification and tasking of appropriate offices of primary interest
• Adequacy of documentation of search efforts

The complainant alleged that Canada Post failed to conduct a reasonable search for records containing their name. The investigation found that Canada Post did not demonstrate that all relevant offices had been tasked or that all responsive records were retrieved. Consequently, the Information Commissioner ordered Canada Post to identify and process any additional responsive records and provide a final response to the complainant.

• Whether Canada Post conducted a reasonable search for records.
• Whether all relevant offices of primary interest were tasked with searching for records.
• Whether Canada Post provided sufficient explanation for missing records.

The complainant alleged that Fisheries and Oceans Canada (DFO) improperly withheld information related to the export of beluga whales, citing personal information (subsection 19(1)) and confidential third-party commercial information (paragraph 20(1)(b)) exemptions. The OIC investigation focused on paragraph 20(1)(b) after the personal information aspect was removed from scope. DFO and the third party failed to demonstrate that the information met the criteria for confidentiality under paragraph 20(1)(b). Consequently, the Information Commissioner found the complaint well-founded and ordered DFO to disclose the records, excluding any information properly withheld under subsection 19(1). DFO indicated it would comply with the order.

• Whether the medical certificates provided by Marineland constitute confidential third-party commercial information under paragraph 20(1)(b) of the ATIA.
• Whether the information was treated consistently as confidential by the third party.
• Whether the information was publicly available.

The complainant alleged that Library and Archives Canada (LAC) took an unreasonable amount of time to grant a time extension for an access to information request. The request was for records related to access requests concerning 'Project Anecdote'. LAC claimed a 1,095-day extension under paragraphs 9(1)(a) and (b) of the Act, pushing the response deadline to June 20, 2025. The Information Commissioner found that LAC met all the requirements for this extension, deeming it valid.

• Reasonableness of time extension claimed by institution under subsection 9(1)
• Whether institution met the requirements of paragraphs 9(1)(a) and (b) for the extension

The complainant alleged that the Department of Justice Canada did not conduct a reasonable search for a 2009 workplace report. The Department stated that the record's retention period was five years and it was requested seven years later, meaning it would have been destroyed. While the complainant claimed the consultant still had a copy, the Department argued it was not reasonable to contact the consultant directly given the nature and age of the contract. The OIC agreed that the Department conducted a reasonable search.

• Did the institution conduct a reasonable search for the requested records?
• Whether the institution was required to contact the consultant directly to fulfill the request.

The complainant alleged that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) had improperly withheld records related to land ownership and transactions on the Bruce/Saugeen Peninsula under section 23 (solicitor-client and litigation privilege). CIRNAC initially claimed solicitor-client privilege but later conceded this did not apply. The institution then argued litigation privilege, citing ongoing court cases. However, the Commissioner found CIRNAC failed to demonstrate that the records were created for the dominant purpose of litigation. The Commissioner recommended full disclosure, but CIRNAC refused to implement the recommendation.

• Applicability of section 23 (solicitor-client privilege)
• Applicability of section 23 (litigation privilege)
• Dominant purpose test for litigation privilege
• Institution's discretion to exercise privilege claims

The complainant requested historical Canadian intelligence assessment records. The Privy Council Office (PCO) initially withheld information under subsections 15(1) (national security) and 19(1) (personal information) of the Access to Information Act. While the OIC found PCO's use of subsection 19(1) justified, it determined that PCO failed to demonstrate how disclosing the remaining information under subsection 15(1) would cause harm. The Information Commissioner ordered PCO to disclose the records.

• Whether the Privy Council Office met the requirements of subsection 15(1) of the Access to Information Act for withholding records related to distribution markings, CSE employee names, and allied distribution lists.
• Whether the Privy Council Office met the requirements of subsection 19(1) of the Access to Information Act for withholding personal information.
• Whether the Privy Council Office reasonably exercised its discretion in deciding not to disclose the information withheld under subsection 15(1).
• The timeliness and appropriateness of the Privy Council Office's submissions following the issuance of the initial report.

The complainant alleged that the Canada Mortgage and Housing Corporation (CMHC) improperly withheld information under several sections of the Access to Information Act, including government information, personal information, third-party commercial information, advice, deliberations, and solicitor-client privilege. The scope of the complaint was narrowed during the investigation. While CMHC disclosed some information, it continued to withhold information under paragraph 20(1)(b) related to third parties TD Bank Financial Group and Andrew Kalotay Associates, Inc. The Information Commissioner found that CMHC failed to demonstrate that this information met the requirements of paragraph 20(1)(b) and ordered its disclosure.

• Applicability of paragraph 20(1)(b) to withheld information
• Confidentiality of third-party information
• Objective standard for confidentiality
• Third-party representations

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint regarding erroneous quarantine notifications sent by the ArriveCAN application to approximately 10,200 Apple device users. The OPC found that the Canada Border Services Agency (CBSA) did not take all reasonable steps to ensure the accuracy of the personal information used for administrative decisions, contravening subsection 6(2) of the Privacy Act. The CBSA disagreed with this finding and refused to correct the inaccurate information, although they later informed the OPC that the defect had been fixed and affected individuals notified.

• Whether the CBSA took all reasonable steps to ensure the accuracy of personal information used for administrative decisions.
• Whether the 'quarantine_exempted' data field constituted personal information used for an administrative purpose.
• Whether the CBSA's pre-release testing, human intervention, and correction mechanisms were adequate.
• Whether the CBSA should correct the erroneous information it holds despite the measures taken.