Canadian privacy & access decisions

The complainant alleged that Fisheries and Oceans Canada (DFO) improperly withheld information under paragraph 20(1)(b) of the Access to Information Act. The request sought data analyzed in the Sea Lice Science Response Report (2022/045) from January to June 2022. DFO initially withheld the information, citing confidentiality, but later conceded that much of the data, including temperature and salinity data, could be disclosed. The Information Commissioner found that neither DFO nor the third parties demonstrated that the information met all the requirements of paragraph 20(1)(b), specifically regarding objective confidentiality and whether all information was supplied by a third party. One third party also raised section 26, but the Commissioner found it did not apply as the 90-day publication timeline had passed. The Commissioner ordered DFO to fully disclose the records, and DFO agreed to comply.

• Whether the information was financial, commercial, scientific, or technical under s.20(1)(b) ATIA
• Whether the information was objectively confidential under s.20(1)(b) ATIA
• Whether the information was supplied by a third party under s.20(1)(b) ATIA
• Whether the third party consistently treated the information as confidential under s.20(1)(b) ATIA
• Whether the information would be published by a government institution within 90 days under s.26 ATIA

The Office of the Privacy Commissioner (OPC) investigated complaints against the NSIRA Secretariat regarding its access to sensitive polygraph records during a review of the Communications Security Establishment's (CSE) Internal Security Program. Complainants questioned whether the collection of personal information complied with section 4 of the Privacy Act and if the Secretariat met its Personal Information Bank (PIB) obligations under section 10. The OPC found that while some un-redacted elements in security screening files posed a re-identification risk, the polygraph recordings themselves were sufficiently anonymized. Given NSIRA's broad mandate and right of access, the OPC concluded the collection issue was not well-founded. However, the Secretariat's delay in requesting approval for PIB changes was found well-founded, though resolved by subsequent submission. The OPC recommended the Secretariat prioritize PIB approvals and publish its Info Source page for transparency. The Secretariat committed to these actions.

• Whether the NSIRA Secretariat's collection of personal information (polygraph records) complied with section 4 of the Privacy Act.
• Whether the anonymization measures applied to polygraph records were sufficient to prevent re-identification.
• Whether the NSIRA Secretariat's viewing of personal information, even if not recorded, constituted a 'collection' under section 4.
• Whether the NSIRA Secretariat met its obligations under section 10 of the Privacy Act regarding Personal Information Banks (PIBs).
• Whether the NSIRA Secretariat's request for PIB approval was timely.
• Whether the NSIRA Secretariat published its Info Source page as required by TBS policy.