Canadian privacy & access decisions

The complainant alleged that Transport Canada improperly withheld information under subsection 19(1) and paragraph 20(1)(b) of the Access to Information Act, related to applications and Minimum Safe Manning Documents for the motor vessel Spirit of Vancouver Island. The complaint regarding subsection 19(1) was later removed from the investigation's scope. During the investigation, Transport Canada also applied paragraph 20(1)(b.1) to one document. The Commissioner found that while portions of one document met the requirements of paragraph 20(1)(b.1), the titles and headings did not. Furthermore, neither Transport Canada nor the third party provided sufficient representations to justify withholding information under paragraph 20(1)(b), except for the titles and headings of the document also claimed under 20(1)(b.1). The Commissioner ordered Transport Canada to disclose all information withheld under paragraphs 20(1)(b) and 20(1)(b.1), with the exception of the main content of page 50, and to disclose the titles and headings on page 50. Transport Canada indicated it would "likely" comply with the order.

• Whether s.19(1) personal information was properly withheld
• Whether s.20(1)(b) confidential third-party financial, commercial, scientific or technical information was properly withheld
• Whether s.20(1)(b.1) third-party emergency management plans information was properly withheld
• Whether the information concerned critical infrastructure information under s.20(1)(b.1)
• Whether the information was supplied in confidence under s.20(1)(b.1)
• Whether the information was supplied for the preparation, maintenance, testing or implementation of emergency management plans under s.20(1)(b.1)
• Whether Transport Canada reasonably exercised its discretion under s.20(5) regarding s.20(1)(b.1)
• Whether Transport Canada reasonably exercised its discretion under s.20(6) regarding s.20(1)(b.1)
• Whether the information was financial, commercial, scientific or technical under s.20(1)(b)
• Whether the information was confidential under s.20(1)(b)
• Whether the third party supplied the information to a government institution under s.20(1)(b)
• Whether the third party consistently treated the information as confidential under s.20(1)(b)

An employee of the Immigration and Refugee Board of Canada (IRB) complained that their intimate personal and sensitive medical information, contained in a Fitness to Work (FTW) report, was disclosed to their management team without consent and for no reasonable purpose. The OPC investigated whether the IRB respected section 8 of the Privacy Act, specifically regarding consent and consistent use. The IRB argued the disclosure was a consistent use, but the OPC found that while some information disclosure was consistent, the highly intimate personal and sensitive medical information was not. The OPC concluded that the IRB contravened the Act by disclosing information internally that fell outside what is permissible. Despite some new processes, the IRB did not fully acknowledge wrongdoing or agree to all recommendations, leading to a well-founded and unresolved finding.

• Whether the IRB obtained valid consent for the disclosure of the FTW report to the management team under section 8(1) of the Privacy Act
• Whether the disclosure of intimate personal and sensitive medical information in the FTW report to the management team was a 'consistent use' under section 8(2)(a) of the Privacy Act
• Whether the IRB adhered to the Treasury Board Secretariat's Occupational Health Evaluation Standard regarding disclosure of medical information to employers

The complainant alleged that Public Safety Canada (Public Safety) took an unreasonable extension of time to respond to an access request for correspondence between Public Safety and the Royal Canadian Mounted Police (RCMP). Public Safety claimed a 240-day extension under paragraphs 9(1)(a) and 9(1)(b) of the Access to Information Act. The Commissioner found that Public Safety properly notified the complainant of the extension. However, Public Safety failed to demonstrate that the request involved a large number of records or that processing it within 30 days would unreasonably interfere with its operations, thus not meeting the requirements of paragraph 9(1)(a). While Public Safety needed to consult with the RCMP, the Commissioner found the 180-day consultation period requested by the RCMP, based on service standards rather than complexity, to be unreasonable. Consequently, the Commissioner concluded that Public Safety did not meet the requirements for a valid extension under either paragraph 9(1)(a) or 9(1)(b), rendering the extension invalid. Public Safety was deemed to have refused access under subsection 10(3) of the Act.

• Whether the institution properly notified the complainant of the extension of time
• Whether the access request was for a large number of records under s.9(1)(a)
• Whether meeting the 30-day deadline would unreasonably interfere with the institution's operations under s.9(1)(a)
• Whether the institution needed to carry out consultations on the requested records under s.9(1)(b)
• Whether the consultations could reasonably be completed within 30 days under s.9(1)(b)
• Whether the extension of time was for a reasonable period under s.9(1)(b)
• Whether the institution responded within the time limits

The complainant alleged that the Public Health Agency of Canada (PHAC) failed to conduct a reasonable search for records in response to two access requests. The requests sought electronic records related to masks, sent or received by a specific warehouse manager within defined timeframes. Initially, PHAC found no responsive records because the employee had deleted their entire mailbox, considering the contents transitory. During the OIC's investigation, PHAC conducted additional searches using IT forensics and identified 107 pages of responsive records, which were subsequently released. The Commissioner found that PHAC's initial search was inadequate as it did not consider other potential sources of records, such as emails sent to or from the employee by others, or corporate repositories. Despite the subsequent release of records and PHAC's commitment to an action plan for improved information management, the Commissioner concluded that the complaints were well founded due to the initial failure to conduct a reasonable search.

• Whether the Public Health Agency of Canada conducted a reasonable search for records in response to the first access request (5820-04413)
• Whether the Public Health Agency of Canada conducted a reasonable search for records in response to the second access request (5820-04414)
• Whether the deletion of an employee's email account impacted the ability to conduct a reasonable search
• Whether PHAC considered all reasonable sources for responsive records

The complainant alleged that Public Services and Procurement Canada (PSPC) failed to respond to an access request for records concerning the procurement of new handguns for the military within the 30-day statutory time limit. PSPC received the request on June 4, 2021, and the response was due by July 5, 2021, but no response was provided. PSPC cited a backlog, operational challenges, heavy workloads, staff turnover, and competing priorities as reasons for the delay, and indicated a plan to respond by February 28, 2025. The Commissioner found that PSPC's reasons, including staffing shortages and the need for inter-institutional consultations, did not absolve it of its statutory obligation to provide a timely response. The Commissioner concluded that PSPC failed to meet its obligations under the Act and was deemed to have refused access. The complaint was found to be well founded, and PSPC was ordered to provide a complete response within 36 business days, an order which PSPC indicated it would not fully implement.

• Whether the institution responded to the access request within the 30-day time limit set out in section 7 of the Access to Information Act
• Whether the institution's reasons for delay (backlog, operational challenges, staff turnover, competing priorities, inter-institutional consultations) absolved it of its statutory obligation to respond within the time limit

The complainant alleged that National Defence (DND) failed to respond to an access request within the 30-day statutory period, leading to a deemed refusal. The request sought records related to strategic communications campaigns concerning perceptions about drones. DND argued that the request did not meet the requirements of section 6 of the Access to Information Act, claiming it lacked sufficient detail to identify records with reasonable effort. The Information Commissioner found that the request, which included a timeframe and subject, provided sufficient detail for an experienced employee to identify the records. The Commissioner also rejected DND's arguments that parts of the request were hypothetical or related to external academic papers. Consequently, DND was found to be in a state of deemed refusal. The complaint was well founded, and DND was ordered to provide a complete response to the access request.

• Whether National Defence responded to the access request within the 30-day period set out in section 7 of the Act
• Whether the access request met the requirements of section 6 of the Act to provide sufficient detail to identify records with reasonable effort
• Whether the request for 'strategic communications campaign(s)' was too broad
• Whether parts of the request were related to a hypothetical strategic communications plan
• Whether parts of the request were related to an academic paper not available within DND/CAF

The complainant alleged that the Canadian Security Intelligence Service (CSIS) failed to sufficiently identify redacted portions of records and the basis for withholding information in response to an access request for historical information about Warren Hart. CSIS used negative (white) redactions and cited exemptions only in the response letter, arguing that marking redactions on the records could cause harm. The Information Commissioner found that CSIS did not provide a cogent explanation for how clearly marked redactions and exemptions would reveal protected information. The Commissioner concluded that CSIS failed to meet its obligations regarding severance and the duty to assist. CSIS was recommended to provide a new response with clearly identified redactions and specific exemption provisions, and to cease using negative redactions and citing exemptions only in response letters. CSIS agreed to implement these recommendations.

• Whether CSIS sufficiently identified redacted portions of records
• Whether CSIS sufficiently identified the basis for withholding information
• Whether the use of negative (white) redactions by CSIS was appropriate
• Whether citing exemptions only in response letters by CSIS was appropriate
• Whether CSIS's practice contravened the duty to assist under subsection 4(2.1) ATIA
• Whether CSIS's practice contravened the severance requirement under section 25 ATIA
• Whether clearly marking redactions and exemptions on records would reveal protected information or cause harm

The complainant alleged that National Defence (DND) failed to conduct a reasonable search for records related to unidentified aerial phenomena (UAP) held by two named individuals. The investigation revealed that DND's Office of Primary Interest misread the request, limiting the search to only 'reports of UAP' instead of the broader 'general subject of UAP', and also unnecessarily restricted its search to keywords. The Office of the Information Commissioner (OIC) requested DND to perform an additional search, which resulted in the retrieval of 11 additional pages of records. The Commissioner concluded that DND did not conduct a reasonable search. The complaint was found to be well founded, and DND was ordered to provide access to the additional records.

• Whether National Defence conducted a reasonable search for records
• Whether the Office of Primary Interest misread the access request
• Whether limiting the search to keywords constituted a reasonable search

An individual complained that Transport Canada collected his personal information for the "Incentives for Zero-Emission Vehicles Program" (iZEV) without a publicly available Personal Information Bank (PIB) description, as required by the Privacy Act. Transport Canada launched the iZEV program in May 2019 but did not submit a PIB description to the Treasury Board Secretariat (TBS) for approval until 19 months later. The OPC found that both Transport Canada and TBS contributed to the contravention, as TBS failed to approve and publish the PIB description in a timely manner. Although Transport Canada eventually published the PIB, TBS declined to implement the OPC's recommendations for service standards, citing complexity, but outlined internal process improvements. The OPC acknowledged TBS's efforts to address the backlog.

• Whether Transport Canada failed to ensure personal information collected for the iZEV program was included in a publicly available PIB description as required by section 10 of the Privacy Act
• Whether Transport Canada obtained TBS approval for a new PIB before implementing the iZEV program as required by subsection 71(4) of the Privacy Act and the TBS Directive on Privacy Impact Assessment
• Whether TBS fulfilled its responsibility under section 11 of the Privacy Act to ensure timely publication of PIB descriptions
• Whether the lack of a timely PIB approval process by TBS impacts the operability of the PIB regime under the Privacy Act

Twenty complainants, current or former federal government employees, alleged that the Treasury Board of Canada Secretariat (TBS) improperly disclosed their personal information. TBS mistakenly sent two emails to 400 applicants for the Severe Phoenix Impacts program using the 'cc' field instead of 'bcc', revealing email addresses (some with names) and the fact they had filed a claim for Phoenix-related damages. The OPC found that the disclosure was not authorized under the Privacy Act, making the complaints well-founded. While TBS acknowledged the error, it initially deemed the breach non-material, a conclusion the OPC disagreed with, emphasizing the importance of contextual factors in assessing harm. TBS agreed to implement two of the OPC's three recommendations, but not the one concerning incorporating the findings on materiality into its policy instruments. The OPC concluded the complaints were well-founded and conditionally resolved in part, expressing ongoing concern about TBS's assessment of breach materiality.

• Whether the disclosure of personal information via email was authorized under the Privacy Act
• Whether the privacy breach was 'material' in nature according to TBS's guidelines
• Whether TBS's assessment of the breach's materiality was appropriate
• Whether the context of the personal information disclosed should be considered when assessing the risk of injury or harm

The complainant alleged that Library and Archives Canada (LAC) improperly withheld information under subsection 15(1) of the Access to Information Act, concerning records of the Intelligence Advisory Committee from 1989-1995. These records pertained to migration trends and global developments. The Office of the Information Commissioner (OIC) found that the Canadian Government had previously disclosed similar records and that the information reflected public and Parliamentary debate, leading the OIC to conclude that disclosure would not harm national security or international relations. Consequently, the OIC determined that the requirements for exemption under subsection 15(1) were not met. As a result of the OIC's intervention, LAC disclosed the records in their entirety on January 20, 2023. The complainant expressed satisfaction with this disclosure.

• Whether s.15(1) ATIA (national security and international relations) was properly applied to records of the Intelligence Advisory Committee, 1989-1995
• Whether disclosure of the records would cause harm to national security or international relations

An institution applied to the Information Commissioner under subsection 6.1(1) of the Access to Information Act to decline to act on an access request, arguing it was vexatious and an abuse of the right to make a request. The request sought all emails, text messages, and digital files from three Human Resources employees from the start of their employment. The Commissioner found that the institution had fulfilled its duty to assist the requester by attempting to clarify the overly broad request and explaining the significant burden it would impose. Despite these efforts, the requester refused to narrow the scope, stating the broadness was intentional to uncover potential misconduct. The Commissioner concluded that the request constituted an abuse of the right of access due to its excessive breadth, the undue burden it placed on the institution, and its potential to impede the rights of other requesters. Consequently, the Commissioner granted the institution's application.

• Whether the access request was an abuse of the right to make a request under s.6.1(1) ATIA
• Whether the institution fulfilled its duty to assist obligations under s.4(2.1) ATIA
• Whether the access request was vexatious under s.6.1(1) ATIA

The complainant alleged that Home Depot disclosed his personal information to Meta (formerly Facebook) without his knowledge and consent. Home Depot was sending in-store customers' hashed email addresses and purchase details to Meta via an "Offline Conversions" tool when customers requested an e-receipt. This data allowed Meta to measure ad effectiveness and use the information for its own business purposes, including targeted advertising. The OPC found that Home Depot failed to obtain valid consent, as its privacy statement was not readily available or sufficiently clear, and customers would not reasonably expect such disclosure. Home Depot discontinued the use of the tool in October 2022 in response to OPC recommendations. The complaint was deemed well-founded and resolved.

• Whether Home Depot obtained valid consent for disclosing customer personal information to Meta
• Whether the disclosure of personal information to Meta constituted a processing activity not requiring additional consent
• Whether Home Depot's Privacy Statement and Meta's Privacy Policy were sufficient to obtain meaningful implied consent
• Whether express opt-in consent was required for the disclosure of customer information to Meta
• Whether the information disclosed was sensitive
• Whether the disclosure was within the reasonable expectations of the individual
• Whether the ability to withdraw consent after the fact was sufficient

The complainant alleged that Transport Canada improperly withheld information under subsection 19(1) (personal information) and paragraph 20(1)(b) (confidential third-party financial, commercial, scientific or technical information) of the Access to Information Act. The request sought information related to applications and Minimum Safe Manning (MSM) Documents for the passenger ship, Queen of Cumberland. During the investigation, the complainant removed the s.19(1) aspect from the complaint. The OIC found that Transport Canada and the third party (BC Ferries) failed to demonstrate that all requirements for the s.20(1)(b) exemption were met. Specifically, the OIC was not convinced that all information was financial, commercial, scientific, or technical, nor that it was consistently treated as confidential or supplied by the third party. Consequently, the Commissioner ordered Transport Canada to disclose the information withheld under paragraph 20(1)(b). Transport Canada indicated it would likely comply with the order.

• Whether the information is financial, commercial, scientific or technical under s.20(1)(b)
• Whether the information is confidential under s.20(1)(b)
• Whether the information was supplied to a government institution by a third party under s.20(1)(b)
• Whether the third party has consistently treated the information as confidential under s.20(1)(b)
• Whether the relationship between the government and the third party is fostered for public benefit by the confidential communication

The complainant alleged that Employment and Social Development Canada (ESDC) improperly withheld information under subsections 19(1), 20(1)(b), and 24(1) of the Access to Information Act regarding records about Canadian universities' engagement in the Federal Contractors Program. The OIC removed the s.24(1) claim from the scope of the complaint as the only information withheld under it (business numbers) was no longer at issue. The Commissioner found that ESDC did not demonstrate that all information withheld under s.19(1) was personal information about identifiable individuals, nor did it appropriately exercise its discretion under s.19(2)(b). Furthermore, neither ESDC nor the third party (University of Waterloo) demonstrated that the requirements of s.20(1)(b) were met for a completed Employment Equity Achievement Awards Application Form. The complaint was found to be well founded, and the Commissioner ordered ESDC to disclose the information at issue. ESDC subsequently gave notice that it would fully implement the order.

• Whether information withheld under s.19(1) was personal information about identifiable individuals
• Whether ESDC properly severed non-personal information from personal information under s.19(1)
• Whether ESDC reasonably exercised its discretion under s.19(2)(b) regarding publicly available information
• Whether the Employment Equity Achievement Awards Application Form met the requirements of s.20(1)(b)
• Whether the information was financial, commercial, scientific or technical under s.20(1)(b)
• Whether the information was confidential under s.20(1)(b)
• Whether the third party consistently treated the information as confidential under s.20(1)(b)