Canadian privacy & access decisions

The complainant alleged that National Defence (DND) failed to conduct a reasonable search for records related to unidentified aerial phenomena (UAP) held by two named individuals. The investigation revealed that DND's Office of Primary Interest misread the request, limiting the search to only 'reports of UAP' instead of the broader 'general subject of UAP', and also unnecessarily restricted its search to keywords. The Office of the Information Commissioner (OIC) requested DND to perform an additional search, which resulted in the retrieval of 11 additional pages of records. The Commissioner concluded that DND did not conduct a reasonable search. The complaint was found to be well founded, and DND was ordered to provide access to the additional records.

• Whether National Defence conducted a reasonable search for records
• Whether the Office of Primary Interest misread the access request
• Whether limiting the search to keywords constituted a reasonable search

An individual complained that Transport Canada collected his personal information for the "Incentives for Zero-Emission Vehicles Program" (iZEV) without a publicly available Personal Information Bank (PIB) description, as required by the Privacy Act. Transport Canada launched the iZEV program in May 2019 but did not submit a PIB description to the Treasury Board Secretariat (TBS) for approval until 19 months later. The OPC found that both Transport Canada and TBS contributed to the contravention, as TBS failed to approve and publish the PIB description in a timely manner. Although Transport Canada eventually published the PIB, TBS declined to implement the OPC's recommendations for service standards, citing complexity, but outlined internal process improvements. The OPC acknowledged TBS's efforts to address the backlog.

• Whether Transport Canada failed to ensure personal information collected for the iZEV program was included in a publicly available PIB description as required by section 10 of the Privacy Act
• Whether Transport Canada obtained TBS approval for a new PIB before implementing the iZEV program as required by subsection 71(4) of the Privacy Act and the TBS Directive on Privacy Impact Assessment
• Whether TBS fulfilled its responsibility under section 11 of the Privacy Act to ensure timely publication of PIB descriptions
• Whether the lack of a timely PIB approval process by TBS impacts the operability of the PIB regime under the Privacy Act

Twenty complainants, current or former federal government employees, alleged that the Treasury Board of Canada Secretariat (TBS) improperly disclosed their personal information. TBS mistakenly sent two emails to 400 applicants for the Severe Phoenix Impacts program using the 'cc' field instead of 'bcc', revealing email addresses (some with names) and the fact they had filed a claim for Phoenix-related damages. The OPC found that the disclosure was not authorized under the Privacy Act, making the complaints well-founded. While TBS acknowledged the error, it initially deemed the breach non-material, a conclusion the OPC disagreed with, emphasizing the importance of contextual factors in assessing harm. TBS agreed to implement two of the OPC's three recommendations, but not the one concerning incorporating the findings on materiality into its policy instruments. The OPC concluded the complaints were well-founded and conditionally resolved in part, expressing ongoing concern about TBS's assessment of breach materiality.

• Whether the disclosure of personal information via email was authorized under the Privacy Act
• Whether the privacy breach was 'material' in nature according to TBS's guidelines
• Whether TBS's assessment of the breach's materiality was appropriate
• Whether the context of the personal information disclosed should be considered when assessing the risk of injury or harm

The complainant alleged that Library and Archives Canada (LAC) improperly withheld information under subsection 15(1) of the Access to Information Act, concerning records of the Intelligence Advisory Committee from 1989-1995. These records pertained to migration trends and global developments. The Office of the Information Commissioner (OIC) found that the Canadian Government had previously disclosed similar records and that the information reflected public and Parliamentary debate, leading the OIC to conclude that disclosure would not harm national security or international relations. Consequently, the OIC determined that the requirements for exemption under subsection 15(1) were not met. As a result of the OIC's intervention, LAC disclosed the records in their entirety on January 20, 2023. The complainant expressed satisfaction with this disclosure.

• Whether s.15(1) ATIA (national security and international relations) was properly applied to records of the Intelligence Advisory Committee, 1989-1995
• Whether disclosure of the records would cause harm to national security or international relations

An institution applied to the Information Commissioner under subsection 6.1(1) of the Access to Information Act to decline to act on an access request, arguing it was vexatious and an abuse of the right to make a request. The request sought all emails, text messages, and digital files from three Human Resources employees from the start of their employment. The Commissioner found that the institution had fulfilled its duty to assist the requester by attempting to clarify the overly broad request and explaining the significant burden it would impose. Despite these efforts, the requester refused to narrow the scope, stating the broadness was intentional to uncover potential misconduct. The Commissioner concluded that the request constituted an abuse of the right of access due to its excessive breadth, the undue burden it placed on the institution, and its potential to impede the rights of other requesters. Consequently, the Commissioner granted the institution's application.

• Whether the access request was an abuse of the right to make a request under s.6.1(1) ATIA
• Whether the institution fulfilled its duty to assist obligations under s.4(2.1) ATIA
• Whether the access request was vexatious under s.6.1(1) ATIA

The complainant alleged that Home Depot disclosed his personal information to Meta (formerly Facebook) without his knowledge and consent. Home Depot was sending in-store customers' hashed email addresses and purchase details to Meta via an "Offline Conversions" tool when customers requested an e-receipt. This data allowed Meta to measure ad effectiveness and use the information for its own business purposes, including targeted advertising. The OPC found that Home Depot failed to obtain valid consent, as its privacy statement was not readily available or sufficiently clear, and customers would not reasonably expect such disclosure. Home Depot discontinued the use of the tool in October 2022 in response to OPC recommendations. The complaint was deemed well-founded and resolved.

• Whether Home Depot obtained valid consent for disclosing customer personal information to Meta
• Whether the disclosure of personal information to Meta constituted a processing activity not requiring additional consent
• Whether Home Depot's Privacy Statement and Meta's Privacy Policy were sufficient to obtain meaningful implied consent
• Whether express opt-in consent was required for the disclosure of customer information to Meta
• Whether the information disclosed was sensitive
• Whether the disclosure was within the reasonable expectations of the individual
• Whether the ability to withdraw consent after the fact was sufficient

The complainant alleged that Transport Canada improperly withheld information under subsection 19(1) (personal information) and paragraph 20(1)(b) (confidential third-party financial, commercial, scientific or technical information) of the Access to Information Act. The request sought information related to applications and Minimum Safe Manning (MSM) Documents for the passenger ship, Queen of Cumberland. During the investigation, the complainant removed the s.19(1) aspect from the complaint. The OIC found that Transport Canada and the third party (BC Ferries) failed to demonstrate that all requirements for the s.20(1)(b) exemption were met. Specifically, the OIC was not convinced that all information was financial, commercial, scientific, or technical, nor that it was consistently treated as confidential or supplied by the third party. Consequently, the Commissioner ordered Transport Canada to disclose the information withheld under paragraph 20(1)(b). Transport Canada indicated it would likely comply with the order.

• Whether the information is financial, commercial, scientific or technical under s.20(1)(b)
• Whether the information is confidential under s.20(1)(b)
• Whether the information was supplied to a government institution by a third party under s.20(1)(b)
• Whether the third party has consistently treated the information as confidential under s.20(1)(b)
• Whether the relationship between the government and the third party is fostered for public benefit by the confidential communication

The complainant alleged that Employment and Social Development Canada (ESDC) improperly withheld information under subsections 19(1), 20(1)(b), and 24(1) of the Access to Information Act regarding records about Canadian universities' engagement in the Federal Contractors Program. The OIC removed the s.24(1) claim from the scope of the complaint as the only information withheld under it (business numbers) was no longer at issue. The Commissioner found that ESDC did not demonstrate that all information withheld under s.19(1) was personal information about identifiable individuals, nor did it appropriately exercise its discretion under s.19(2)(b). Furthermore, neither ESDC nor the third party (University of Waterloo) demonstrated that the requirements of s.20(1)(b) were met for a completed Employment Equity Achievement Awards Application Form. The complaint was found to be well founded, and the Commissioner ordered ESDC to disclose the information at issue. ESDC subsequently gave notice that it would fully implement the order.

• Whether information withheld under s.19(1) was personal information about identifiable individuals
• Whether ESDC properly severed non-personal information from personal information under s.19(1)
• Whether ESDC reasonably exercised its discretion under s.19(2)(b) regarding publicly available information
• Whether the Employment Equity Achievement Awards Application Form met the requirements of s.20(1)(b)
• Whether the information was financial, commercial, scientific or technical under s.20(1)(b)
• Whether the information was confidential under s.20(1)(b)
• Whether the third party consistently treated the information as confidential under s.20(1)(b)

The complainant alleged that Trans Mountain Corporation (TMC) improperly responded to an access request by invoking subsection 10(2) of the Access to Information Act, neither confirming nor denying the existence of records, and stating that if records existed, they would be withheld under subsection 16(2). The OIC found that TMC failed to demonstrate that the existence or absence of records itself warranted withholding, especially since TMC had previously confirmed the existence of similar records in response to a nearly identical request. The Commissioner also determined that TMC did not show how all responsive records, if they existed, could reasonably be expected to facilitate the commission of an offence under subsection 16(2). Consequently, the Commissioner concluded that TMC's reliance on subsection 10(2) was not justified. The complaint was found to be well founded, and TMC was ordered to provide a new response confirming or denying the existence of records and, if records exist, to provide access unless a specific exemption applies.

• Whether the institution met the requirements for invoking subsection 10(2) of the ATIA
• Whether the existence or absence of records itself is information that warrants being withheld under the Act
• Whether, if responsive records existed, they could reasonably be exempted under specific provisions of the Act
• Whether the institution's reliance on subsection 10(2) was a reasonable exercise of discretion
• Whether disclosure of records could reasonably be expected to facilitate the commission of an offence under subsection 16(2)

The complainant alleged that the Royal Canadian Mounted Police (RCMP) failed to conduct a reasonable search for records in response to an access request. The request sought the total annual amount paid by the RCMP due to sexual harassment/assault from 2009 to 2020. The RCMP disclosed information related to two publicly known class action settlements but stated it could not identify other relevant payments from its general ledger due to confidentiality and the ledger's design, which does not detail the nature of settlement claims. The investigation confirmed that the RCMP's general ledger does not capture the specific nature of settlement payments, making it impossible to identify those related to sexual harassment/assault. Furthermore, the RCMP did not maintain a comprehensive list of such payments, and creating one would require an unreasonable review of thousands of files. The Information Commissioner concluded that the RCMP conducted a reasonable search by disclosing the only information it could reasonably compile.

• Whether the institution conducted a reasonable search for records under the Access to Information Act

The complainant alleged that Environment and Climate Change Canada (ECCC) improperly withheld information related to the Roberts Bank Terminal 2 Project, specifically concerning biofilm and shorebirds, under several exemptions of the Access to Information Act. The complaint initially included exemptions s.16(2) and s.19(1), but these were later removed from the scope of the investigation. The OIC found that ECCC had appropriately applied s.21(1)(a) and s.21(1)(b) to most of the withheld records, as they constituted advice, recommendations, or accounts of consultations. However, ECCC's application of s.20(1)(b), s.21(1)(a), and s.21(1)(b) to a scientific manuscript was deemed improper, as the manuscript was found not to be confidential and ECCC later agreed to its disclosure. The Commissioner also noted inconsistencies in ECCC's disclosure practices. The complaint was found to be well founded, and ECCC was ordered to disclose the manuscript and correct the inconsistencies.

• Whether s.16(2) ATIA (facilitating the commission of an offence) was properly applied (removed from scope)
• Whether s.19(1) ATIA (personal information) was properly applied (removed from scope)
• Whether s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information) was properly applied to the scientific manuscript
• Whether the scientific manuscript was 'financial, commercial, scientific or technical' information under s.20(1)(b)
• Whether the scientific manuscript was 'confidential' under s.20(1)(b) (Air Atonabee test)
• Whether the information in the scientific manuscript was supplied by a third party under s.20(1)(b)
• Whether the third party consistently treated the information in the scientific manuscript as confidential under s.20(1)(b)
• Whether s.21(1)(a) ATIA (advice or recommendations) was properly applied to the scientific manuscript
• Whether s.21(1)(b) ATIA (accounts of consultations or deliberations) was properly applied to the scientific manuscript
• Whether s.21(1)(a) ATIA (advice or recommendations) was properly applied to other records
• Whether s.21(1)(b) ATIA (accounts of consultations or deliberations) was properly applied to other records
• Whether ECCC reasonably exercised its discretion to disclose information under s.21(1)(a) and s.21(1)(b)
• Whether there were inconsistencies in ECCC's disclosure of information

The complainant alleged that the Department of Justice Canada (Justice) improperly withheld information under various sections of the Access to Information Act, including s.16(2), s.19(1), s.21(1)(a), s.21(1)(b), s.23, and s.69(1), related to the Alternate Independent Process for St-Anne’s Residential School hearings. During the investigation, the complainant withdrew the s.19(1) allegation. The Commissioner found that Justice appropriately applied s.16(2), s.21(1)(a), s.21(1)(b), and s.69(1). However, Justice could not demonstrate that all information withheld under s.23 (solicitor-client and litigation privilege) met the exemption's requirements, particularly regarding communications outside the direct solicitor-client relationship or where common interest privilege was not established. The Commissioner recommended disclosure of the improperly withheld s.23 information. Justice maintained its position on s.23 but committed to reviewing the records for potential disclosure. The complaint was found to be well founded.

• Whether s.16(2) facilitating the commission of an offence was properly applied
• Whether discretion was reasonably exercised for s.16(2)
• Whether s.21(1)(a) advice or recommendations was properly applied
• Whether discretion was reasonably exercised for s.21(1)(a)
• Whether s.21(1)(b) accounts of consultations or deliberations was properly applied
• Whether discretion was reasonably exercised for s.21(1)(b)
• Whether s.23 solicitor-client privilege was properly applied to all communications
• Whether s.23 litigation privilege was properly applied to all communications
• Whether common interest privilege was established for s.23 claims
• Whether discretion was reasonably exercised for s.23
• Whether s.69(1) Cabinet confidences was properly applied

The Office of the Information Commissioner (OIC) received a complaint alleging that a federal institution failed to respond within an extended timeframe for an access request and engaged in inappropriate communication. The OIC accepted the complaint regarding the delay but deemed the complaint about inappropriate communication inadmissible. The institution had, on May 2, 2022, suggested the requester abandon their request, which the requester declined on May 22, 2022. The complainant argued the 60-day period for filing a complaint about the communication started when the extended response timeframe expired on August 25, 2022. However, the OIC determined that the alleged inappropriate conduct occurred on May 2, 2022, when the institution first communicated its proposal regarding the request. Since the complaint about communication was filed after the mandatory 60-day limit from May 2, 2022, the Commissioner found it inadmissible.

• Whether the institution responded within the extended timeframe for an access request
• Whether the complaint regarding the institution's alleged inappropriate communication was submitted within the 60-day time limit under s.31 ATIA
• When the complainant became aware of the grounds for complaint regarding alleged inappropriate communication

The complainant alleged that Library and Archives Canada (LAC) improperly withheld information under section 23 (solicitor-client privilege) of the Access to Information Act, concerning regulations under the Food and Drugs Act and related litigation. The Information Commissioner found that the withheld information did meet the requirements for solicitor-client privilege. However, LAC failed to demonstrate that it had reasonably exercised its discretion in deciding whether to disclose the information, as it did not provide evidence of considering all relevant factors for and against disclosure. The Commissioner noted that the records were nearly 90 years old and had historical significance, suggesting that exceptional circumstances might exist to warrant disclosure. Consequently, the Commissioner ordered LAC to re-exercise its discretion, taking into account all relevant factors, including the age and historical significance of the records. LAC agreed to implement the order.

• Whether the information met the requirements of s.23 ATIA (solicitor-client privilege)
• Whether the communications were between a lawyer/notary and client
• Whether the communications related to seeking or giving legal advice
• Whether the parties intended the communication to remain confidential
• Whether there was an implied waiver of solicitor-client privilege due to prior disclosure
• Whether there was a selective waiver of privilege
• Whether LAC reasonably exercised its discretion to disclose the information under s.23 ATIA
• Whether LAC considered all relevant factors for and against disclosure

The complainant alleged that Health Canada improperly withheld information under paragraphs 20(1)(b) and 20(1)(c) of the Access to Information Act. The request sought two versions of a non-clinical overview of the Novavax SARS CoV-2 rS vaccine. Health Canada applied paragraph 20(1)(b) to withhold the information, arguing it was confidential third-party scientific or technical information. The OIC found that the information met all criteria for exemption under paragraph 20(1)(b), including being scientific/technical, confidential, supplied by a third party, and consistently treated as confidential. The OIC also concluded that the circumstances requiring Health Canada to exercise discretion under subsections 20(5) or 20(6) did not exist, as Novavax did not consent to disclosure and the public interest in disclosure did not clearly outweigh potential harm to Novavax at the time of the decision. Consequently, the complaint was deemed not well founded.

• Whether the information is financial, commercial, scientific or technical under s.20(1)(b) ATIA
• Whether the information is confidential under s.20(1)(b) ATIA
• Whether the information was supplied by a third party under s.20(1)(b) ATIA
• Whether the third party consistently treated the information as confidential under s.20(1)(b) ATIA
• Whether the institution reasonably exercised its discretion to disclose under s.20(5) ATIA
• Whether the institution reasonably exercised its discretion to disclose under s.20(6) ATIA
• Whether s.20(1)(c) ATIA applies to the information