Canadian Privacy Decisions

The complainant alleged that the Canadian Broadcasting Corporation (CBC) improperly withheld information regarding the total remuneration of its highest-paid unionized employees. The CBC claimed exemptions under paragraph 18(b) (competitive position) for specific salary figures. The Information Commissioner found that disclosing these exact salaries could indeed harm the CBC's competitive position in a limited market, and that the CBC reasonably exercised its discretion in withholding the information. Therefore, the complaint was found not well founded.

• Proper application of paragraph 18(b) of the Access to Information Act
• Reasonable expectation of harm to the institution's competitive position
• Reasonable exercise of discretion by the institution to withhold information

The complainant alleged that Employment and Social Development Canada (ESDC) improperly withheld information related to a contract for an Access to Information consultant. ESDC claimed exemptions for personal information, financial impact on third parties, consultations or deliberations, solicitor-client privilege, and restrictions by other laws. The Information Commissioner found that ESDC improperly withheld information concerning the consultant's job duties and experience, some third-party financial details, and certain accounts of deliberations. The Commissioner ordered ESDC to disclose this information and to re-evaluate consent for some personal information.

• Proper application of subsection 19(1) (personal information)
• Proper application of paragraph 20(1)(c) (financial impact on third party)
• Proper application of paragraph 21(1)(b) (accounts of consultations or deliberations)
• Reasonable exercise of discretion for exemptions

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) improperly withheld "Repayments to Date" figures for 12 third parties under paragraph 20(1)(c) of the Access to Information Act. The institution and several third parties argued that disclosure could harm competitive positions or financial interests. The Information Commissioner found that neither ISED nor the third parties met the burden of proving that disclosure would cause harm beyond the merely possible. The Commissioner ordered ISED to disclose the information.

• Whether the "Repayments to Date" figures met the requirements for exemption under paragraph 20(1)(c) of the ATIA regarding financial impact on a third party.
• Whether the "Repayments to Date" figures met the requirements for exemption under paragraph 20(1)(d) of the ATIA regarding interference with third-party negotiations.
• Whether the third parties or the institution met their burden of proof to demonstrate that disclosure would cause harm beyond the merely possible.
• Whether the disclosure of the information was in the public interest.

The institution applied to the Information Commissioner to decline to act on an access request, arguing it was vexatious and an abuse of the right to access information. The requester had made multiple, repetitive requests for similar information, much of which had already been provided to them. The Commissioner found the request to be an abuse of the access right due to this pattern of behaviour and the fact that the requester was not seeking new information. The Commissioner also found that the institution had fulfilled its duty to assist the requester.

• Whether the access request constituted an abuse of the right of access.
• Whether the institution met its duty to assist obligations.
• Whether the access request was vexatious.

The Information Commissioner of Canada gave notice that she ceased to investigate a complaint. The Commissioner determined the complaint was trivial, as the complainant wished to pursue the matter as a point of principle, despite the issue having already been settled and showing a seeming lack of interest in obtaining the records.

• Whether the complaint was trivial, frivolous, or vexatious under subsection 30(4)(a) of the ATIA.

The complainant requested the Canada Emergency Wage Subsidy (CEWS) database for all recipient corporations from the Canada Revenue Agency (CRA). The CRA withheld the total amount of CEWS received by each company, citing exemptions under the Access to Information Act (ATIA), including subsection 24(1) (disclosure restricted by another law). The OIC found that the withheld information was about identifiable taxpayers and was prepared for the purposes of administering the Income Tax Act, and therefore properly withheld under subsection 24(1). Consequently, the complaint was found not well founded.

• Whether the CEWS database information was properly withheld under subsection 24(1) of the ATIA, citing section 241 of the Income Tax Act.
• Whether the information was properly withheld under paragraph 16(1)(c) (conduct of investigations) and subsection 19(1) (personal information) of the ATIA.

The complainant alleged that Public Services and Procurement Canada (PSPC) failed to respond to an access request for documents concerning the Copyright Media Clearance Program by the extended deadline. PSPC had not provided a response when the extended deadline of September 4, 2020, expired. The Information Commissioner found the complaint to be well-founded and ordered PSPC to provide a final response within 10 days.

• Whether the institution responded to the access request within the extended time limit.
• The implications of an institution failing to respond by the deadline.

The complainant alleged the Royal Canadian Mounted Police (RCMP) did not conduct a reasonable search for records related to the "E Norther" file. The RCMP initially refused to search the Legal Services Unit, claiming records would not be under their control. The Information Commissioner found this unreasonable, ordering the RCMP to search and process any responsive records found. The RCMP subsequently located additional records and provided a supplementary release to the complainant.

• Reasonableness of the search conducted by the institution.
• Determination of record control for access to information purposes.
• Scope of records requested by the complainant.

The complainant alleged that the Immigration and Refugee Board of Canada (IRB) failed to conduct a reasonable search for records containing all final decisions made between January 2018 and June 2020. The IRB's ATIP office mistakenly narrowed the request to only written decisions, excluding responsive audio recordings without the complainant's consent. The Information Commissioner found the complaint well-founded and ordered the IRB to process all responsive audio recordings.

• Reasonableness of search
• Definition of 'record' under ATIA
• Scope of access request
• Assistance to requesters

The complainant alleged that the Public Health Agency of Canada (PHAC) unreasonably extended the time to respond to an access request for correspondence sent and received by its president during a specific week. PHAC cited a large volume of records (estimated at 30,000 pages) and the need for consultations as justification for the extensive extension. The Information Commissioner found that PHAC provided sufficient justification for the time extension under paragraphs 9(1)(a) and 9(1)(b) of the Access to Information Act, making the complaint not well-founded.

• Reasonableness of time extension due to volume of records (ATIA s. 9(1)(a))
• Reasonableness of time extension due to consultations (ATIA s. 9(1)(b))
• Impact of request scope on institution's operations
• Complainant's willingness to narrow the scope of the request

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) improperly withheld Total Repayment figures related to the Technology Partnerships Canada (TPC) program, citing exemptions concerning financial impact on third parties (s. 20(1)(c)) and other provisions. The scope was narrowed to 21 third parties. The Information Commissioner found that neither ISED nor the third parties provided sufficient evidence to meet the requirements for these exemptions. Consequently, the Commissioner ordered ISED to disclose all the withheld information.

• Whether the Total Repayments figures meet the criteria for exemption under paragraph 20(1)(b) (confidential third-party information).
• Whether the Total Repayments figures meet the criteria for exemption under paragraph 20(1)(c) (financial impact on a third party).
• Whether the Total Repayments figures meet the criteria for exemption under paragraph 20(1)(d) (interference with third-party negotiations).
• The burden of proof on the institution and third parties to demonstrate that exemptions apply.

An institution applied to the Information Commissioner for permission to ignore two access requests, claiming they were vexatious and an abuse of the access to information process. The institution also argued it had fulfilled its duty to assist the requester. The Commissioner found the institution failed in its duty to assist and did not prove the requests were vexatious or an abuse of the process. Consequently, the Commissioner denied the institution's applications, requiring it to process the requests.

• Whether the access requests were vexatious
• Whether the access requests constituted an abuse of the right to access information
• Whether the institution fulfilled its duty to assist the requester

This investigation concerned MGM Resorts International's handling of a 2019 data breach that affected millions of guests, including nearly two million Canadians. The OPC initiated a complaint after media reports indicated a breach and MGM had not reported it. The investigation found that MGM failed to promptly assess the risk of significant harm (RROSH) posed by the breach and did not report it to the OPC or notify affected Canadians as soon as feasible. MGM has committed to updating its privacy breach response framework to ensure timely RROSH assessments and reporting.

• Whether the personal information involved in the breach posed a real risk of significant harm (RROSH) to affected Canadians.
• Whether MGM adequately assessed the RROSH.
• Whether MGM reported the breach to the OPC and notified affected Canadians as soon as feasible.
• Whether MGM's delay in assessing the breach and notifying Canadians contravened PIPEDA's mandatory breach reporting obligations.

The Department of National Defence (DND) disclosed the identity of a workplace violence (WPV) complainant and the investigation report to a second investigator, who was conducting a separate administrative investigation into the complainant's conduct. The OPC found that while disclosing the report to labour relations was a consistent use, disclosing it to the second investigator was not, as it was not a reasonably expected use of the information given the confidentiality assurances provided to the complainant. This disclosure was therefore found to be a contravention of the Privacy Act.

• Was the disclosure of the WPV complainant's identity and report to a second investigator a 'consistent use' under paragraph 8(2)(a) of the Privacy Act?
• Did DND's consent form clearly communicate potential uses and disclosures of the complainant's identity?
• Did the disclosure align with the reasonable expectations of the complainant regarding confidentiality?
• What corrective actions are necessary to ensure future compliance with privacy principles in WPV investigations?

The complainant alleged that Shared Services Canada (SSC) wrongfully refused to process an access request for records related to informal official language complaints. SSC argued that the request, even after narrowing its scope, did not meet the requirements of section 6 of the Access to Information Act because it would require tasking too many employees and would impose an unreasonable administrative burden. The Information Commissioner disagreed, finding the request sufficiently detailed and ordering SSC to process it.

• Whether the access request provided sufficient detail to enable an experienced employee to identify records with reasonable effort.
• Whether administrative burden on an institution is a valid reason to refuse processing a request.
• Whether the scope of the request necessitated tasking all employees of the department.
• Whether section 6.1 of the Act was the appropriate process to address claims of vexatious requests.