Canadian Privacy Decisions

The complainant alleged that the Canada School of Public Service (CSPS) did not conduct a reasonable search for emails from a senior executive and that records were potentially deleted. The investigation found that the CSPS kept the request on hold without lawful authority, failed to retain records responsive to an active access request, and conducted an inadequate search. The Commissioner concluded the complaint was well-founded regarding the search, but found no evidence of an intent to deny access or that the requester's identity was considered. Additional records were eventually found and provided to the complainant.

• Reasonableness of search
• Failure to retain records
• Intent to deny access
• Consideration of requester's identity

The complainant alleged that the Immigration and Refugee Board of Canada (IRB) took an unreasonable amount of time to respond to an access request for records related to its "Weighing Evidence" document. The IRB claimed a 1,295-day extension, which would have pushed the response deadline to March 31, 2025. The Information Commissioner found that the IRB did not provide sufficient justification for the length of the extension, particularly regarding the time allocated for record review and approval processes. Consequently, the extension was deemed invalid, and the IRB was ordered to process the records as soon as possible, no later than April 18, 2023.

• Reasonableness of time extension claimed under paragraph 9(1)(a) of the ATIA
• Justification for allocated timeframes for record review and approval
• Whether concurrent processing of review stages is possible
• Calculation of time extension for large volume requests

The complainant alleged that Library and Archives Canada (LAC) improperly withheld information under subsection 15(1) of the Access to Information Act. The request was for historical documents concerning the defence of the Arctic region. The Information Commissioner found that LAC failed to demonstrate how disclosing the records would harm national security or the defence of Canada, especially given that similar information has been publicly disclosed by Canada and the United States. The Commissioner recommended that LAC disclose the records in their entirety, and LAC agreed to implement this recommendation.

• Whether subsection 15(1) of the ATIA was properly applied to withhold historical records.
• Whether the disclosure of the records could reasonably be expected to harm national security or the defence of Canada.
• Whether LAC provided sufficient evidence to justify the continued withholding of information.
• The relevance of prior disclosures of similar information by Canada and the United States.

The complainant alleged that the Office of the Auditor General of Canada (OAG) had incorrectly stated that witness statements and documentation supporting a harassment investigation report were not under its control. The OIC investigated whether these records were under the OAG's control, considering factors such as whether they related to an institutional matter and if the OAG had a legally enforceable right to access them. Ultimately, the OIC found that the records were indeed under the OAG's control, making the complaint well-founded.

• Determination of 'control' over records not in physical possession of an institution.
• Whether the OAG had a legally enforceable right of access to the investigation records.
• Whether the content of the records required OAG authorization for communication.
• Whether the OAG relied on the records when preparing other government records.

The complainant alleged that the Federal Economic Development Agency for Southern Ontario (FedDev Ontario) improperly withheld information related to funding applications from The Corporation of the Town of Niagara-on-the-Lake. The exemptions cited were for personal information, and confidential third-party financial, commercial, scientific, or technical information, and information affecting third-party negotiations. Neither the institution nor the third parties provided sufficient evidence to justify withholding the information. The Information Commissioner found the complaint well-founded and ordered the release of the records.

• Whether the withheld information met the requirements for exemption under subsection 19(1) (personal information) of the ATIA.
• Whether the withheld information met the requirements for exemption under paragraph 20(1)(b) (confidential third-party financial, commercial, scientific or technical information) of the ATIA.
• Whether the withheld information met the requirements for exemption under paragraph 20(1)(c) (financial impact on a third party) of the ATIA.
• Whether the withheld information met the requirements for exemption under paragraph 20(1)(d) (negotiations by a third party) of the ATIA.

The complainant alleged that the Canadian Security Intelligence Service (CSIS) did not conduct a reasonable search for records related to pay equity for unionized employees. CSIS argued that records held by its Departmental Legal Services Unit (DLSU) were under the control of the Department of Justice. The Information Commissioner found that CSIS had failed to establish it conducted a reasonable search, as records held by its DLSU might be under CSIS's control. The Commissioner recommended CSIS retrieve and review these records, but CSIS refused to implement the recommendations.

• Reasonableness of the search conducted by CSIS
• Determination of 'control' over records held by the Departmental Legal Services Unit
• Relationship between CSIS and the Department of Justice regarding information holdings

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint from a Trimac truck driver concerned about audio and video recording in his truck cabin. The OPC found that while Trimac had legitimate safety and asset protection goals, the continuous audio recording was too intrusive, especially when drivers were off-duty. Trimac was also not initially transparent about using the data for disciplinary purposes, failing to meet consent requirements under PIPEDA. Trimac has since implemented changes, limiting audio recording to on-duty hours and improving data access controls. The OPC found the complaint conditionally resolved regarding the intrusive nature of the recording and resolved regarding the consent issue, accepting Trimac's remedial actions.

• Appropriateness of continuous audio recording in truck cabins, including during off-duty hours.
• Whether Trimac provided adequate information about the use of collected data for disciplinary purposes.
• The proportionality of privacy intrusion versus business benefits.
• The requirement for employee consent for data collection in an employment context.

The complainant requested a summary of financial assistance provided by Export Development Canada (EDC) to Canadian companies in Honduras over $50,000 from 2009 to 2019. EDC withheld information under exemptions related to confidential business information and disclosure restricted by another law. The Information Commissioner found that EDC failed to demonstrate that the information belonged to EDC as required for the first exemption and that the information was "obtained by" EDC as required for the second exemption. The Commissioner ordered EDC to disclose policy types, policy numbers, and maximum liability amounts.

• Applicability of exemption s. 18.1(1) (confidential financial, commercial, scientific or technical information of EDC)
• Meaning of "belongs to" in s. 18.1(1) ATIA
• Interpretation of EDC's Disclosure Policy for confidentiality
• Applicability of exemption s. 24(1) (disclosure restricted by another law) citing s. 24.3(1) of the Export Development Act
• Distinction between information "obtained by" and "created by" EDC under s. 24.3(1) of the Export Development Act

The complainant alleged that the Old Port of Montreal Corporation Inc. improperly withheld records related to the loan of objects for an exhibit under several exemptions in the Access to Information Act. The exemptions claimed included those related to competitive advantage, government financial interests, personal information, and third-party financial interests and negotiations. The institution failed to provide sufficient representations to support the application of these exemptions. The OIC found that photographs of human remains could not be withheld under the personal information exemption, as the individuals were either not identifiable or had been deceased for over 20 years. The OIC ordered the disclosure of all information at issue, and the institution agreed to comply.

• Burden of proof for exemptions
• Definition of personal information for deceased individuals
• Adequacy of representations to support exemptions
• Status of the Coroner's office as a third party

Following a data breach involving the Starwood hotel database, the Office of the Privacy Commissioner of Canada (OPC) investigated Marriott International, Inc. The investigation found that Marriott's security safeguards, accountability measures, and information retention practices were inadequate at the time of the breach, leading to unauthorized access to personal information. While Marriott has taken remedial actions and the complaint is conditionally resolved, the OPC highlighted failures in access controls, antivirus software, logging and monitoring, and information storage. The OPC also found Marriott contravened accountability principles by not adequately assessing security risks during its acquisition of Starwood and retaining personal information longer than necessary.

• Adequacy of security safeguards for personal information
• Marriott's accountability and due diligence during the acquisition of Starwood
• Timeliness of information retention and deletion practices
• Adequacy of notification and mitigation measures for affected individuals

The complainant alleged that the Canadian Broadcasting Corporation (CBC) improperly withheld information regarding the total remuneration of its highest-paid unionized employees. The CBC claimed exemptions under paragraph 18(b) (competitive position) for specific salary figures. The Information Commissioner found that disclosing these exact salaries could indeed harm the CBC's competitive position in a limited market, and that the CBC reasonably exercised its discretion in withholding the information. Therefore, the complaint was found not well founded.

• Proper application of paragraph 18(b) of the Access to Information Act
• Reasonable expectation of harm to the institution's competitive position
• Reasonable exercise of discretion by the institution to withhold information

The complainant alleged that Employment and Social Development Canada (ESDC) improperly withheld information related to a contract for an Access to Information consultant. ESDC claimed exemptions for personal information, financial impact on third parties, consultations or deliberations, solicitor-client privilege, and restrictions by other laws. The Information Commissioner found that ESDC improperly withheld information concerning the consultant's job duties and experience, some third-party financial details, and certain accounts of deliberations. The Commissioner ordered ESDC to disclose this information and to re-evaluate consent for some personal information.

• Proper application of subsection 19(1) (personal information)
• Proper application of paragraph 20(1)(c) (financial impact on third party)
• Proper application of paragraph 21(1)(b) (accounts of consultations or deliberations)
• Reasonable exercise of discretion for exemptions

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) improperly withheld "Repayments to Date" figures for 12 third parties under paragraph 20(1)(c) of the Access to Information Act. The institution and several third parties argued that disclosure could harm competitive positions or financial interests. The Information Commissioner found that neither ISED nor the third parties met the burden of proving that disclosure would cause harm beyond the merely possible. The Commissioner ordered ISED to disclose the information.

• Whether the "Repayments to Date" figures met the requirements for exemption under paragraph 20(1)(c) of the ATIA regarding financial impact on a third party.
• Whether the "Repayments to Date" figures met the requirements for exemption under paragraph 20(1)(d) of the ATIA regarding interference with third-party negotiations.
• Whether the third parties or the institution met their burden of proof to demonstrate that disclosure would cause harm beyond the merely possible.
• Whether the disclosure of the information was in the public interest.

The institution applied to the Information Commissioner to decline to act on an access request, arguing it was vexatious and an abuse of the right to access information. The requester had made multiple, repetitive requests for similar information, much of which had already been provided to them. The Commissioner found the request to be an abuse of the access right due to this pattern of behaviour and the fact that the requester was not seeking new information. The Commissioner also found that the institution had fulfilled its duty to assist the requester.

• Whether the access request constituted an abuse of the right of access.
• Whether the institution met its duty to assist obligations.
• Whether the access request was vexatious.

The Information Commissioner of Canada gave notice that she ceased to investigate a complaint. The Commissioner determined the complaint was trivial, as the complainant wished to pursue the matter as a point of principle, despite the issue having already been settled and showing a seeming lack of interest in obtaining the records.

• Whether the complaint was trivial, frivolous, or vexatious under subsection 30(4)(a) of the ATIA.