Canadian privacy & access decisions

The complainant alleged that the National Capital Commission (NCC) improperly withheld information under paragraphs 16(2)(c), 18(d), and subsection 19(1) of the Access to Information Act concerning renovation projects at Rideau Hall. During the investigation, the NCC disclosed some information previously withheld under subsection 19(1), and the application of paragraphs 16(2)(c) and 18(d) was removed from the scope of the complaint. The Commissioner found that the name, title, and contact information of an NCC employee did not meet the requirements for exemption under subsection 19(1) as it fell under an exception for business contact information. For other personal information, the NCC failed to demonstrate that it had reasonably exercised its discretion to disclose publicly available personal information. The Commissioner ordered the NCC to disclose the NCC employee's information and to properly exercise its discretion regarding publicly available personal information. The NCC agreed to implement the order, and the complaint was found to be well founded.

• Whether s.16(2)(c) ATIA (facilitating the commission of an offence) was properly applied
• Whether s.18(d) ATIA (negotiations by government institutions) was properly applied
• Whether s.19(1) ATIA (personal information) was properly applied to the name, title, and contact information of an NCC employee
• Whether the information about an NCC employee is excluded from the definition of personal information under paragraph 3(j) of the Privacy Act
• Whether the NCC reasonably exercised its discretion under s.19(2)(a) ATIA (consent to disclosure)
• Whether the NCC reasonably exercised its discretion under s.19(2)(b) ATIA (publicly available personal information)
• Whether the NCC reasonably exercised its discretion under s.19(2)(c) ATIA (disclosure consistent with s.8 of the Privacy Act)

The complainant sought rail industry workplace fatality investigation reports from Employment and Social Development Canada (ESDC) between 2000 and 2020. ESDC withheld information under several exemptions, including those for law enforcement, personal information, third-party commercial information, financial impact on third parties, and advice/recommendations. The Commissioner found that ESDC improperly applied the law enforcement exemption and most of the third-party exemptions, noting a lack of demonstrated harm or failure to meet exemption requirements. While some information was genuinely personal, ESDC failed to justify withholding information about individuals deceased for over 20 years or general report titles, and did not reasonably exercise its discretion regarding publicly available information or public interest. Furthermore, ESDC did not properly apply severance to all records and failed to reasonably exercise discretion for the advice/recommendations exemption. Consequently, the complaint was found to be well founded. The Commissioner ordered ESDC to disclose information not properly exempted, re-exercise discretion where appropriate, and conduct a proper severance exercise. ESDC subsequently notified the Commissioner that it would implement the order.

• Whether s.16(1)(c) law-enforcement harm was reasonably expected from disclosing photographs taken during investigations
• Whether information met the requirements of s.19(1) personal information, particularly for individuals deceased for over 20 years or general report titles
• Whether ESDC reasonably exercised its discretion under s.19(2)(a) regarding consent for personal information disclosure
• Whether ESDC reasonably exercised its discretion under s.19(2)(b) regarding publicly available personal information
• Whether ESDC reasonably exercised its discretion under s.19(2)(c) by properly weighing public interest against invasion of privacy for personal information
• Whether information met the requirements of s.20(1)(b) confidential third-party financial, commercial, scientific or technical information, specifically regarding its commercial/technical nature, confidentiality, and whether it was 'supplied by' a third party
• Whether information met the requirements of s.20(1)(c) financial impact on a third party, particularly regarding speculative harm arguments
• Whether ESDC reasonably exercised its discretion under s.20(6) by properly weighing public interest against potential harm to third parties for commercial information
• Whether information met the requirements of s.21(1)(b) accounts of consultations or deliberations
• Whether ESDC reasonably exercised its discretion under s.21(1)(b) for accounts of consultations or deliberations
• Whether ESDC adhered to s.25 severance by failing to apply it to records related to CN

The complainant alleged that the Canada Mortgage and Housing Corporation (CMHC) improperly withheld information under several sections of the Access to Information Act related to the Canada Mortgage Bonds (CMB) program and National Housing Act Mortgage-Backed Securities (NHA MBS) programs. During the investigation, CMHC disclosed some information previously withheld under paragraphs 18(a), 18(b), 21(1)(a), and 21(1)(b), citing the passage of time. The OIC found that CMHC appropriately applied paragraph 68(a) to exclude information available for purchase and that CMHC's application of paragraphs 18(a) and 21(1)(a) was justified, including a reasonable exercise of discretion. However, CMHC failed to demonstrate that the information withheld under paragraph 20(1)(b) met the exemption's requirements, particularly because the relevant third parties (Cornerstone and AKA) did not provide representations to support the claim. Consequently, the Information Commissioner ordered CMHC to disclose the information withheld under paragraph 20(1)(b). CMHC agreed to implement the order.

• Whether s.18(a) ATIA (government financial, commercial, scientific or technical information) was properly applied
• Whether CMHC reasonably exercised its discretion under s.18(a) ATIA
• Whether s.18(b) ATIA (competitive position of government institutions, negotiations by government institutions) was properly applied
• Whether s.20(1)(a) ATIA (third-party trade secrets) was properly applied
• Whether s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information) was properly applied
• Whether s.21(1)(a) ATIA (advice or recommendations) was properly applied
• Whether CMHC reasonably exercised its discretion under s.21(1)(a) ATIA
• Whether s.21(1)(b) ATIA (accounts of consultations or deliberations) was properly applied
• Whether s.68(a) ATIA (material available for purchase) applied to exclude information

The complainant alleged that Agriculture and Agri-Food Canada (AAFC) improperly withheld information under subsection 19(1) (personal information) and paragraph 20(1)(b) (confidential third-party information) of the Access to Information Act. The request sought communications with the National Farm Animal Care Council (NFACC) regarding a Five-Year Review Summary Report and proposed amendments to the Code of Practice for the Care and Handling of Pigs. During the investigation, AAFC disclosed some records, and the complainant narrowed the scope of the complaint. The Information Commissioner found that the information remaining under subsection 19(1) was properly withheld as personal information. However, the Commissioner determined that the information withheld under paragraph 20(1)(b) did not meet the criteria for exemption, specifically, it was not financial, commercial, scientific, or technical. The complaint was found to be well founded, and AAFC was ordered to disclose the information withheld under paragraph 20(1)(b). AAFC subsequently notified the Commissioner that it would not implement the order and intended to apply to the Federal Court.

• Whether records were under the control of the institution
• Whether information met the criteria for exemption under s.19(1) ATIA (personal information)
• Whether the institution reasonably exercised its discretion under s.19(2) ATIA
• Whether information met the criteria for exemption under s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information)
• Whether the information was financial, commercial, scientific, or technical

The complainant alleged that the Social Sciences and Humanities Research Council (SSHRC) improperly withheld information under paragraph 20(1)(b) of the Access to Information Act. The request sought records related to a virtual town hall meeting and other contacts between SSHRC and Memorial University of Newfoundland and Labrador (MUN) officials. SSHRC withheld technical information for WebEx meetings and data on MUN's application and success rates for SSHRC funding programs, citing confidentiality. The Commissioner found that while the WebEx access information was technical, neither SSHRC nor MUN demonstrated that it met the confidentiality criteria, particularly given the large number of potential attendees and lack of measures to prevent sharing. Furthermore, the Commissioner determined that MUN's application and success rates were not financial, commercial, scientific, or technical information, and SSHRC later confirmed some of this information was publicly available. Consequently, the Commissioner concluded that the information did not meet the requirements for exemption under paragraph 20(1)(b).

• Whether the withheld information is financial, commercial, scientific, or technical under s.20(1)(b) ATIA
• Whether the WebEx access information is confidential under s.20(1)(b) ATIA
• Whether MUN's application and success rates are confidential under s.20(1)(b) ATIA
• Whether the information was consistently treated as confidential by the third party
• Whether the relationship between the institution and third party was fostered for public benefit by confidential communication

The complainant alleged that the Canadian Institutes of Health Research (CIHR) improperly withheld information under subsections 18(a), 19(1), and 20(1)(b) of the Access to Information Act, concerning an individual's role on the Pfizer Lyme Disease Advisory Board and their research project. During the investigation, the complainant narrowed the scope to three specific sections of records withheld under paragraph 20(1)(b). The OIC sought representations from the third party (Nominated Principal Investigator via Queen's University), who had no concerns with disclosure. CIHR subsequently conceded that the threshold for paragraph 20(1)(b) had not been met and indicated preparedness to release the information. The Commissioner found that the information at issue, describing aspects of a proposed research network, was not financial, commercial, scientific, or technical as required by paragraph 20(1)(b). Therefore, the Commissioner concluded that the exemption did not apply. The complaint was found to be well founded, and CIHR was ordered to disclose the information.

• Whether the withheld information was financial, commercial, scientific, or technical under s.20(1)(b) ATIA
• Whether the information was confidential under s.20(1)(b) ATIA
• Whether the information was supplied by a third party to a government institution under s.20(1)(b) ATIA
• Whether the third party consistently treated the information as confidential under s.20(1)(b) ATIA

A federal institution applied to the Information Commissioner for approval to decline to act on two access to information requests, arguing they were vexatious and an abuse of the right of access under subsection 6.1(1) of the Access to Information Act. The institution claimed the requester submitted a high volume of requests, refused to narrow their scope, and engaged in intimidating communications, thereby diverting public resources and harassing the department. The Commissioner found that the institution failed to fulfill its duty to assist the requester under subsection 4(2.1) of the Act, as its communication was solely aimed at reducing scope without offering other assistance. Furthermore, the Commissioner determined that the institution did not provide clear and compelling evidence to support its claims that the requests were vexatious or an abuse of the right of access. The Commissioner denied the institution's application, requiring it to process the access requests.

• Whether the institution fulfilled its duty to assist obligations under subsection 4(2.1) of the Act
• Whether the access requests were vexatious under subsection 6.1(1) of the Act
• Whether the access requests constituted an abuse of the right to make a request under subsection 6.1(1) of the Act

The Office of the Privacy Commissioner of Canada (OPC) investigated Agronomy Company of Canada Ltd. following a complaint alleging inadequate safeguards, lack of accountability, and invalid consent for personal information collection and use, stemming from a data breach. A malicious actor gained access to Agronomy's systems, exfiltrating sensitive personal information of 845 individuals, including SINs, financial details, and identification documents, before deploying ransomware. The OPC found Agronomy failed to implement appropriate safeguards, citing a lack of multifactor authentication, network segregation, data encryption, and detection tools, which contributed to the breach. Furthermore, Agronomy lacked a comprehensive privacy policy, a designated privacy officer, and adequate staff training, indicating a failure in accountability. While these two aspects were found well-founded, Agronomy committed to significant improvements, leading to a conditionally resolved outcome. However, the OPC found the complaint regarding invalid consent for credit services not well-founded, as the complainant had signed a clearly labelled credit application and utilized the extended credit.

• Whether Agronomy implemented appropriate safeguards to adequately protect personal information under its control, as per PIPEDA Principle 4.7.
• Whether Agronomy's technical safeguards (multifactor authentication, network segregation, data encryption, detection and response tools) were appropriate for the sensitivity of the information.
• Whether Agronomy's organizational safeguards (incident response protocols, information management, security documentation, staff training) were adequate.
• Whether Agronomy was accountable for personal information under its control, including designating an individual for PIPEDA compliance and implementing policies and practices, as per PIPEDA Principle 4.1.
• Whether Agronomy obtained valid and meaningful consent for the collection and use of personal information for credit services, particularly sensitive information, as per PIPEDA Principle 4.3.

The complainant alleged that Employment and Social Development Canada (ESDC) improperly withheld information under subsections 19(1), 20(1)(b), and section 23 of the Access to Information Act, related to an Occupational Health and Safety Tribunal decision concerning a Canadian National Railway (CN Rail) employee's death. The Commissioner found that ESDC and CN Rail did not demonstrate that all requirements for paragraph 20(1)(b) were met, particularly regarding confidentiality and whether the information was truly commercial or technical. While ESDC met the requirements for subsection 19(1) and section 23, the Commissioner determined that ESDC failed to reasonably exercise its discretion to decide whether to disclose the information, especially for publicly available personal information. Consequently, the Commissioner ordered ESDC to disclose the information withheld under paragraph 20(1)(b) and to re-exercise its discretion for information withheld under subsection 19(1) and section 23, considering all relevant factors for and against disclosure. ESDC agreed to implement the order.

• Whether s.19(1) personal information exemption was properly applied
• Whether the institution reasonably exercised its discretion under s.19(2) for personal information
• Whether the information is financial, commercial, scientific or technical under s.20(1)(b)
• Whether the information is confidential under s.20(1)(b)
• Whether the third party supplied the information to a government institution under s.20(1)(b)
• Whether the third party consistently treated the information as confidential under s.20(1)(b)
• Whether s.23 solicitor-client privilege exemption was properly applied
• Whether the institution reasonably exercised its discretion for s.23 solicitor-client privileged information

The complainant alleged that Employment and Social Development Canada (ESDC) improperly withheld information under subsection 19(1) (personal information) and paragraph 20(1)(b) (confidential third-party information) of the Access to Information Act. The request was for fatality investigation reports from rail industry employers. The Information Commissioner found that while much of the withheld information was personal information under s.19(1), some was not about identifiable individuals and should be disclosed. Regarding third-party information, the Commissioner determined that neither ESDC nor the third parties provided sufficient justification for withholding all information under paragraphs 20(1)(b) or 20(1)(c). The Commissioner ordered ESDC to disclose information not about identifiable individuals, re-exercise discretion regarding publicly available personal information, disclose information not meeting the requirements of paragraph 20(1)(b), and re-exercise discretion under subsection 20(5) for information related to a third party that consented to disclosure. ESDC agreed to implement the order. The complaint was found to be well founded.

• Whether information withheld under s.19(1) was truly about identifiable individuals
• Whether ESDC adequately considered if personal information was publicly available under s.19(2)(b)
• Whether ESDC adequately considered public interest in disclosure under s.19(2)(c) in relation to s.8 of the Privacy Act
• Whether information met the definition of financial, commercial, scientific or technical information under s.20(1)(b)
• Whether information was confidential by an objective standard under s.20(1)(b)
• Whether information was consistently treated as confidential by third parties under s.20(1)(b)
• Whether ESDC reasonably exercised discretion under s.20(5) when a third party consented to disclosure
• Whether ESDC reasonably exercised discretion under s.20(6) for public health or safety reasons
• Whether disclosure could reasonably be expected to have a material financial impact or injure competitive position under s.20(1)(c)
• Whether ESDC properly applied severance under s.25

The complainant alleged that Library and Archives Canada (LAC) improperly withheld information under subsections 13(1) and 15(1) of the Access to Information Act concerning submarine operations in the Arctic. LAC initially released some information but maintained that the remaining records were justifiably withheld. The Information Commissioner found that LAC failed to demonstrate that the information was obtained in confidence, as required by subsection 13(1), lacking evidence of an expectation of confidentiality. Furthermore, the Commissioner determined that LAC did not provide convincing evidence that the disclosure of the information, much of which was historical and publicly available, could reasonably be expected to harm national security or defence, as required by subsection 15(1). Consequently, the Commissioner concluded that the complaint was well founded and recommended full disclosure. However, LAC notified the Commissioner that it would not implement the recommendation.

• Whether the information was obtained in confidence from a specified government body under s.13(1) ATIA
• Whether there was a reasonable expectation of harm to national security or defence from disclosure under s.15(1) ATIA
• Whether the institution reasonably exercised its discretion under s.13(2) ATIA
• Whether the institution reasonably exercised its discretion under s.15(1) ATIA

The complainant alleged that Indigenous Services Canada (ISC) failed to conduct a reasonable search for records related to the National Priority Ranking Framework, the Priority Framework for Water and Wastewater Projects, and long-term First Nations Infrastructure Investment Plans, including internal correspondence, from 2014 onwards. The investigation revealed that the Offices of Primary Interest (OPIs) initially tasked with the search might not have been the most appropriate ones, and that additional OPIs likely held responsive records. ISC was unable to provide concrete details about the search parameters or sufficient documentation of their efforts. The Commissioner concluded that ISC did not conduct a reasonable search. Consequently, the Commissioner ordered ISC to conduct a new, expanded search and provide a new response to the complainant, either granting access to any additional records found or explaining why no such records were located.

• Whether Indigenous Services Canada conducted a reasonable search for records in response to the access request

The complainant alleged that Canada Post failed to conduct a reasonable search for records containing their name in response to an access request. The investigation by the Office of the Information Commissioner (OIC) found that Canada Post had not demonstrated that all relevant Offices of Primary Interest (OPIs) were tasked or that those tasked produced all relevant records. The OIC noted the absence of certain record types, such as personnel files, overtime sheets, and day logs, which the complainant identified as missing or incomplete. Canada Post could not provide sufficient explanation for these omissions, nor for why only one work location was tasked when the complainant worked at several. The Commissioner concluded that Canada Post did not conduct a reasonable search. Consequently, the complaint was found to be well founded, and Canada Post was ordered to conduct a more thorough search and process any newly identified records.

• Whether Canada Post conducted a reasonable search for records
• Whether all relevant Offices of Primary Interest (OPIs) were tasked
• Whether all relevant records under the OPIs' control were produced

The complainant alleged that Fisheries and Oceans Canada (DFO) improperly withheld information under subsection 19(1) (personal information) and paragraph 20(1)(b) (confidential third-party financial, commercial, scientific or technical information) of the Access to Information Act. The requested records were medical certificates provided by Marineland for the export of five beluga whales. During the investigation, the complainant withdrew the allegation regarding subsection 19(1), removing it from the scope of the complaint. The Commissioner found that DFO and Marineland failed to demonstrate that the information met all the requirements of paragraph 20(1)(b), specifically that the information was confidential and consistently treated as such. Consequently, the Commissioner ordered DFO to disclose the records in their entirety, excluding any information previously withheld under subsection 19(1). DFO agreed to implement the order.

• Whether paragraph 20(1)(b) applied to the medical certificates
• Whether the information was financial, commercial, scientific or technical
• Whether the information was confidential
• Whether the third party consistently treated the information as confidential
• Whether the information was available from sources otherwise accessible by the public
• Whether the information originated and was communicated with a reasonable expectation of non-disclosure
• Whether the information was communicated in a fiduciary relationship or one not contrary to the public interest

The complainant alleged that Library and Archives Canada (LAC) took an unreasonable extension of time to respond to an access request for records related to "Project Anecdote." LAC claimed a 1,095-day extension under paragraphs 9(1)(a) and (b) of the Access to Information Act, setting the response deadline to June 20, 2025. During the investigation, LAC demonstrated that its calculation for the extension was logical and supportable, and that providing the records sooner would unreasonably interfere with its operations. LAC also showed that necessary consultations could not be completed within 30 days. The Office of the Information Commissioner concluded that LAC met all the requirements for the extension under paragraphs 9(1)(a) and (b). Consequently, the extension was deemed valid, and the complaint was found to be not well founded.

• Whether the 1,095-day extension of time taken by Library and Archives Canada was reasonable under s.9(1) of the Access to Information Act
• Whether the calculation of the time extension was sufficiently logical and supportable under s.9(1)(a) and (b)
• Whether providing access within a materially lesser period would unreasonably interfere with operations under s.9(1)(a)
• Whether consultations could reasonably be completed within 30 days under s.9(1)(b)