Canadian privacy & access decisions

The complainant alleged that the Department of Justice Canada (Justice) failed to respond to an access request within the statutory time limit, improperly placed the request on hold, and did not meet its duty to assist the requester. The request sought records related to COVID-19 vaccination mandates for federal employees and travel. The Commissioner found that Justice improperly placed the request on an indefinite hold, as there is no provision in the Act for such an action. Justice also failed to provide updates and assistance to the complainant, thereby not meeting its obligations under subsection 4(2.1). Furthermore, Justice did not respond to the request by the statutory deadline, leading to a deemed refusal of access. The Commissioner rejected Justice's estimated 14-year processing time as unreasonable and ordered Justice to remove the hold, provide a complete response by May 17, 2029, and issue regular updates and interim releases.

• Whether the institution responded within the time limit set out in section 7 ATIA
• Whether the institution took an invalid extension of time under section 9 ATIA
• Whether the institution improperly placed the access request on hold
• Whether the institution improperly communicated by phone
• Whether the institution met its responsibilities under subsection 4(2.1) ATIA to assist the requester
• Whether there was evidence of an offence under section 67.1 ATIA

The complainant alleged that National Defence (DND) failed to respond to an access request within the 30-day period mandated by section 7 of the Access to Information Act. The request sought all documentation related to unidentified objects shot down in Yukon and over Lake Huron in February 2023, including emails, photos, and reports. The investigation confirmed that DND received the request on March 16, 2023, and did not extend the response period, making the due date April 17, 2023. DND failed to respond by this date, leading to a deemed refusal under subsection 10(3). The Commissioner found the delay by DND's Offices of Primary Interest (OPIs) in providing responsive records unacceptable, noting that one OPI provided incomplete records and another none at all. The Commissioner concluded that DND did not meet its obligations under the Act. The complaint was found to be well founded, and DND was ordered to provide a complete response within 36 business days.

• Whether National Defence responded to the access request within the 30-day period required by section 7 of the Access to Information Act
• Whether National Defence is deemed to have refused access under subsection 10(3) due to failure to respond within statutory timelines

The complainant alleged that the Canada Revenue Agency (CRA) failed to respond to an access request within the extended timeframe, a violation under paragraph 30(1)(a) of the Access to Information Act. The request sought all documents related to House of Commons committee studies concerning the Pierre Elliott Trudeau Foundation between February 1, 2023, and July 14, 2023. The OIC's investigation revealed that while 5,782 pages of responsive records had been identified, one of CRA's Offices of Primary Interest (OPIs) had not yet provided an additional 4,715 pages for review. Despite the outstanding work, the Information Commissioner found that CRA had not met its obligation to respond within the extended period, deeming it a refusal of access under subsection 10(3). The Commissioner ordered CRA to issue a complete response by January 8, 2025, and made recommendations for improving internal processes and accountability for timely record provision. CRA agreed to implement the order and consider the recommendations.

• Whether the institution responded to the access request within the extended period under subsection 9(1) of the Access to Information Act
• Whether the institution is deemed to have refused access under subsection 10(3) due to failure to respond within the statutory timeframe

A federal institution applied to the Information Commissioner for approval to decline to act on an access request under subsection 6.1(1) of the Access to Information Act. The institution argued that the request was vexatious, an abuse of the right of access, and made in bad faith. The Commissioner found that the institution successfully demonstrated that the access request was vexatious. Consequently, the Commissioner determined that the circumstances justified granting the institution's request to decline to act on the access request. The application was therefore granted, allowing the institution to refuse processing the request.

• Whether the access request was vexatious under s.6.1(1) ATIA
• Whether the access request constituted an abuse of the right of access under s.6.1(1) ATIA
• Whether the access request was made in bad faith under s.6.1(1) ATIA
• Whether the circumstances warranted approval to decline to act on the request

The complainant alleged that Public Services and Procurement Canada (PSPC) took an unreasonable extension of time to respond to an access request for materials related to the sixth interprovincial crossing between Gatineau and Ottawa, and improperly regrouped this request with others to justify the extension. PSPC had extended the response time by 768 days under paragraph 9(1)(a) and an additional 300 days under paragraph 9(1)(b), citing a large volume of complex and sensitive records (2,404 pages) and the need to avoid interference with operations. The Commissioner found that PSPC failed to demonstrate that the 768-day extension was reasonable or justified, concluding that the requirements of paragraph 9(1)(a) were not met. Consequently, the Commissioner did not need to assess the 9(1)(b) extension. Regarding the regrouping allegation, the Commissioner found no evidence that PSPC would not have claimed the extension without regrouping, especially since the requester had agreed to it. The complaint was found to be well founded concerning the unreasonable extension of time, and PSPC was ordered to provide a complete response within 36 business days.

• Whether the extension of time taken under subsection 9(1) was unreasonable (30(1)(c))
• Whether the request was for a large number of records or required searching through a large number of records (9(1)(a))
• Whether meeting the 30-day time limit would unreasonably interfere with the institution’s operations (9(1)(a))
• Whether the extension of time was for a reasonable period, having regard to the circumstances (9(1)(a))
• Whether PSPC improperly regrouped the access request with other requests to take the extension of time (30(1)(f))
• Whether PSPC was in deemed refusal under subsection 10(3)

The complainant alleged that National Defence (DND) failed to respond to an access request within the statutory 30-day period, as required by section 7 of the Access to Information Act. The request sought records related to Dr. Ross Harvey's review of Suffield Experimental Station/Defence Research Establishment Suffield reports, specifically his recommendations and their implementation by DRES management. DND extended the response period by 120 days, making the new deadline August 31, 2023, but failed to respond by this date. The investigation found that DND did not meet its obligation, leading to a deemed refusal of access under subsection 10(3) of the Act. The Commissioner noted ongoing internal discussions within DND regarding severances, which delayed the processing and release of records. The Commissioner concluded that DND's lack of responsiveness contravened its obligations and undermined the access system. The complaint was found to be well founded, and DND was ordered to complete the retrieval of records and provide a full response.

• Whether National Defence responded to the access request within the statutory time limits under section 7 of the ATIA
• Whether National Defence's extension of the response period under paragraph 9(1)(a) was properly followed
• Whether National Defence is deemed to have refused access under subsection 10(3) due to failure to respond
• Whether National Defence's ongoing internal review processes justified the delay in responding

The complainant alleged that the Public Health Agency of Canada (PHAC) unreasonably extended the time to respond to an access request for correspondence related to a specific standing offer and company. PHAC extended the response time by 255 days, citing subsections 9(1)(a), (b), and (c) of the Access to Information Act. The Commissioner investigated whether the extension under 9(1)(a) was reasonable, noting that PHAC initially identified 2,962 pages, later corrected to 1,805 pages. While acknowledging the volume and potential interference with operations, the Commissioner found that PHAC failed to justify the reasonableness of the 180-day extension taken under 9(1)(a), particularly regarding its estimated review rate of 500 pages per 30 days. Consequently, the Commissioner concluded that the extension was invalid, and PHAC was deemed to have refused access under subsection 10(3) of the Act. The complaint was found to be well founded, and PHAC was ordered to provide a complete response within 60 business days.

• Whether the extension of time taken under subsection 9(1) of the Access to Information Act was unreasonable
• Whether the request was for a large number of records under paragraph 9(1)(a)
• Whether meeting the 30-day deadline would unreasonably interfere with the institution’s operations under paragraph 9(1)(a)
• Whether the extension of time was for a reasonable period under paragraph 9(1)(a)
• Whether the institution provided convincing explanation for its estimated monthly review rate of 500 pages
• Whether the institution applied sufficient rigour and logic in determining the duration of the extension
• Whether the institution is deemed to have refused access under subsection 10(3)

The complainant alleged that Housing, Infrastructure and Communities Canada (Infrastructure Canada) improperly withheld information under subsections 19(1), 20(1)(b), 20(1)(c), and 24(1) of the Access to Information Act. The request sought payment documents from Signature on the Saint Lawrence Group (SSLG) to Infrastructure Canada. During the investigation, the complainant narrowed the scope, no longer requiring investigation into GST/PST numbers, banking information, and information withheld under subsection 19(1). The Commissioner found that Infrastructure Canada and SSLG successfully demonstrated that information related to pricing and contractual relationships met the requirements of paragraph 20(1)(c). However, they failed to justify the withholding of other information under paragraphs 20(1)(b), 20(1)(c), or subsection 24(1). The Commissioner ordered Infrastructure Canada to disclose the remaining information, excluding that related to pricing and contractual relationships. Infrastructure Canada agreed to implement the order, and the complaint was found to be well founded.

• Whether s.19(1) personal information was properly withheld
• Whether s.20(1)(b) confidential third-party financial, commercial, scientific or technical information was properly withheld
• Whether s.20(1)(c) financial impact on a third party was properly withheld
• Whether s.24(1) disclosure restricted by another law was properly withheld
• Whether disclosure of financial information provides insight into pricing and contractual relationships
• Whether disclosure of financial information would give SSLG’s competitors an advantage
• Whether the argument that disclosure could be seen negatively by project owners on future bids was speculative
• Whether the information is financial, commercial, scientific or technical under s.20(1)(b)
• Whether the information is confidential by an objective standard under s.20(1)(b)
• Whether the information was supplied by a third party to a government institution under s.20(1)(b)
• Whether the third party has consistently treated the information as confidential under s.20(1)(b)
• Whether the content of the record is not available from sources otherwise accessible to the public
• Whether the information originates and is communicated in a reasonable expectation of confidence
• Whether the information was communicated in a relationship between government and the third party that is either a fiduciary relationship or one that is not contrary to the public interest, and that will be fostered for the public benefit by confidential communication
• Whether the confidentiality clause in the Project Agreement is determinative for objective confidentiality
• Whether the information contained within the invoices was supplied by a third party to Infrastructure Canada
• Whether section 295 of the Excise Tax Act applies to the Procurement Business Number under s.24(1)

The complainant alleged that National Defence (DND) took an unreasonable extension of time to respond to an access request for information related to military equipment, weaponry, and ammunition sent to Ukraine from 2019 to 2022. DND initially extended the response time by 3,210 days, citing the large volume of records and interference with operations. The Commissioner found that while the request involved a large number of records and would interfere with operations, DND did not demonstrate that the extended period was reasonable, as it lacked sufficient rigor in its calculation and planned consecutive, rather than concurrent, processing steps. Consequently, DND was deemed to have refused access to the records. During the investigation, the complainant narrowed the scope of the request, reducing the record count by approximately 20,000 pages. DND then indicated it could respond within six months, which the complainant found acceptable. The Commissioner ordered DND to provide a complete response by November 25, 2024, and DND agreed to implement the order.

• Whether the extension of time taken by National Defence under subsection 9(1) of the Access to Information Act was unreasonable
• Whether the access request was for a large number of records or required searching through a large number of records under paragraph 9(1)(a)
• Whether meeting the 30-day time limit would unreasonably interfere with the institution’s operations under paragraph 9(1)(a)
• Whether the extension of time was for a reasonable period, having regard to the circumstances, under paragraph 9(1)(a)
• Whether National Defence was deemed to have refused access to the requested records pursuant to subsection 10(3)

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld their DNA profile, generated from a biological sample, under subsection 24(1) of the Access to Information Act. The RCMP argued that section 6.6 of the DNA Identification Act, which is listed in Schedule II of the Access to Information Act, prohibits the disclosure of information contained in the DNA data bank. The Commissioner found that the DNA Identification Act indeed restricts the communication of such information, except in specific, limited circumstances not applicable to an access to information request. Therefore, the Commissioner concluded that the RCMP correctly applied subsection 24(1) to withhold the complainant's DNA profile. The complaint was found to be not well founded.

• Whether the information requested (complainant's DNA profile) is subject to subsection 24(1) of the Access to Information Act
• Whether section 6.6 of the DNA Identification Act prohibits the disclosure of the requested information
• Whether the DNA Identification Act is listed in Schedule II of the Access to Information Act

The complainant alleged that the Impact Assessment Agency of Canada (IAAC) took an unreasonable extension of time to respond to an access request for communications related to designated projects in Western Canada. IAAC had extended the response time by 880 days, citing paragraphs 9(1)(a), (b), and (c) of the Access to Information Act. The Commissioner found that while the request involved a large volume of records, IAAC failed to demonstrate that the 820-day extension taken under paragraph 9(1)(a) was reasonable, particularly regarding its estimated monthly review rate. Consequently, the Commissioner concluded that IAAC was deemed to have refused access under subsection 10(3) of the Act. The Commissioner ordered IAAC to provide a complete response to the access request by April 23, 2025. IAAC's President confirmed that the agency would implement the order, outlining steps to increase processing capacity and optimize ATIP processes.

• Whether the extension of time taken under s.9(1)(a) was for a reasonable period
• Whether the request was for a large number of records
• Whether meeting the 30-day deadline would unreasonably interfere with the institution’s operations
• Whether the institution is deemed to have refused access under s.10(3)

The complainant alleged that the Canada Border Services Agency (CBSA) improperly withheld the complete source code for the ArriveCAN application under subsection 16(2) of the Access to Information Act. CBSA argued that disclosing the source code could reasonably be expected to facilitate the commission of an offence by allowing malicious actors to hack the application, impersonate it, or expose security vulnerabilities, thereby risking personal information. The OIC found that at the time of the request in September 2022, when ArriveCAN was mandatory and collected sensitive personal data, the disclosure of the source code could indeed facilitate an offence. The Commissioner also concluded that CBSA reasonably exercised its discretion by weighing the public interest in disclosure against the risks. Furthermore, the OIC accepted CBSA's argument that severance of the source code was not reasonable due to the unknown locations of potential vulnerabilities. Consequently, the complaint was deemed not well founded.

• Whether disclosure of the ArriveCAN source code could reasonably be expected to facilitate the commission of an offence under s.16(2) ATIA
• Whether CBSA reasonably exercised its discretion in deciding not to disclose the information under s.16(2) ATIA
• Whether severance of the source code was reasonable under s.25 ATIA

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld information under paragraph 16(1)(a) of the Access to Information Act, concerning investigation reports into the deaths of two individuals. The RCMP demonstrated that the records met the requirements for exemption under s.16(1)(a), as they were created less than 20 years prior, obtained by an investigative body during a lawful investigation into crime detection/suppression and law enforcement. The Commissioner found that the RCMP reasonably exercised its discretion not to disclose the information, having considered relevant factors including investigative integrity and privacy. While acknowledging the RCMP's correct application of the Act, the Commissioner noted a gap in the legislation regarding the disclosure of deceased individuals' personal information for compassionate reasons. The complaint was ultimately found not well founded.

• Whether the information was obtained or prepared by an investigative body listed in Schedule I of the Access to Information Regulations
• Whether the information was obtained or prepared during a lawful investigation within the authority of the investigative body
• Whether the information concerned an investigation related to the detection, prevention or suppression of crime or the enforcement of any law of Canada or a province
• Whether the records were created less than 20 years before the access request was made
• Whether the institution reasonably exercised its discretion to decide whether to disclose the information

The complainant alleged that Library and Archives Canada (LAC) failed to respond to an access request within the extended time limit, constituting a deemed refusal under the Access to Information Act. The request sought historical records related to the Canadian Intelligence Program and the Joint Intelligence Organization. The investigation confirmed that LAC did not respond by the extended deadline of February 13, 2020, for a request received in July 2019. Despite the records comprising 135 pages and a consultation with Global Affairs Canada being completed, LAC had not finalized processing the request almost five years later. The Information Commissioner found the delay unacceptable and ordered LAC to provide a complete response within 36 business days. However, LAC notified the Commissioner that it would not implement the order due to workload prioritization, stating the records required careful review and further consultation.

• Whether Library and Archives Canada responded to the access request within the extended time limit under subsection 9(1) of the Access to Information Act
• Whether Library and Archives Canada is deemed to have refused access under subsection 10(3) of the Act due to delay

The complainant alleged that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) failed to respond to an access request within the 30-day statutory period. The request sought specific documents related to a briefing note on litigation, some of which had been previously released. The investigation confirmed that CIRNAC did not respond by the deadline, leading to a deemed refusal of access under subsection 10(3) of the Act. The Information Commissioner found the delay by the Resolution & Partnerships unit in retrieving records, despite multiple follow-ups from the ATIP office, to be unacceptable. The Commissioner ordered CIRNAC to complete record retrieval and provide a full response within 36 business days. Additionally, the Commissioner recommended that CIRNAC develop proper processes and performance indicators to ensure timely record provision by its Offices of Primary Interest. CIRNAC agreed to implement the order but did not commit to the recommendations. The complaint was found to be well founded.

• Whether the institution responded to the access request within the 30-day period set out in section 7 of the Access to Information Act
• Whether the institution is deemed to have refused access to the requested records under subsection 10(3) of the Act
• Whether the delay by the Office of Primary Interest (Resolution & Partnerships unit) in retrieving records was acceptable