Canadian Privacy Decisions

This report details an investigation into the unauthorized disclosure of personal information of over 18,000 Canada Border Services Agency (CBSA) employees due to improperly shared spreadsheets. While the CBSA contravened section 8 of the Privacy Act by disclosing information beyond what was necessary for the stated purposes, the agency took appropriate steps to notify affected individuals, contain the breaches, and implement measures to prevent recurrence. These measures included new data request procedures and the development of a new information management system.

• Whether the CBSA contravened section 8 of the Privacy Act by disclosing personal information.
• Whether the CBSA took adequate steps to notify affected individuals.
• Whether the CBSA took adequate steps to contain the impact of the breaches.
• Whether the CBSA took adequate steps to reduce the risk of future breaches.

The complainant alleged that the Privy Council Office (PCO) improperly withheld information concerning intelligence committee meetings from 1972, citing exemptions related to confidential government information, international affairs, national security, investigative bodies, and personal information. PCO released some information during the investigation but continued to withhold other records. The Information Commissioner found that PCO had not met the requirements for most of the claimed exemptions, particularly given the age of the records and the fact that similar information had been previously disclosed publicly. Consequently, the Commissioner ordered PCO to release most of the remaining withheld information and to re-exercise discretion on a few specific pages.

• Timeliness of exemption claims for historical records
• Demonstration of reasonable expectation of harm
• Public domain status of information
• Proper exercise of discretion

The complainant alleged that the Privy Council Office (PCO) failed to respond to an access request regarding government communications about the recognition of Yaroslav Hunka in September 2023 by the extended deadline. The OIC found that PCO did not respond by the April 7, 2025, extended due date and was deemed to have refused access. Despite the ongoing processing and consultations, the OIC found the delay unacceptable and ordered PCO to provide a complete response within 36 business days.

• Timeliness of response to access request
• Definition of a 'response' under the ATIA
• Effect of deemed refusal under subsection 10(3)
• Timeliness of implementing OIC order

An institution applied to the Information Commissioner for approval to decline an access request, arguing it was an abuse of the right to access information due to the large volume of Microsoft Teams messages requested. The Commissioner denied the application, finding the institution failed to provide sufficient evidence. The institution's calculations for the volume of messages were unreliable, and the Commissioner noted it is the institution's responsibility to build adequate capacity to process requests.

• Whether the access request is an abuse of the right of access under subsection 6.1(1) of the ATIA
• Whether the institution provided sufficient evidence to demonstrate the request would overburden its operations
• The institution's responsibility to ensure it has the operational capacity to process access requests

The complainant alleged that Shared Services Canada (SSC) improperly withheld information requested under the Access to Information Act. The request was for a report from Gartner, Inc. The complainant argued the information was wrongly withheld under exemptions related to personal information, third-party financial/commercial/scientific/technical information, financial impact on a third party, and negotiations by a third party. The Information Commissioner found that while some information met the criteria for exemption under paragraph 20(1)(b), SSC failed to demonstrate that other withheld information met exemption requirements or that reasonable severance was not possible. The Commissioner ordered SSC to re-exercise its discretion on certain information and disclose specific parts of the report.

• Improper withholding of information under exemptions 19(1), 20(1)(b), 20(1)(c), and 20(1)(d) of the ATIA.
• Whether information qualified as confidential third-party financial, commercial, scientific, or technical information under paragraph 20(1)(b).
• Whether reasonable severance was possible under section 25 of the ATIA.
• Whether SSC reasonably exercised its discretion to withhold information under subsection 16(2).

The complainant alleged that Parks Canada failed to respond to an access request within the extended deadline. The request concerned data on human activity and coastal erosion impacts in the Gulf Islands National Park Reserve, and records related to a park closure decision. Parks Canada cited technical issues, staffing shortages, and third-party consultations as reasons for the delay. The Information Commissioner found the complaint well-founded, ordering Parks Canada to provide a complete response by April 30, 2026.

• Failure to respond within statutory time limits.
• Justification for delays due to technical issues and staffing shortages.
• Balancing third-party consultation requirements with the right to timely access.

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) failed to respond to an access request within the extended deadline. The request sought records concerning parliamentary consideration of electric vehicle battery manufacturing facilities, related agreements, and the use of foreign workers. The investigation found that ISED did not respond by the required date and was deemed to have refused access. The delay was attributed to a lack of responsiveness from one of its offices. The Information Commissioner ordered ISED to provide a complete response within 60 business days.

• Timeliness of response to an access request
• Definition of a response under the ATIA
• Responsibility for delays within an institution

The complainant alleged that Health Canada improperly withheld information related to submissions for using Anafranil / Altius Clomipramine in the treatment of obsessive-compulsive disorder, citing exemptions related to third-party financial, commercial, scientific, or technical information. Both Health Canada and the third party indicated that due to the passage of time, the exemptions no longer applied. The Information Commissioner found the complaint well-founded and ordered Health Canada to disclose the withheld information, which the institution agreed to do.

• Whether information was properly withheld under paragraphs 20(1)(b) and 20(1)(c) of the Access to Information Act.
• Whether the passage of time rendered the claimed exemptions inapplicable.
• The burden on institutions and third parties to justify exemptions.
• The need for a clear and direct connection between disclosure and expected harm to justify exemption under paragraph 20(1)(c).

The complainant alleged that Fisheries and Oceans Canada (DFO) improperly withheld records related to commercial fishing agreements with Eskasoni First Nation (EFN). The information was claimed to be exempt under provisions related to personal information, and confidential third-party financial, commercial, scientific, or technical information, and potential financial impact on a third party. The Information Commissioner found that while some information met the criteria for personal information, much of the financial and commercial information was either publicly available, not truly confidential, or not supplied by a third party. The Commissioner also found the claim of financial impact was speculative. Therefore, the complaint was well-founded, and DFO was ordered to disclose most of the withheld information.

• Application of subsection 19(1) (personal information)
• Application of paragraph 20(1)(b) (confidential third-party financial, commercial, scientific or technical information)
• Application of paragraph 20(1)(c) (financial impact on a third party)
• Confidentiality and 'supplied by a third party' requirements under paragraph 20(1)(b)

An institution applied for approval to decline processing an access request, arguing it was an abuse of the right of access due to its excessive breadth and the burden it would place on the small organization. The requested records spanned multiple years and covered broad categories related to rare diseases and medication coverage. The Information Commissioner agreed that the request was overly broad and burdensome, constituting an abuse of the right of access. The Commissioner also found that the institution had met its duty to assist the requester.

• Is the access request an abuse of the right of access under subsection 6.1(1) of the ATIA?
• Would responding to the request overburden the institution?
• Is the request overly broad?
• Did the institution meet its duty to assist the requester under subsection 4(2.1)?

The complainant alleged that Public Services and Procurement Canada (PSPC) took an unreasonable amount of time to extend its response deadline for an access request concerning documents related to the parliamentary consideration of ArriveCAN. The Information Commissioner found that while PSPC demonstrated the need for consultations due to a large volume of records, it failed to justify the 150-day extension for these consultations, relying instead on service standards rather than a genuine assessment of the time required. Consequently, the extension was deemed unreasonable, and PSPC was ordered to provide a complete response by June 1, 2026.

• Reasonableness of time extension under paragraph 9(1)(a) for volume of records
• Reasonableness of time extension under paragraph 9(1)(b) for consultations
• Institution's failure to demonstrate genuine assessment of time required for consultations
• Deemed refusal of access under subsection 10(3) due to unreasonable extension

The complainant alleged that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) improperly withheld records related to a 2000 settlement agreement with the Squamish Nation. CIRNAC claimed exemptions under paragraphs 20(1)(b), 20(1)(c), 20(1)(d), and section 23 of the Access to Information Act. The Information Commissioner found that neither CIRNAC nor the Squamish Nation provided sufficient evidence to justify withholding the information under these exemptions. The Commissioner ordered CIRNAC to disclose the records in their entirety, but CIRNAC indicated it would not comply.

• Applicability of exemptions for confidential third-party financial/commercial/scientific/technical information (s. 20(1)(b))
• Applicability of exemptions for financial impact on a third party (s. 20(1)(c))
• Applicability of exemptions for negotiations by a third party (s. 20(1)(d))
• Applicability of solicitor-client and litigation privilege (s. 23)

The complainant alleged that Fisheries and Oceans Canada (DFO) improperly withheld records related to an application by Ridley Terminals Inc. for a berth expansion project. The information was withheld under exemptions related to personal information, confidential third-party commercial or technical information, and financial impact on a third party. The Information Commissioner found that DFO did not meet the requirements for withholding information under paragraphs 20(1)(b) and 20(1)(c), but did meet the requirements for subsection 19(1) regarding personal information. DFO was ordered to disclose all information except for the personal information.

• Whether information qualifies as personal information under s. 19(1) ATIA.
• Whether information qualifies as confidential third-party financial, commercial, scientific, or technical information under s. 20(1)(b) ATIA.
• Whether information could reasonably be expected to have a material financial impact on a third party or harm its competitive position under s. 20(1)(c) ATIA.
• Whether information could reasonably be expected to interfere with the contractual or other negotiations of a third party under s. 20(1)(d) ATIA.

An institution applied for approval to decline acting on a 42-page, 196-item access request, arguing it was vexatious, made in bad faith, and an abuse of the right of access. The institution had split the request into 196 separate requests without the requester's consent, leading the Commissioner to consider the application for the entire request. The Commissioner found that the breadth and complexity of the request placed an unreasonable burden on the institution, constituting an abuse of the right of access. The Commissioner also found the institution made reasonable efforts to assist the requester. Consequently, the application was granted.

• Whether the access request constitutes an abuse of the right of access
• Whether the institution made reasonable efforts to assist the requester
• Whether the modifications made by the requester after the application were timely
• Procedural fairness of the OIC's process

The complainant alleged that Public Safety Canada improperly withheld information related to user agreements for the national public alerting system, citing personal information and third-party emergency management plans. During the investigation, the complainant withdrew the need to investigate the personal information aspect. The Commissioner found that the agreements did not meet the criteria for third-party emergency management plans because they constituted negotiated terms rather than information supplied by a third party. The Commissioner also found that the institution's invocation of the exemption for facilitating an offence was not justified.

• Whether the information was 'supplied...by a third party' for the purposes of paragraph 20(1)(b.1) of the ATIA.
• Whether the information meets the criteria for third-party emergency management plans under paragraph 20(1)(b.1) of the ATIA.
• Whether the disclosure of a DocuSign envelope identification number could reasonably be expected to facilitate the commission of an offence under subsection 16(2) of the ATIA.