Canadian privacy & access decisions

The complainant alleged that the Canada Revenue Agency (CRA) improperly withheld employee telephone numbers under paragraph 16(2)(c) of the Access to Information Act, claiming disclosure could facilitate the commission of an offence. The request was for a telephone list for the CRA Headquarters International and Large Business Directorate. The complainant also initially alleged an unreasonable search, but later withdrew this aspect of the complaint. The CRA argued that disclosing cell phone numbers, now widely used by employees, could lead to hacking, interception of communications, identity theft, fraud, and harassment, citing vulnerabilities like SS7 attacks. However, the OIC found that the CRA failed to provide clear and convincing evidence of a reasonable expectation of harm, noting that government devices are encrypted and employees are trained on security risks. The OIC also pointed out that some of the numbers were already publicly available, undermining the CRA's claim of harm. The Information Commissioner concluded that the CRA did not meet the requirements for applying paragraph 16(2)(c). The complaint was deemed well founded, and the CRA subsequently released the withheld phone numbers.

• Whether s.16(2)(c) ATIA (facilitating the commission of an offence) was properly applied to withhold employee telephone numbers
• Whether there was a reasonable expectation of harm from disclosing employee telephone numbers
• Whether the institution's security measures for government devices mitigated the risk of harm
• Whether the public availability of some employee telephone numbers undermined the claim of harm
• Whether the institution conducted a reasonable search for records