Canadian Privacy Decisions

This report details an investigation into the unauthorized disclosure of personal information of over 18,000 Canada Border Services Agency (CBSA) employees due to improperly shared spreadsheets. While the CBSA contravened section 8 of the Privacy Act by disclosing information beyond what was necessary for the stated purposes, the agency took appropriate steps to notify affected individuals, contain the breaches, and implement measures to prevent recurrence. These measures included new data request procedures and the development of a new information management system.

• Whether the CBSA contravened section 8 of the Privacy Act by disclosing personal information.
• Whether the CBSA took adequate steps to notify affected individuals.
• Whether the CBSA took adequate steps to contain the impact of the breaches.
• Whether the CBSA took adequate steps to reduce the risk of future breaches.

The complainant alleged that the Privy Council Office (PCO) improperly withheld information concerning intelligence committee meetings from 1972, citing exemptions related to confidential government information, international affairs, national security, investigative bodies, and personal information. PCO released some information during the investigation but continued to withhold other records. The Information Commissioner found that PCO had not met the requirements for most of the claimed exemptions, particularly given the age of the records and the fact that similar information had been previously disclosed publicly. Consequently, the Commissioner ordered PCO to release most of the remaining withheld information and to re-exercise discretion on a few specific pages.

• Timeliness of exemption claims for historical records
• Demonstration of reasonable expectation of harm
• Public domain status of information
• Proper exercise of discretion