Canadian privacy & access decisions

The complainant alleged that the Canadian Security Intelligence Service (CSIS) took an unreasonable time extension under paragraph 9(1)(b) of the Access to Information Act for consultations. CSIS justified a 240-day extension, citing the necessity of consulting with two other government institutions, the high classification and sensitivity of the records, the need for on-site review, and limited workplace access due to the pandemic. The Office of the Information Commissioner (OIC) found that CSIS made a serious effort to determine the extension's length based on the pandemic's realities. The OIC concluded that the time extension was reasonable given the circumstances and that CSIS met the three requirements for claiming such an extension. Therefore, the complaint was not well founded.

• Whether the time extension taken under paragraph 9(1)(b) for consultations was reasonable
• Whether CSIS met the three requirements to claim the time extension

The Office of the Information Commissioner (OIC) received nine complaints regarding Global Affairs Canada's (GAC) failure to respond to nine access requests within the statutory deadlines or taking unreasonable time extensions. GAC cited the COVID-19 pandemic as a significant factor impacting its ability to process these requests. Despite the challenges, GAC committed to providing a final response for all nine files by October 15, 2021. The Commissioner found all nine complaints to be well founded, indicating that GAC improperly delayed access to the requested information. This decision highlights the institution's obligation to meet timelines under the Access to Information Act, even when facing operational difficulties.

• Whether Global Affairs Canada failed to respond to access requests within the statutory deadlines
• Whether Global Affairs Canada took unreasonable time extensions for access requests

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld information under paragraph 16(1)(a) of the Access to Information Act. The requested information pertained to a complaint investigated by the RCMP. The OIC's investigation determined that the withheld information was obtained by the RCMP, an investigative body specified in the regulations, during a lawful investigation related to the detection, prevention, or suppression of crime. Furthermore, the information was created less than twenty years before the request. The OIC also found that the RCMP reasonably exercised its discretion by considering relevant factors for and against disclosure, including the purpose of the Act and the private interests of other individuals. Consequently, the OIC concluded that the information met the requirements for exemption under paragraph 16(1)(a) and that the institution's decision to withhold it was appropriate.

• Whether the information was obtained or prepared by an investigative body listed in Schedule I of the Access to Information Regulations
• Whether the information was obtained or prepared during a lawful investigation within the authority of the investigative body
• Whether the investigation concerned the detection, prevention, or suppression of crime, enforcement of law, or threats to security of Canada
• Whether the information was created less than 20 years before the access request
• Whether the institution reasonably exercised its discretion to decide whether to release the information under s.16(1)(a)

The complainant alleged that the Canada Revenue Agency (CRA) improperly withheld information under subsection 24(1) of the Access to Information Act. The request sought income-related information regarding business ownership for a specific individual. The CRA claimed that the information was exempt from disclosure because section 241 of the Income Tax Act (ITA) restricts its release. The Office of the Information Commissioner (OIC) found that the requested information constituted "taxpayer information" as defined in subsection 241(10) of the ITA, meaning it related to an identifiable taxpayer (not the complainant) and was obtained by the CRA for administering the ITA. Consequently, the OIC concluded that the information met the requirements for exemption under subsection 24(1) of the ATIA. The complaint was therefore deemed not well founded.

• Whether the requested information falls under the definition of "taxpayer information" in subsection 241(10) of the Income Tax Act
• Whether section 241 of the Income Tax Act restricts the disclosure of the requested information
• Whether subsection 24(1) of the Access to Information Act applies to exempt the information from disclosure

The complainant alleged that Health Canada failed to conduct a reasonable search for records in response to two access requests concerning personal or designated producers and users of medical cannabis. Health Canada provided records from one database but argued that retrieving additional potentially relevant information from a second database would be unreasonable due to the extensive manual labour required. The Office of the Information Commissioner (OIC) agreed with Health Canada's position. The OIC found that the institution's search was reasonable, considering the burden of retrieving records from the second database. Consequently, the complaint was not well-founded.

• Whether Health Canada conducted a reasonable search for records under s.4 of the ATIA

The complainant alleged that Transport Canada improperly withheld annual statistics related to processing access to information and privacy requests, citing section 26 of the Access to Information Act. Transport Canada argued that the information was intended for future publication. The Office of the Information Commissioner (OIC) investigated whether the institution met the criteria for applying section 26 and properly exercised its discretion. The OIC found that Transport Canada had satisfied the requirements for section 26 and had considered all relevant factors for and against disclosure. Consequently, the OIC concluded that the institution's decision to withhold the records was appropriate.

• Whether s.26 ATIA (information to be published) was properly applied
• Whether Transport Canada appropriately exercised its discretion under s.26 ATIA

The Information Commissioner initiated a complaint against Canadian Heritage (PCH) after reports indicated the institution had suspended processing access requests due to the COVID-19 pandemic. The investigation revealed that PCH's Access to Information and Privacy Secretariat could not access its work premises or departmental network remotely between March 16, 2020, and July 10, 2020. This resulted in a backlog of 224 access requests. The Commissioner found that PCH's failure to respond to these requests was not justified by any of the circumstances outlined in subsection 9(1) of the Act, thereby breaching requesters' quasi-constitutional rights of access. The complaint was deemed well-founded, and the Commissioner made six recommendations to the Minister of Canadian Heritage, who agreed to implement corrective measures.

• Whether the institution's suspension of access request processing constituted a breach of the Access to Information Act
• Whether the institution's failure to respond to requests was justified under subsection 9(1) of the Act

The complainant challenged Transport Canada's decision to withhold information concerning vehicle safety recall completion rates, citing sections 14, 20, and 21 of the Access to Information Act. The Office of the Information Commissioner (OIC) requested submissions from the complainant, Transport Canada, and a third party. The Commissioner determined that neither Transport Canada nor the third party had adequately demonstrated that the claimed exemptions applied to the information in question. Consequently, the Commissioner recommended that Transport Canada disclose all previously withheld information, excluding any personal information. Transport Canada confirmed its intention to implement these recommendations. The complaint was found to be well founded.

• Whether s.14 ATIA (federal-provincial affairs) applied to the withheld information
• Whether s.20 ATIA (third-party information) applied to the withheld information
• Whether s.21 ATIA (advice and recommendations) applied to the withheld information
• Whether Transport Canada and the third party met their burden of proof for the claimed exemptions

The complainant challenged VIA Rail's decision to withhold information concerning a High Frequency Rail Proposal. VIA Rail had applied multiple exemptions under the Access to Information Act. The Information Commissioner found that VIA Rail failed to demonstrate that the withheld information properly fell within the scope of the claimed exemptions. Furthermore, VIA Rail did not perform a severance exercise to release non-exempt portions of the records. The Commissioner recommended that VIA Rail conduct a severance exercise, disclose all information not meeting exemption criteria, and properly exercise discretion for any remaining exempt information. Consequently, the complaint was deemed well founded.

• Whether the information fell within the scope of the exemptions claimed under s.18 ATIA
• Whether the information fell within the scope of the exemptions claimed under s.21 ATIA
• Whether VIA Rail conducted a proper severance exercise to disclose non-exempt information

An employee complained that a federal government institution breached her privacy by disclosing her transgender identity and the reasons for her transfer to her new manager and colleagues without her consent. The complainant had explicitly requested confidentiality due to prior workplace harassment related to her gender identity, and the employer had assured her of discretion. The institution's internal review confirmed that managers disclosed this sensitive information, believing it necessary to support the employee and her new supervisor, but acknowledged this was an error and contrary to internal policies. The OPC found that the disclosure was made without consent, contravening section 8(1) of the Privacy Act. The institution recognized the breach and committed to improving policies and providing transgender awareness education. The OPC recommended updating policies to prevent similar incidents, and the institution created new guidance for its staff.

• Whether information about an individual's transgender identity is personal information requiring protection under the Privacy Act
• Whether the institution disclosed the complainant's personal information without consent
• Whether the disclosure was contrary to section 8(1) of the Privacy Act

The complainant alleged that the Privy Council Office (PCO) failed to respond to an access request within the statutory time limits. The request sought minutes of the Joint Intelligence Committee from 1962. PCO claimed an extension, partly for consultations, but then closed the file, citing its 'no late file' policy and the lack of recommendations from other government institutions. The Office of the Information Commissioner found that the Act does not permit an institution to cease processing a request due to outstanding consultations, concluding that PCO was in deemed refusal under subsection 10(3) of the Act. The Commissioner recommended PCO respond to the request by a specific date and revoke or revise its 'no late file' policy to comply with the Act. PCO committed to a revised response date and confirmed the revocation of its policy. The complaint was found to be well founded.

• Whether the institution responded to the access request within the time limits set out in the Access to Information Act
• Whether the institution was authorized to cease processing an access request due to outstanding recommendations from consulted institutions
• Whether the institution was in deemed refusal pursuant to subsection 10(3) of the Act

The complainant alleged that the Privy Council Office (PCO) failed to respond to an access request for minutes of the Joint Intelligence Committee from 1971 within the time limits stipulated by the Access to Information Act. PCO had claimed an extension, partly for consultations with other government institutions. When these consultations were not completed by the deadline, PCO informed the complainant it would not process the request, citing its 'no late file' policy. The Office of the Information Commissioner found that the Act does not permit an institution to cease processing a request due to outstanding consultations. Consequently, PCO was deemed to have refused the request under subsection 10(3) of the Act. The Commissioner recommended that PCO respond to the request and revise its policy to comply with the Act. PCO agreed to implement both recommendations, and the complaint was found to be well founded.

• Whether the institution failed to respond to an access request within the time limits set out in the Access to Information Act
• Whether the institution's 'no late file' policy, which led to closing a file due to outstanding consultations, is compliant with the Act
• Whether the institution was in deemed refusal pursuant to subsection 10(3) of the Act

The complainant alleged that the Privy Council Office (PCO) failed to respond to an access request within the statutory time limits. The request sought minutes of the Joint Intelligence Committee from 1968. PCO claimed an extension, partly for consultations, but then closed the file under its 'no late file' policy when consulted institutions did not respond by the deadline. The OIC found that the Act does not permit an institution to cease processing a request due to delayed consultations, concluding that PCO was in deemed refusal under subsection 10(3) of the Act. The Information Commissioner recommended PCO respond to the request and revoke its 'no late file' policy. PCO agreed to revoke the policy and committed to responding by a revised date.

• Whether the institution responded to the access request within the time limits set out in the Access to Information Act
• Whether the institution was authorized to close the file due to delayed responses from consulted institutions
• Whether the institution was in deemed refusal pursuant to subsection 10(3) of the Act

The Office of the Privacy Commissioner of Canada (OPC), along with its provincial counterparts in Alberta and British Columbia, conducted a joint investigation into The Cadillac Fairview Corporation Limited (CFCL) regarding its use of Anonymous Video Analytics (AVA) technology in mall directories and mobile device geolocation tracking. For the AVA technology, the Offices found that CFCL collected and used personal information, including sensitive biometric numerical representations of faces, without valid consent. CFCL also improperly retained approximately 5 million such representations and video/audio recordings. The Offices concluded that CFCL contravened PIPEDA and provincial privacy acts regarding consent and retention for AVA. In response, CFCL ceased using the AVA technology, deleted the improperly retained data, and committed to staff training, leading to a "well-founded and resolved" outcome for this issue. For mobile device geolocation tracking, the Offices found that data collected from anonymous shoppers (hashed MAC addresses and non-granular zone geolocation) did not constitute personal information. Furthermore, CFCL clarified that geolocation data was not linked to identifiable logged-in Wi-Fi users. Consequently, this aspect of the complaint was deemed "not well-founded." The Offices, however, recommended that CFCL obtain express consent if it were to activate geolocation tracking for identifiable Wi-Fi users in the future.

• Whether CFCL’s use of Anonymous Video Analytics (AVA) technology, via in-mall directories, resulted in the collection, use, and/or disclosure of personal information.
• Whether images of individual faces captured by AVA technology constitute personal information.
• Whether numerical representations of faces (biometric information) generated by AVA technology constitute personal information.
• Whether age range and gender assessments, combined with other data, constitute personal information.
• Whether CFCL obtained adequate and meaningful consent for the collection, use, and/or disclosure of personal information via AVA technology.
• Whether CFCL retained personal information collected via AVA technology longer than necessary.
• Whether CFCL’s use of mobile device geolocation technologies (Anonymous Shopper Journey) resulted in the collection, use, and/or disclosure of personal information.
• Whether hashed and randomized MAC addresses, combined with non-granular zone geolocation, constitute personal information in the context of anonymous shopper tracking.
• Whether CFCL’s use of mobile device geolocation technologies (Logged In Shopper Journey) resulted in the collection, use, and/or disclosure of personal information linked to identifiable individuals.
• Whether CFCL obtained adequate and meaningful consent for the collection, use, and/or disclosure of personal information via mobile device geolocation technologies (Logged In Shopper Journey).
• Whether CFCL's privacy policy and signage provided sufficient notice and obtained valid consent for its data collection practices.
• Whether the "serious possibility" threshold for identifying individuals was met for anonymous shopper journey data.

An applicant complained that Health Canada failed to identify all records responsive to an access request and improperly refused to provide an index of all responsive records. The investigation by the Office of the Information Commissioner (OIC) found that Health Canada had conducted a reasonable search for records and there was no evidence that any records were missing. The OIC also determined that Health Canada's refusal to create an index of records did not violate its duty to assist obligations under subsection 4(2.1) of the Access to Information Act. The Commissioner concluded that creating such an index for this specific request would have been unreasonable. Therefore, the complaint was deemed not well-founded.

• Whether Health Canada conducted a reasonable search for responsive records
• Whether Health Canada's refusal to provide an index of responsive records contravened its duty to assist under subsection 4(2.1) ATIA
• Whether creating an index of records for this request would have been unreasonable