Canadian privacy & access decisions

The complainant alleged that Health Canada improperly withheld information under various sections of the Access to Information Act concerning records related to Dukoral. During the investigation, the complainant narrowed the scope, no longer requiring investigation into personal information or information about the production process or composition of Dukoral. The Commissioner found that Health Canada and the third party (Valneva) did not adequately demonstrate that all information withheld under paragraphs 20(1)(b) and 20(1)(c) met the exemption requirements, particularly regarding confidentiality and reasonable expectation of harm. Similarly, certain information withheld under paragraph 21(1)(a) was found not to constitute advice or recommendations. However, the institution successfully demonstrated that information withheld under section 23 (solicitor-client privilege) was properly exempted. The Commissioner ordered Health Canada to disclose specific information previously withheld under paragraphs 20(1)(b), 20(1)(c), and 21(1)(a). Health Canada agreed to implement the order, and the complaint was found to be well founded.

• Whether s.19(1) personal information exemption was properly applied (withdrawn by complainant)
• Whether s.20(1)(b) confidential third-party financial, commercial, scientific or technical information exemption was properly applied
• Whether the information was financial, commercial, scientific or technical
• Whether the information was confidential (not publicly available, reasonable expectation of confidence, relationship fostered for public benefit)
• Whether the information was supplied by a third party
• Whether the information was consistently treated as confidential by the third party
• Whether s.20(1)(c) financial impact on a third party exemption was properly applied
• Whether disclosure could result in material financial loss or gain to the third party
• Whether there is a reasonable expectation of harm (well beyond a mere possibility)
• Whether disclosure could injure the competitive position of the third party
• Whether Health Canada reasonably exercised its discretion under s.20(5) and s.20(6)
• Whether s.21(1)(a) advice or recommendations exemption was properly applied
• Whether the information constitutes advice or recommendations
• Whether the information was created by or for a government institution or minister
• Whether Health Canada reasonably exercised its discretion under s.21(1)(a)
• Whether s.23 solicitor-client privilege exemption was properly applied
• Whether the information consists of communication between a lawyer/notary and client for legal advice
• Whether the parties intended the communication to remain confidential
• Whether Health Canada reasonably exercised its discretion under s.23

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint against Immigration, Refugees and Citizenship Canada (IRCC) regarding a privacy breach. IRCC inadvertently disclosed the personal information of 497 individuals when sending mass email notifications for a work permit extension program. An employee failed to apply a filter to the email address column in an Excel spreadsheet, causing email addresses to misalign with other personal data, leading to notifications being sent to incorrect recipients. The OPC found that IRCC contravened section 8 of the Privacy Act by disclosing personal information without a permissible purpose and that its prevention measures were insufficient. While IRCC's mitigation efforts, including notifying affected individuals, were deemed adequate, the OPC recommended implementing robust procedural and administrative controls. IRCC accepted these recommendations, committing to measures such as a 'two pairs of eyes' rule, updated operating procedures, and data quality assurance checks. Consequently, the OPC considered the matter resolved.

• Whether IRCC's disclosure of personal information to unintended recipients contravened section 8 of the Privacy Act.
• Whether IRCC had sufficient measures in place to prevent unauthorized disclosures of personal information of this nature.
• Whether IRCC's response to mitigate the impact of the breach on affected individuals was adequate.