Canadian privacy & access decisions

The World Anti-Doping Agency (WADA) entered into a compliance agreement with the Privacy Commissioner of Canada (OPC) to resolve an investigation into WADA's collection, use, and disclosure practices concerning athletes' personal information in its Anti-Doping Administration and Management System (ADAMS). The OPC launched an investigation after receiving a complaint, and WADA disputed the allegations and challenged the OPC's jurisdiction in Federal Court. Without admitting contravention or waiving jurisdictional rights, WADA agreed to remedial measures. These measures include ceasing to permit Anti-Doping Organizations (ADOs) to use ADAMS data for non-anti-doping purposes, updating the World Anti-Doping Code, and amending agreements with ADOs to restrict data use to anti-doping purposes only. WADA will also provide the OPC with a mechanism to ensure ADOs adhere to these restrictions. The investigation will be placed in abeyance and discontinued upon completion of the remedial measures.

• Whether WADA's collection, use, and disclosure practices of athletes' personal information in ADAMS comply with PIPEDA
• Whether the OPC has statutory, territorial, and/or subject matter jurisdiction over WADA
• Whether ADOs are permitted to use personal information in ADAMS for purposes other than anti-doping

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) took an unreasonable extension of time to respond to an access request for Microsoft Teams messages and related policies. ISED claimed a 390-day extension, citing the volume of records, complexity, and the need for senior-level review, as well as internal and external consultations. The Commissioner found that ISED failed to demonstrate a link between the reasons for the extension and its length, or that a serious attempt was made to determine the necessary length. Specifically, the 240-day extension for volume and interference was deemed excessive, and the 150-day extension for consultations lacked sufficient justification. The Commissioner concluded that the extension was invalid, leading to a deemed refusal of access. The complaint was found to be well-founded, and ISED was ordered to provide a complete response within 60 business days.

• Whether the 240-day extension under s.9(1)(a) ATIA for volume and interference was reasonable
• Whether the 150-day extension under s.9(1)(b) ATIA for consultations was reasonable
• Whether ISED made a serious effort to assess the necessary length of the extension of time
• Whether there was a link between the reasons for the extension and its length
• Whether the calculation of the length of the extension was sufficiently rigorous, logical, and supportable
• Whether ISED was in deemed refusal under s.10(3) ATIA

An unnamed federal institution applied to the Information Commissioner for approval to decline to act on an access request, arguing it constituted an abuse of the right of access under subsection 6.1(1) of the Access to Information Act. The request sought extensive records related to rare diseases and medications, spanning from the earliest records to the present, across multiple departments and communication types. The institution contended the request was overly broad, would overburden its small staff, and required manual review of an unmanageable volume of records. The Commissioner found that the request, particularly its fifth part, was indeed overly broad and that responding to it would overburden the institution, which has only 15 employees and processes a modest number of pages annually. Despite the requester's offer to provide a more specific list of diseases, the Commissioner concluded that the institution had made reasonable efforts to assist and that the request would still be unduly burdensome. Consequently, the Commissioner granted the institution's application to decline to act on the request.

• Whether the access request is an abuse of the right of access under s.6.1(1) ATIA
• Whether the request is overly broad
• Whether acting on the request would overburden the institution
• Whether the institution met its duty to assist the requester under s.4(2.1) ATIA
• Whether the circumstances warrant granting approval to decline to act on the request

The complainant sought records related to the Canada Student Service Grant from Employment and Social Development Canada (ESDC), alleging improper withholding of information under several exemptions and an unreasonable search for records. The Commissioner found that ESDC improperly withheld information claimed under paragraphs 20(1)(b) and 20(1)(c), determining that the institution failed to demonstrate the information's confidentiality, its financial/commercial/scientific/technical nature, or a reasonable expectation of harm from disclosure. For information withheld under paragraphs 21(1)(a) and 21(1)(b), the Commissioner concluded that factual information and final decisions did not meet the exemption requirements and that ESDC failed to reasonably exercise its discretion for other information that did meet the requirements. Similarly, while the majority of information claimed under section 23 met the requirements for solicitor-client privilege, some portions did not, and privilege was waived for other parts by the Privy Council Office. However, the Commissioner found that ESDC conducted a reasonable search for records, despite the complainant's concerns about missing emails, handwritten notes, and cabinet confidences. Consequently, the complaint was found to be well founded regarding the improper application of exemptions and the failure to exercise discretion. The Commissioner ordered ESDC to disclose specific information and to re-exercise its discretion for other information withheld under sections 21 and 23. ESDC notified the Commissioner of its intent to comply with the order, though it also indicated a desire to apply additional exemptions not raised during the investigation, which the Commissioner rejected.

• Whether ESDC improperly withheld information under s.16(2) ATIA
• Whether ESDC improperly withheld information under s.19(1) ATIA
• Whether the information met the requirements of s.20(1)(b) ATIA (confidential financial, commercial, scientific or technical information)
• Whether the information met the requirements of s.20(1)(c) ATIA (material financial impact or harm to competitive position)
• Whether the information met the requirements of s.21(1)(a) ATIA (advice or recommendations)
• Whether the information met the requirements of s.21(1)(b) ATIA (accounts of consultations or deliberations)
• Whether the information met the requirements of s.23 ATIA (solicitor-client and litigation privilege)
• Whether ESDC reasonably exercised its discretion to disclose information under s.20(5) ATIA
• Whether ESDC reasonably exercised its discretion to disclose information under s.21 ATIA
• Whether ESDC reasonably exercised its discretion to disclose information under s.23 ATIA
• Whether ESDC conducted a reasonable search for records
• Whether PCO waived solicitor-client privilege over certain information