Canadian privacy & access decisions

The Office of the Privacy Commissioner of Canada (OPC) investigated complaints against Loblaw Companies Ltd. (Loblaw) regarding its PC Optimum Loyalty Program, focusing on the handling of privacy challenges and the retention of personal information. The investigation found that Loblaw contravened PIPEDA Principle 4.10 by failing to adequately address privacy challenges and respond to account deletion requests in a timely manner, though this issue was resolved during the investigation as Loblaw enhanced its procedures. The OPC also found that Loblaw contravened PIPEDA Principle 4.5.3 by not sufficiently anonymizing personal information retained from closed PC Optimum accounts, meaning there was a serious possibility of re-identification. Loblaw disagreed with this finding but agreed to engage an independent third party to assess its anonymization process and implement recommendations. A preliminary matter regarding requiring physical card holders to create an online account for deletion was found not well-founded. The overall outcome reflects a mix of resolved and conditionally resolved well-founded findings.

• Whether Loblaw adequately addresses privacy challenges raised by individuals concerning account deletion (PIPEDA Principle 4.10)
• Whether Loblaw retains personal information of PC Optimum members for longer than necessary after account closure (PIPEDA Principle 4.5.3)
• Whether Loblaw collected unnecessary personal information by requiring physical card holders to create an online account to delete their PC Optimum account (PIPEDA Principle 4.4)
• Whether Loblaw established retention schedules for customer support logs (PIPEDA Principle 4.5.2)
• Whether Loblaw retains universal login credentials (PCids) for longer than necessary for members with no other associated accounts (PIPEDA Principle 4.5.3)
• Whether Loblaw's anonymization process for retained Historical Transaction Data, Loyalty Data, and Usage Data ensures no serious possibility of re-identification
• Whether Loblaw's retention of public IP address data after account closure is sufficiently anonymized
• Whether Loblaw's practice of retaining email domain portions after account closure is sufficiently anonymized
• Whether manual processing errors in Loblaw's de-identification process were adequately detected and addressed
• Whether Loblaw ensured identifiers were removed from back-up systems as part of its anonymization process
• Whether Loblaw considered the impact of other factors affecting re-identification risk, such as separately retained PCid data

An inmate complained that Correctional Service Canada (CSC) failed to retain video footage of use of force incidents involving them, which they requested access to under the Privacy Act. CSC's policy was to retain relevant footage for two years, but otherwise, it was automatically deleted after six days. The OPC's investigation found that CSC had disposed of footage that it was obligated to retain under Subsection 6(1) of the Privacy Act and Paragraph 4(1)(a) of the Privacy Regulations. This failure meant the complainant could not access the sensitive recordings. The OPC recommended that CSC ensure all relevant footage is retained for the prescribed two-year period. CSC agreed to monthly attestations from the institution and quarterly random audits across its Pacific Region, with findings reported to the OPC. The complaint was found to be well-founded and conditionally resolved.

• Whether CSC failed to retain personal information used for an administrative purpose as required by Subsection 6(1) of the Privacy Act and Paragraph 4(1)(a) of the Privacy Regulations
• Whether the complainant was denied a reasonable opportunity to obtain access to their personal information due to non-retention

The complainant alleged that the Privy Council Office (PCO) improperly withheld information under subsections 16(2) and 19(1) of the Access to Information Act. The request sought records concerning a meeting between Clerk John Hannaford and the official languages commissioner. The Commissioner found that PCO appropriately applied subsection 16(2) to a phone number, concluding that its disclosure could reasonably facilitate the commission of an offence and that PCO's exercise of discretion was reasonable. However, the Commissioner determined that PCO improperly applied subsection 19(1) to a signature and two initials, as PCO failed to demonstrate why this information, used in the performance of official duties, was not excluded from the definition of personal information by paragraph 3(j) of the Privacy Act. The Office of the Privacy Commissioner concurred with this assessment. Despite being given an opportunity to release the information informally, PCO did not respond. The Commissioner ordered PCO to disclose the signature and initials, which PCO ultimately agreed to do after obtaining consent from the individuals involved, while still maintaining its disagreement with the Commissioner's position.

• Whether the disclosure of a phone number could reasonably be expected to facilitate the commission of an offence under s.16(2) ATIA
• Whether the institution reasonably exercised its discretion in applying s.16(2) ATIA
• Whether a signature and initials on official documents constitute personal information under s.19(1) ATIA
• Whether the signature and initials are excluded from the definition of personal information by paragraph 3(j) of the Privacy Act
• Whether the institution sufficiently justified the application of s.19(1) ATIA

An anonymous applicant complained that Transport Canada improperly withheld records related to a workplace fatality under sections 19(1), 20(1)(b), and 20(1)(c) of the Access to Information Act, and failed to conduct a reasonable search. During the investigation, Transport Canada also invoked sections 16(1)(c) and 16(2), and the reasonable search complaint was resolved. The Commissioner found that most personal information was properly withheld under section 19(1), and Transport Canada's exercise of discretion under section 19(2) was reasonable. However, the Commissioner rejected the application of sections 16(1)(c), 20(1)(c), and 24(1), finding no reasonable expectation of harm or that the information did not meet the exemption criteria. While section 16(2) was upheld for URLs and passwords, Transport Canada failed to demonstrate it had exercised its discretion. Section 20(1)(b) was upheld in part, with significant portions of information ordered disclosed as they did not meet all the exemption's requirements. Consequently, the complaint was found well-founded, and Transport Canada was ordered to disclose specific information and re-exercise its discretion for other records.

• Whether Transport Canada improperly withheld information under s.19(1) ATIA (personal information).
• Whether Transport Canada reasonably exercised its discretion under s.19(2) ATIA regarding personal information.
• Whether Transport Canada improperly withheld information under s.16(1)(c) ATIA (conduct of investigations).
• Whether disclosure of information could reasonably be expected to harm the conduct of lawful investigations under s.16(1)(c) ATIA.
• Whether Transport Canada improperly withheld information under s.16(2) ATIA (facilitating the commission of an offence).
• Whether Transport Canada reasonably exercised its discretion under s.16(2) ATIA regarding information that could facilitate an offence.
• Whether Transport Canada improperly withheld information under s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information).
• Whether the information met the "financial, commercial, scientific or technical" requirement of s.20(1)(b) ATIA.
• Whether the information was "confidential" by an objective standard under s.20(1)(b) ATIA.
• Whether the information was "supplied by" a third party under s.20(1)(b) ATIA.
• Whether the third party "consistently treated the information as confidential" under s.20(1)(b) ATIA.
• Whether Transport Canada improperly withheld information under s.20(1)(c) ATIA (financial impact on a third party).
• Whether disclosure could reasonably be expected to result in material financial loss or gain to the third party under s.20(1)(c) ATIA.
• Whether disclosure could reasonably be expected to injure the competitive position of the third party under s.20(1)(c) ATIA.
• Whether Transport Canada improperly withheld information under s.24(1) ATIA (disclosure restricted by another law).
• Whether the information related to a "secret process or trade secret" under s.24(1) ATIA.
• Whether Transport Canada conducted a reasonable search for records.

The Office of the Privacy Commissioner (OPC) received complaints regarding the unauthorized disclosure of personal information of over 18,000 Canada Border Services Agency (CBSA) employees. These disclosures occurred when HR-generated spreadsheets, intended for specific operational purposes like shift scheduling, contained excessive personal data or were shared with unauthorized employees. The CBSA's internal investigation uncovered four additional similar breaches. The OPC found that these incidents contravened section 8 of the Privacy Act regarding disclosure limitations. However, the CBSA took appropriate steps to notify affected individuals, contain the impact of the breaches, and implement both short-term and long-term measures to prevent recurrence, including new data request procedures and a future information management system. Consequently, the complaints were deemed well-founded and resolved.

• Whether the CBSA's disclosure of employee personal information via spreadsheets contravened section 8 of the Privacy Act
• Whether the inclusion of excess information in spreadsheets constituted unauthorized disclosure
• Whether the use of personal email addresses for work-related data sharing contravened the Privacy Act
• Whether the CBSA took adequate steps to address the incidents, including notification to affected individuals
• Whether the CBSA's measures to reduce the risk of recurrence were reasonable

An anonymous applicant complained that the Privy Council Office (PCO) improperly withheld records related to meetings of the Joint Intelligence Committee and Intelligence Advisory Committee from 1972. PCO initially claimed exemptions under subsections 13(1), 15(1), 16(1)(a), 16(1)(b), 16(1)(c), and 19(1) of the Access to Information Act. During the investigation, PCO conceded that some exemptions were improperly applied and released additional information, and the complainant narrowed the scope of the complaint. The Information Commissioner found that PCO failed to demonstrate that most of the remaining withheld information met the requirements for exemption under subsections 13(1) and 15(1), often citing a lack of evidence for confidentiality or a reasonable expectation of harm, especially given the historical nature and public availability of similar records. For a British Joint Intelligence Committee Draft Paper title, while s.13(1) applied, PCO did not reasonably exercise its discretion under s.13(2) as the title was publicly available. Consequently, the Commissioner ordered PCO to disclose numerous pages in their entirety and to re-exercise discretion for specific information. The complaint was found to be well-founded, and PCO agreed to implement the orders.

• Whether information regarding visits of Intelligence Community members from other countries met the requirements of s.13(1) ATIA.
• Whether information concerning the Tripartite Alert Circuit met the requirements of s.13(1) ATIA.
• Whether the titles of liaison officers from other countries met the requirements of s.13(1) ATIA.
• Whether information regarding other specified countries met the requirements of s.13(1) ATIA.
• Whether mention of a conference met the requirements of s.13(1) ATIA.
• Whether the title of a British Joint Intelligence Committee Draft Paper met the requirements of s.13(1) ATIA.
• Whether PCO reasonably exercised discretion under s.13(2) ATIA for the title of a British Joint Intelligence Committee Draft Paper.
• Whether information on pages 212 and 215 met the requirements of s.13(1) ATIA.
• Whether the title of a British Joint Intelligence Committee Draft Paper met the requirements of s.15(1) ATIA.
• Whether information regarding the visits of Intelligence Community members from other countries met the requirements of s.15(1) ATIA.
• Whether information concerning the Tripartite Alert Circuit met the requirements of s.15(1) ATIA.
• Whether the titles of liaison officers from other countries met the requirements of s.15(1) ATIA.
• Whether discussion of the Special Research Bureau (SRB) Program Forecast met the requirements of s.15(1) ATIA.
• Whether information regarding other countries (activities, bi-national relationships, threats, UK JIC) met the requirements of s.15(1) ATIA.
• Whether reference to a Joint Intelligence Report met the requirements of s.15(1) ATIA.
• Whether remarks concerning an individual from a foreign country met the requirements of s.15(1) ATIA.
• Whether mention of a conference met the requirements of s.15(1) ATIA.
• Whether PCO improperly withheld information under s.16(1)(a) ATIA.
• Whether PCO improperly withheld information under s.16(1)(b) ATIA.
• Whether PCO improperly withheld information under s.16(1)(c) ATIA.
• Whether PCO improperly withheld information under s.19(1) ATIA.

The complainant alleged that the Privy Council Office (PCO) failed to respond to an access request by the extended due date, concerning government communications about former House of Commons Speaker Anthony Rota's recognition of Yaroslav Hunka. PCO had extended the response period by 360 days, making the due date April 7, 2025, but failed to respond by this date. The Commissioner found that PCO did not meet its obligation to respond within the extended period, deeming it to have refused access under subsection 10(3) of the Act. Despite PCO indicating that records had been reviewed and consultations completed, and proposing an anticipated response deadline of October 24, 2025, this deadline was also not met. The Commissioner concluded that the delay was unacceptable and in contravention of PCO's obligations. The complaint was found to be well founded, and PCO was ordered to provide a complete response within 36 business days.

• Whether the institution responded within the time limits required by section 7 of the ATIA
• Whether the institution's extension under subsection 9(1) of the ATIA was properly applied and adhered to
• Whether the institution is deemed to have refused access under subsection 10(3) of the ATIA due to failure to respond

An institution applied to the Information Commissioner for approval to decline to act on an access request, arguing it constituted an abuse of the right of access under subsection 6.1(1) of the Access to Information Act. The request sought all Microsoft Teams messages from EX-1 level employees and above, along with Teams usage policies and activity reports, for a specific timeframe. The institution claimed the request would be "operationally catastrophic" due to the estimated volume of messages and its limited ATIP capacity. However, the Commissioner found the institution's evidence, particularly its estimation of message volume based on a global report rather than actual Teams data, to be unreliable and inflated. The Commissioner also noted that the institution's limited ATIP capacity, while acknowledged, does not automatically render a request abusive. Consequently, the Commissioner determined that the institution failed to demonstrate that the access request was an abuse of the right of access.

• Whether the access request is an abuse of the right of access under subsection 6.1(1)(c) ATIA
• Whether the institution's estimate of responsive records was reliable
• Whether the institution's ATIP capacity limitations justify declining to act on the request

The complainant alleged that Parks Canada failed to respond to an access request within the extended time limit under subsection 9(1) of the Access to Information Act. The request sought records related to human activity and coastal erosion impacts on culturally significant areas within Gulf Islands National Park Reserve, and records leading to the park's closure decision. Parks Canada received the request on May 5, 2025, and extended the response period to October 27, 2025, but failed to respond by this date, leading to a deemed refusal under subsection 10(3). The institution attributed the delay to staffing shortages, technical issues with redaction software, and the need for extensive third-party consultations, particularly with First Nations due to the sensitive nature of the records. The Commissioner found the technical delays unacceptable and emphasized that staffing issues and competing priorities do not justify delays under the Act. Parks Canada committed to providing a partial response by February 27, 2026, and a complete response by April 30, 2026. The Commissioner ordered Parks Canada to provide a complete response by April 30, 2026, which the institution agreed to implement.

• Whether Parks Canada responded to the access request within the extended time limit under subsection 9(1) of the ATIA
• Whether technical issues with redaction software justify delay in responding to an access request
• Whether staffing shortages and heavy workload justify delay in responding to an access request
• Whether the need for third-party consultations justifies delay in responding to an access request

The complainant alleged that Shared Services Canada (SSC) improperly withheld information from a Gartner, Inc. report on cloud economics under various sections of the Access to Information Act. Initially, SSC claimed exemptions under subsections 19(1), 20(1)(b), 20(1)(c), and 20(1)(d), later dropping 19(1) and 20(1)(d) but adding 16(2). Gartner also asserted exemptions under 20(1)(a) and 68(a). The Commissioner found that while some information met the requirements of paragraph 20(1)(b), much of the claimed information did not, including administrative details and government-supplied data. The Commissioner also concluded that SSC failed to properly exercise discretion for information withheld under subsection 16(2) and did not establish that paragraphs 20(1)(a) or 20(1)(c) applied. Furthermore, SSC failed to adhere to severance requirements under section 25. The complaint was found to be well founded, and SSC was ordered to re-exercise discretion for the subsection 16(2) claim and disclose specific portions of the report.

• Whether the complaint falls under paragraph 30(1)(a) of the Act
• Whether subsection 19(1) (personal information) applied to the information
• Whether paragraph 20(1)(d) (negotiations by a third party) applied to the information
• Whether subsection 16(2) (facilitating the commission of an offence) applied to the security measures on page 134
• Whether Shared Services Canada reasonably exercised its discretion under subsection 16(2)
• Whether paragraph 20(1)(a) (third-party trade secrets) applied to the information
• Whether the information was a "plan or process, tool, mechanism or compound" under paragraph 20(1)(a)
• Whether the information was "secret" under paragraph 20(1)(a)
• Whether the third party intended to treat the information as secret under paragraph 20(1)(a)
• Whether paragraph 20(1)(b) (confidential third-party financial, commercial, scientific or technical information) applied to the information
• Whether the information was financial, commercial, scientific or technical under paragraph 20(1)(b)
• Whether the information was objectively confidential under paragraph 20(1)(b) (not available from other sources)
• Whether the information was objectively confidential under paragraph 20(1)(b) (reasonable expectation of non-disclosure)
• Whether the information was objectively confidential under paragraph 20(1)(b) (relationship fostered for public benefit)
• Whether the third party supplied the information to a government institution under paragraph 20(1)(b)
• Whether the third party consistently treated the information as confidential under paragraph 20(1)(b)
• Whether paragraph 20(1)(c) (financial impact on a third party) applied to the information
• Whether disclosure could result in material financial loss or gain to the third party under paragraph 20(1)(c)
• Whether disclosure could injure the competitive position of the third party under paragraph 20(1)(c)
• Whether there was a reasonable expectation of harm well beyond a mere possibility under paragraph 20(1)(c)
• Whether section 25 (severance) was properly applied by Shared Services Canada
• Whether paragraph 20(1)(b) applied to administrative details
• Whether paragraph 20(1)(b) applied to introductory slides
• Whether paragraph 20(1)(b) applied to engagement objectives
• Whether paragraph 20(1)(b) applied to section title slides
• Whether paragraph 20(1)(b) applied to table of contents
• Whether paragraph 20(1)(b) applied to government information
• Whether paragraph 20(1)(b) applied to file names and icons
• Whether paragraph 20(1)(b) applied to project-specific advice paid for by the government
• Whether paragraph 20(1)(b) applied to application names and descriptions

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) failed to respond to an access request within the extended timeframe, constituting a deemed refusal under subsection 10(3) of the Access to Information Act. The request sought records related to parliamentary consideration of electric vehicle battery manufacturing facilities, agreements between manufacturers and the Government of Canada, and the use of foreign workers in these facilities. ISED had extended the response deadline by 300 days, but failed to meet it, primarily due to a lack of responsiveness from its Industry Sector. The Commissioner found the delay unacceptable and noted that the complainant had been waiting almost 18 months for a response. The Commissioner ordered ISED to provide a complete response within 60 business days of the final report. ISED indicated its intention to comply with the order, and the complaint was found to be well founded.

• Whether the institution responded within the extended time limits under subsection 9(1) of the Access to Information Act
• Whether the institution is deemed to have refused access under subsection 10(3) of the Access to Information Act

The complainant alleged that Health Canada improperly withheld information under paragraphs 20(1)(b) and 20(1)(c) of the Access to Information Act, related to submissions for using Anafranil / Altius Clomipramine in the treatment of obsessive-compulsive disorder. During the investigation, the complainant narrowed the scope of the complaint to specific pages and no longer pursued the personal information exemption. Both Health Canada and the third party, AA Pharma Inc., declined to provide detailed representations to support the exemptions, stating that due to the passage of time, the exemptions no longer applied. The Information Commissioner found that the institution and third party failed to demonstrate that the exemptions were still applicable. Consequently, the Commissioner ordered Health Canada to disclose the information. Health Canada notified the Commissioner of its intent to comply with the order.

• Whether the information met the requirements of s.20(1)(a) ATIA (third-party trade secrets)
• Whether the information met the requirements of s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information)
• Whether the information met the requirements of s.20(1)(c) ATIA (financial impact on a third party)

The complainant alleged that Fisheries and Oceans Canada (DFO) improperly withheld records related to commercial fishing agreements with Eskasoni First Nation (EFN) from 2000 to 2020, citing exemptions under subsections 19(1), 20(1)(b), and 20(1)(c) of the Access to Information Act. The Information Commissioner found that DFO correctly applied subsection 19(1) to personal information that remained after some signatures were voluntarily disclosed. However, for much of the information withheld under paragraph 20(1)(b), DFO and EFN failed to demonstrate that it was objectively confidential, supplied by a third party, or consistently treated as confidential, leading to its rejection for many portions. The Commissioner upheld paragraph 20(1)(b) for specific financial details like EFN contribution amounts, salary information, activity costs, and supplier quotes. Furthermore, the Commissioner rejected the application of paragraph 20(1)(c), concluding that the alleged financial harm or competitive injury was speculative and lacked concrete evidence. Consequently, the complaint was found to be well founded. DFO was ordered to disclose the information improperly withheld under paragraphs 20(1)(b) and 20(1)(c), and the institution agreed to implement the order.

• Whether the information met the definition of "personal information" under s.19(1) ATIA.
• Whether DFO reasonably exercised its discretion under s.19(2) ATIA regarding personal information.
• Whether the information was financial, commercial, scientific, or technical under s.20(1)(b) ATIA.
• Whether the information was objectively confidential under s.20(1)(b) ATIA.
• Whether the information was not otherwise available from public sources (sub-criterion of confidentiality).
• Whether the information originated and was communicated with a reasonable expectation of confidence (sub-criterion of confidentiality).
• Whether the relationship between the government and third party would be fostered for public benefit by keeping the information confidential (sub-criterion of confidentiality).
• Whether the information was supplied by a third party to a government institution under s.20(1)(b) ATIA.
• Whether the third party consistently treated the information as confidential under s.20(1)(b) ATIA.
• Whether disclosure of the information could reasonably be expected to have a material financial impact on a third party under s.20(1)(c) ATIA.
• Whether disclosure of the information could reasonably be expected to harm a third party's competitive position under s.20(1)(c) ATIA.
• Whether the alleged harm under s.20(1)(c) ATIA was well beyond a mere possibility or speculative.

The complainant alleged that Public Services and Procurement Canada (PSPC) took an unreasonable extension of time under subsection 9(1) of the Access to Information Act to respond to a request for documents related to parliamentary consideration of ArriveCAN. The OIC investigated two allegations: that the extension was unreasonable (s.30(1)(c)) and that it did not meet the requirements of section 9 (s.30(1)(a)). PSPC had extended the response time by 600 days under paragraph 9(1)(a) for volume of records and 150 days under paragraph 9(1)(b) for consultations. The OIC found that the extension under 9(1)(a) was reasonable due to the large volume of records and potential interference with operations. However, the OIC determined that the 150-day extension under 9(1)(b) was not reasonable because PSPC relied primarily on service standards rather than a genuine assessment of the actual time required for consultations. Consequently, the OIC concluded that PSPC was deemed to have refused access under subsection 10(3) and ordered PSPC to provide a complete response by June 1, 2026, also recommending interim releases for non-consultation documents. PSPC agreed to implement the order and recommendation.

• Whether the extension of time taken under subsection 9(1) was unreasonable (s.30(1)(c))
• Whether the extension of time taken met the requirements of section 9 (s.30(1)(a))
• Whether the request was for a large number of records under paragraph 9(1)(a)
• Whether meeting the 30-day deadline would unreasonably interfere with the institution’s operations under paragraph 9(1)(a)
• Whether the extension of time under paragraph 9(1)(a) was for a reasonable period
• Whether consultations were necessary under paragraph 9(1)(b)
• Whether consultations could reasonably be completed within 30 days under paragraph 9(1)(b)
• Whether the extension of time under paragraph 9(1)(b) was for a reasonable period
• Whether PSPC was deemed to have refused access pursuant to subsection 10(3)

An anonymous applicant complained that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) improperly withheld a 2000 land claim settlement agreement with the Squamish Nation. CIRNAC initially claimed exemptions under paragraphs 20(1)(b), 20(1)(c), and section 23 of the Access to Information Act, later adding paragraphs 18(b) and 20(1)(d) during the investigation. The Information Commissioner found that CIRNAC failed to demonstrate how any of the claimed exemptions applied to the records. Specifically, the institution did not establish a reasonable expectation of harm for the harms-based exemptions, nor did it meet all criteria for the class-based exemption. The Commissioner also rejected the argument that common law settlement privilege could be a stand-alone basis for refusal under the Act. Consequently, the complaint was found to be well-founded, and CIRNAC was ordered to disclose the records in their entirety. However, CIRNAC notified the Commissioner that it would not implement the order.

• Whether the information met the requirements of s.18(b) (competitive position or negotiations of a government institution)
• Whether the circumstances for exercising discretion under s.18(b) existed
• Whether the information met the requirements of s.20(1)(b) (confidential third-party financial, commercial, scientific or technical information)
• Whether the circumstances for exercising discretion under s.20(1)(b) existed
• Whether the information met the requirements of s.20(1)(c) (material financial impact on a third party or harm to its competitive position)
• Whether the circumstances for exercising discretion under s.20(1)(c) existed
• Whether the information met the requirements of s.20(1)(d) (interference with contractual or other negotiations of a third party)
• Whether the circumstances for exercising discretion under s.20(1)(d) existed
• Whether the information met the requirements of s.23 (solicitor-client or litigation privilege)
• Whether the circumstances for exercising discretion under s.23 existed
• Whether common law settlement privilege can be invoked as a stand-alone basis for refusing disclosure under the Access to Information Act
• Whether the public interest in access outweighed the public interest in preserving settlement privilege
• Whether CIRNAC fulfilled its severance obligations under s.25 of the Act