Canadian privacy & access decisions

The complainant alleged that Public Safety Canada (Public Safety) improperly refused to process an access request for records related to keywords such as 'counter-radicalization' and 'cyber radicalization', including associated metadata. Public Safety argued that portions of the request did not meet the requirements of section 6 of the Access to Information Act due to the expansive volume of records and the complexity of identifying relevant information. The Commissioner agreed that some parts of the request were too broad, but found that other parts (Paragraph 1 and Schedule A) were sufficiently detailed and should have been processed. The Commissioner also determined that Public Safety failed to meet its legislated obligations by not claiming an extension of time and by refusing to process any part of the request. The complaint was found to be well founded, and Public Safety committed to processing the valid portions of the request at a rate of 5,000 pages per year.

• Whether the request provided sufficient detail to enable an experienced employee to identify records with reasonable effort (s.6 ATIA)
• Whether Public Safety was justified in refusing to process the entire request if only parts of it met s.6 ATIA requirements
• Whether Public Safety complied with its obligation to claim an extension of time under s.9(1) ATIA
• Whether Public Safety made every reasonable effort to assist the requester (s.4(2.1) ATIA)
• Whether Public Safety was required to consult on the term 'metadata' and provide records in the requested format

The complainant alleged that Yahoo! Canada's default "Stay signed in" setting for Yahoo Mail, particularly for Rogers Yahoo Mail users, posed significant privacy concerns on public or shared computers. The OPC investigated whether Yahoo adequately safeguarded against unauthorized access and obtained valid consent for potential disclosures. The OPC found that Yahoo's safeguards were not appropriate for the sensitivity of email content and that its consent for the "Stay signed in" setting was not meaningful. Yahoo committed to changing the setting to opt-in and providing clearer information about privacy implications. Rogers, while not a respondent, also agreed to implement measures for Rogers Yahoo Mail users. The complaint was found to be well-founded and conditionally resolved.

• Whether Yahoo's safeguards against unauthorized third-party access to email content on public or shared computers were adequate under Principle 4.7 PIPEDA
• Whether Yahoo obtained valid and meaningful consent for the disclosure of personal information to others who subsequently access emails via the "Stay signed in" setting under Principle 4.3 PIPEDA
• Whether the "Stay signed in" setting was clearly and prominently displayed
• Whether a reasonable person would understand the "Stay signed in" setting to be "on" by default
• Whether the "Stay signed in" setting is consistent with industry standards
• Whether Yahoo's additional safeguards (algorithm, sign-out option, session expiration, password reset, security information) were effective
• Whether express opt-in consent was required for the "Stay signed in" setting due to sensitivity of information, reasonable expectations, and risk of harm
• Whether the language "stay signed in" provided users with key information for meaningful consent

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld information under subsection 19(1) of the Access to Information Act, concerning a follow-up investigation related to a Code of Conduct decision against the complainant. During the investigation, the RCMP conceded that some of the withheld information was not personal information and issued a supplementary release. However, the RCMP maintained the application of subsection 19(1) on the remaining information. The Office of the Information Commissioner (OIC) found that the remaining withheld information was indeed personal information about another individual, meeting the requirements of the exemption. The OIC also concluded that none of the circumstances under subsection 19(2) that would warrant disclosure existed. Therefore, the complaint was found to be well founded because the RCMP initially withheld information that was not personal information, but the OIC upheld the exemption for the remaining records.

• Whether the information initially withheld by the RCMP constituted personal information under s.19(1) ATIA
• Whether the remaining withheld information was personal information about another individual under s.19(1) ATIA
• Whether the circumstances for disclosure under s.19(2) ATIA existed

The OPC initiated an investigation into CashHere, a short-term lender, after being alerted by the Ontario Ministry of Government and Consumer Services that it was collecting online banking credentials (passwords, usernames, security questions/answers) from loan applicants. The OPC found that while CashHere had a legitimate need to validate identity and income, collecting banking credentials was not an appropriate purpose under PIPEDA s. 5(3) due to less privacy-invasive alternatives and disproportionate privacy risks. The investigation also noted that a related entity, MoneyHome, appeared to be continuing the same practices. CashHere ceased responding to the OPC, and the matter was found to be well-founded and unresolved.

• Whether CashHere's collection of online banking login credentials was for a purpose that a reasonable person would consider appropriate under s. 5(3) of PIPEDA
• Whether the collection of banking credentials was effective in meeting CashHere's legitimate need
• Whether there were less privacy-invasive means of achieving the same ends
• Whether the loss of privacy was proportional to the benefits for CashHere

The complainant alleged that the Canadian Security Intelligence Service (CSIS) took an unreasonable time extension under paragraph 9(1)(b) of the Access to Information Act for consultations. CSIS justified a 240-day extension, citing the necessity of consulting with two other government institutions, the high classification and sensitivity of the records, the need for on-site review, and limited workplace access due to the pandemic. The Office of the Information Commissioner (OIC) found that CSIS made a serious effort to determine the extension's length based on the pandemic's realities. The OIC concluded that the time extension was reasonable given the circumstances and that CSIS met the three requirements for claiming such an extension. Therefore, the complaint was not well founded.

• Whether the time extension taken under paragraph 9(1)(b) for consultations was reasonable
• Whether CSIS met the three requirements to claim the time extension

The Office of the Information Commissioner (OIC) received nine complaints regarding Global Affairs Canada's (GAC) failure to respond to nine access requests within the statutory deadlines or taking unreasonable time extensions. GAC cited the COVID-19 pandemic as a significant factor impacting its ability to process these requests. Despite the challenges, GAC committed to providing a final response for all nine files by October 15, 2021. The Commissioner found all nine complaints to be well founded, indicating that GAC improperly delayed access to the requested information. This decision highlights the institution's obligation to meet timelines under the Access to Information Act, even when facing operational difficulties.

• Whether Global Affairs Canada failed to respond to access requests within the statutory deadlines
• Whether Global Affairs Canada took unreasonable time extensions for access requests

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld information under paragraph 16(1)(a) of the Access to Information Act. The requested information pertained to a complaint investigated by the RCMP. The OIC's investigation determined that the withheld information was obtained by the RCMP, an investigative body specified in the regulations, during a lawful investigation related to the detection, prevention, or suppression of crime. Furthermore, the information was created less than twenty years before the request. The OIC also found that the RCMP reasonably exercised its discretion by considering relevant factors for and against disclosure, including the purpose of the Act and the private interests of other individuals. Consequently, the OIC concluded that the information met the requirements for exemption under paragraph 16(1)(a) and that the institution's decision to withhold it was appropriate.

• Whether the information was obtained or prepared by an investigative body listed in Schedule I of the Access to Information Regulations
• Whether the information was obtained or prepared during a lawful investigation within the authority of the investigative body
• Whether the investigation concerned the detection, prevention, or suppression of crime, enforcement of law, or threats to security of Canada
• Whether the information was created less than 20 years before the access request
• Whether the institution reasonably exercised its discretion to decide whether to release the information under s.16(1)(a)

The complainant alleged that the Canada Revenue Agency (CRA) improperly withheld information under subsection 24(1) of the Access to Information Act. The request sought income-related information regarding business ownership for a specific individual. The CRA claimed that the information was exempt from disclosure because section 241 of the Income Tax Act (ITA) restricts its release. The Office of the Information Commissioner (OIC) found that the requested information constituted "taxpayer information" as defined in subsection 241(10) of the ITA, meaning it related to an identifiable taxpayer (not the complainant) and was obtained by the CRA for administering the ITA. Consequently, the OIC concluded that the information met the requirements for exemption under subsection 24(1) of the ATIA. The complaint was therefore deemed not well founded.

• Whether the requested information falls under the definition of "taxpayer information" in subsection 241(10) of the Income Tax Act
• Whether section 241 of the Income Tax Act restricts the disclosure of the requested information
• Whether subsection 24(1) of the Access to Information Act applies to exempt the information from disclosure

The complainant alleged that Health Canada failed to conduct a reasonable search for records in response to two access requests concerning personal or designated producers and users of medical cannabis. Health Canada provided records from one database but argued that retrieving additional potentially relevant information from a second database would be unreasonable due to the extensive manual labour required. The Office of the Information Commissioner (OIC) agreed with Health Canada's position. The OIC found that the institution's search was reasonable, considering the burden of retrieving records from the second database. Consequently, the complaint was not well-founded.

• Whether Health Canada conducted a reasonable search for records under s.4 of the ATIA

The complainant alleged that Transport Canada improperly withheld annual statistics related to processing access to information and privacy requests, citing section 26 of the Access to Information Act. Transport Canada argued that the information was intended for future publication. The Office of the Information Commissioner (OIC) investigated whether the institution met the criteria for applying section 26 and properly exercised its discretion. The OIC found that Transport Canada had satisfied the requirements for section 26 and had considered all relevant factors for and against disclosure. Consequently, the OIC concluded that the institution's decision to withhold the records was appropriate.

• Whether s.26 ATIA (information to be published) was properly applied
• Whether Transport Canada appropriately exercised its discretion under s.26 ATIA