Canadian Privacy Decisions

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint from a truck driver alleging that his employer, Oculus Transport Ltd., collected personal information through audio surveillance in the truck cab for inappropriate purposes. The OPC found that while Oculus had a legitimate business need for some surveillance, the continuous audio recording, even when drivers were off-duty, was excessively intrusive and disproportionate to the benefits. Oculus has since stopped using audio surveillance.

• Whether the purposes for which Oculus collected audio recordings were appropriate under PIPEDA's section 5(3).
• Whether less privacy-invasive means were available to Oculus to achieve its stated purposes.
• Whether the intrusion on drivers' privacy was proportionate to the benefits gained by Oculus.

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) took an unreasonable extension of time to respond to an access request for information related to the Competition Bureau's bread price-fixing investigation. The request involved over 75 million pages of records. ISED calculated the extension by considering the volume of records, the time needed for the program area to gather records, and the time needed by the Access to Information and Privacy Office to analyze exemptions. The Information Commissioner found the complaint not well founded, agreeing that the extension was reasonable and that ISED followed the proper procedures.

• Whether the extension of time taken by the institution was reasonable under paragraph 9(1)(a) of the Access to Information Act.
• Whether the request involved a large number of records or required searching through a large number of records.
• Whether meeting the 30-day deadline would unreasonably interfere with the institution's operations.
• Whether the duration of the extension was reasonable given the circumstances.

The complainant alleged that Public Safety Canada refused to process an access request for records related to various keywords. Public Safety argued parts of the request did not meet the Act's requirements and processing it would be overly burdensome. The Commissioner found the complaint well-founded, agreeing that some parts of the request were too vague but that Public Safety improperly refused to process the parts that did meet the criteria. Public Safety Canada committed to processing 5,000 pages per year of the relevant records.

• Adequacy of the request details under section 6 of the ATIA
• Institution's obligation to process requests in parts
• Institution's duty to assist requesters
• Timely processing of large volumes of records

This investigation concerned Yahoo! Canada's "Stay signed in" feature for its email service, which defaulted to keeping users logged in. The OPC found this practice posed significant privacy risks, especially on public or shared computers, as emails can contain highly sensitive personal information. Yahoo was found to have inadequate safeguards and failed to obtain meaningful consent for the disclosure of personal information that could result from this default setting. Yahoo committed to changing the feature to an opt-in basis and providing clearer warnings to users.

• Adequacy of safeguards against unauthorized access to sensitive email content.
• Whether "Stay signed in" default setting constitutes meaningful consent for disclosure of personal information.
• Clarity and prominence of privacy warnings associated with the "Stay signed in" feature.

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld information under subsection 19(1) of the Access to Information Act related to a follow-up investigation concerning a Code of Conduct decision against the complainant. The RCMP initially withheld information, but later released some of it, conceding it was not personal information. However, they continued to withhold other information under subsection 19(1). The OIC concluded that the remaining withheld information was indeed personal information concerning another individual and did not meet the exceptions in subsection 19(2), therefore the complaint was well founded.

• Application of subsection 19(1) (personal information) of the ATIA
• Whether withheld information constituted personal information of another individual
• Whether the exceptions in subsection 19(2) of the ATIA applied

The Office of the Privacy Commissioner of Canada (OPC) investigated a short-term lender, CashHere, after receiving an alert that it was collecting clients' online banking credentials (usernames, passwords, security questions and answers) as part of its payday loan application process. The OPC found that while the lender had a legitimate need to verify identity and income, collecting these highly sensitive credentials was not a purpose that a reasonable person would consider appropriate due to the significant privacy risks and the availability of less invasive alternatives. The investigation also uncovered a related entity, MoneyHome, engaging in similar practices.

• Appropriateness of collecting online banking credentials for loan applications
• Proportionality of privacy harms versus lender benefits
• Availability of less privacy-invasive means to verify identity and income
• Potential link between CashHere and MoneyHome

The complainant alleged that the Canadian Security Intelligence Service (CSIS) took an unreasonable amount of time to respond to an access to information request, specifically concerning a time extension for consultations. CSIS argued that the extension was necessary due to the sensitivity of the records, the need for on-site review, and limited workplace access, all exacerbated by the pandemic. The OIC found that CSIS made a reasonable effort to assess the extension period and concluded that the time taken was justified given the circumstances.

• Reasonableness of time extension for consultations under paragraph 9(1)(b) of the ATIA.
• Impact of the pandemic on the ability of institutions to complete consultations within the standard timeframes.
• Whether CSIS adequately demonstrated the necessity and duration of the time extension.

The Office of the Information Commissioner (OIC) received nine complaints concerning Global Affairs Canada's failure to meet deadlines or take unreasonable time extensions in responding to access requests. In four cases, the institution cited the COVID-19 pandemic as a significant factor. Global Affairs committed to finalizing all nine requests by October 15, 2021. The OIC found all nine complaints to be well founded.

• Timeliness of response to access to information requests
• Impact of COVID-19 on institution's ability to process requests
• Reasonableness of time extensions

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld information under paragraph 16(1)(a) of the Access to Information Act. The OIC found that the withheld information was obtained by the RCMP during a lawful investigation related to the suppression of crime and was created less than 20 years before the request. The OIC was also satisfied that the RCMP reasonably exercised its discretion in deciding to withhold the information.

• Whether the information was obtained or prepared by an investigative body in the course of a lawful investigation pertaining to the detection, prevention or suppression of crime.
• Whether the information came into existence less than twenty years prior to the request.
• Whether the RCMP reasonably exercised its discretion to withhold the information.

The complainant alleged that the Canada Revenue Agency (CRA) improperly withheld information concerning a specific individual's business ownership under subsection 24(1) of the Access to Information Act. The OIC found that the requested information was about an identifiable taxpayer (not the complainant) and was obtained by the CRA for the purposes of administering the Income Tax Act. As section 241 of the Income Tax Act restricts the disclosure of such information, the OIC concluded the CRA properly withheld the records.

• Whether the information requested was properly withheld under subsection 24(1) of the ATIA (disclosure restricted by another law).
• Whether the information constituted taxpayer information as defined by the Income Tax Act.
• Whether section 241 of the Income Tax Act restricted the disclosure of the requested information.

The complainant alleged that Health Canada did not conduct a reasonable search for records concerning producers and users of medical cannabis. Responsive records were drawn from one database, but Health Canada argued retrieving additional records from a second database would be unreasonable due to the manual labour involved. The Information Commissioner agreed that the search was reasonable given the effort required.

• Reasonableness of search

The complainant alleged that Transport Canada improperly relied on section 26 of the Access to Information Act to refuse access to annual statistics regarding the processing of access to information and privacy requests. The Office of the Information Commissioner found that Transport Canada met the criteria for applying section 26 and had properly considered all relevant factors in its decision.

• Applicability of section 26 of the ATIA (Refusal of access if information to be published)
• Proper exercise of discretion by the institution