Canadian privacy & access decisions

The complainant alleged that the Canada Revenue Agency (CRA) improperly withheld information related to the Canada Emergency Wage Subsidy (CEWS) database for all recipient corporations. The CRA had released a list of company names but withheld the total CEWS amounts received by each company, citing subsections 24(1), 16(1)(c), and 19(1) of the Access to Information Act. The Office of the Information Commissioner (OIC) focused its investigation on subsection 24(1), which mandates refusal of disclosure if restricted by a Schedule II provision. The OIC found that the withheld information constituted "taxpayer information" as defined by section 241 of the Income Tax Act, a Schedule II provision, because it related to identifiable taxpayers and was obtained or prepared by CRA for administering the Income Tax Act. Since subsection 24(1) was found to apply, the OIC did not assess the applicability of subsections 16(1)(c) and 19(1) to the same information. The Commissioner concluded that the information was properly withheld, and the complaint was not well founded.

• Whether the withheld information constitutes "taxpayer information" under section 241 of the Income Tax Act
• Whether section 241 of the Income Tax Act restricts disclosure of the information under subsection 24(1) of the ATIA
• Whether subsection 24(1) ATIA was properly applied to withhold the information
• Whether paragraph 16(1)(c) ATIA applies to the information (not considered)
• Whether subsection 19(1) ATIA applies to the information (not considered)

The complainant alleged that Public Services and Procurement Canada (PSPC) failed to respond to an access request by the extended due date. The request sought all documents related to the Copyright Media Clearance Program for a specific period. PSPC had extended the response deadline by 420 days, but failed to provide a response by the new due date. The OIC found that PSPC did not meet its obligation to respond within the time limits, leading to a deemed refusal of access. Despite PSPC citing resource limitations and COVID-19 related difficulties, the Commissioner concluded that these were not valid reasons for continued delay. The Commissioner ordered PSPC to provide a final response within 10 days, but PSPC indicated it would not fully implement the order, proposing a phased approach with a later completion date.

• Whether the institution responded to the access request by the extended due date under subsection 9(1) of the Access to Information Act
• Whether the institution is deemed to have refused access under subsection 10(3) of the Access to Information Act

The complainant alleged that the Royal Canadian Mounted Police (RCMP) failed to conduct a reasonable search for records related to its "E Norther" file and National Administrative Records Management System (NARMS). Specifically, the complainant identified the RCMP's Legal Services Unit as a potential source of records, but the RCMP initially refused to search this area, claiming the records would not be under its control. The OIC's investigation found that any such records would likely be under the RCMP's control. The RCMP subsequently agreed to task its Legal Services Unit, which led to the identification and release of additional records to the complainant. The Commissioner concluded that the RCMP's initial search was not reasonable and ordered the RCMP to confirm with an outstanding Office of Primary Interest (OPI) and process any further responsive records. The RCMP later confirmed that the outstanding OPI had responded and an additional response was sent to the complainant.

• Whether the Royal Canadian Mounted Police conducted a reasonable search for records
• Whether records held by the RCMP's Departmental Legal Services Unit were under the control of the RCMP

The complainant alleged that the Immigration and Refugee Board of Canada (IRB) failed to conduct a reasonable search for records in response to a request for "all final decisions rendered pursuant to section 37 of the Immigration and Refugee Protection Act (IRPA) from January 2018 until June 2020." The IRB provided only written decisions, stating that audio recordings are only provided when specifically requested. However, the OIC found that the IRB's ATIP office had erroneously informed its Office of Primary Interest that only written decisions were sought, thereby reducing the scope of the request without the complainant's approval. The Commissioner determined that "all final decisions" includes audio recordings, as a record under the Act means any documentary material regardless of medium or form. Consequently, the Commissioner found that the IRB did not perform a reasonable search.

• Whether the institution conducted a reasonable search for records
• Whether audio recordings fall within the scope of "all final decisions"

The complainant alleged that the Public Health Agency of Canada (PHAC) took an unreasonable extension of time to respond to an access request for all correspondence, including emails, MS Teams messages, texts, and phone messages, sent and received by Iain Stewart between June 14 and June 21, 2021. PHAC notified the complainant of a 1,950-day extension under paragraphs 9(1)(a) and 9(1)(b) of the Access to Information Act. The Commissioner found that PHAC demonstrated the request involved a large volume of records (30,000 pages) and that meeting the 30-day deadline would unreasonably interfere with its operations, particularly given its role in the COVID-19 pandemic response and increased ATIP workload. The Commissioner also found that consultations were necessary and could not be completed within 30 days. Despite the lengthy extension, the Commissioner concluded that PHAC's calculation was reasonable given the circumstances, including the complexity of the records and the institution's processing capacity. Therefore, the complaint was not well founded.

• Whether the extension of time under s.9(1)(a) was unreasonable
• Whether the request was for a large number of records or required searching through a large number of records
• Whether meeting the 30-day deadline would unreasonably interfere with the institution’s operations
• Whether the extension of time under s.9(1)(a) was for a reasonable period, given the circumstances
• Whether the extension of time under s.9(1)(b) was unreasonable
• Whether the institution needed to carry out consultations on the requested records
• Whether the consultations could reasonably be completed within 30 days
• Whether the extension of time under s.9(1)(b) was for a reasonable period, given the circumstances
• Whether the time extension was validly claimed

An anonymous applicant complained that Innovation, Science and Economic Development Canada (ISED) improperly withheld "Total Repayment figures" related to several projects under the Technology Partnerships Canada (TPC) program, involving 21 third parties. ISED initially relied on paragraph 20(1)(c) of the Access to Information Act, while some third parties also raised paragraphs 20(1)(b) and 20(1)(d). The Commissioner found that the information was financial and commercial but not objectively confidential under paragraph 20(1)(b), as there was no reasonable expectation of non-disclosure for public funds, nor would confidentiality foster public benefit. For paragraph 20(1)(c), the Commissioner determined that neither ISED nor the third parties demonstrated a clear and direct connection between disclosure and a reasonable expectation of material financial harm or injury to competitive position, deeming their arguments speculative. Similarly, for paragraph 20(1)(d), insufficient evidence was provided to show that disclosure would interfere with contractual negotiations. Consequently, the complaint was found to be well-founded, and the Commissioner ordered ISED to disclose all the Total Repayments figures at issue.

• Whether the Total Repayment figures are financial or commercial information under s.20(1)(b) ATIA
• Whether the Total Repayment figures are confidential under s.20(1)(b) ATIA
• Whether the circumstances of communication gave rise to a reasonable expectation of non-disclosure for the Total Repayment figures under s.20(1)(b) ATIA
• Whether confidential communication of the Total Repayment figures would foster the relationship between third parties and ISED for public benefit under s.20(1)(b) ATIA
• Whether disclosure of the Total Repayment figures could reasonably be expected to result in material financial loss or gain to a third party under s.20(1)(c) ATIA
• Whether disclosure of the Total Repayment figures could reasonably be expected to injure the competitive position of a third party under s.20(1)(c) ATIA
• Whether a clear and direct connection between disclosure and harm was demonstrated for s.20(1)(c) ATIA
• Whether arguments of public misunderstanding justify withholding information under s.20(1)(c) ATIA
• Whether disclosure of the Total Repayment figures could reasonably be expected to interfere with contractual or other negotiations of a third party under s.20(1)(d) ATIA
• Whether a clear and direct connection between disclosure and interference (obstruction) was demonstrated for s.20(1)(d) ATIA

The OPC initiated a complaint against MGM Resorts International after media reports revealed a 2019 data breach affecting millions, including Canadians, for which MGM had not reported to the OPC. The investigation focused on whether MGM complied with mandatory breach reporting obligations under PIPEDA. The OPC found that MGM contravened PIPEDA by failing to promptly assess whether the breach posed a real risk of significant harm (RROSH) to affected Canadians and by not reporting the breach or notifying individuals as soon as feasible. MGM had delayed its assessment for Canadians for several months compared to its U.S. customers. In response to OPC recommendations, MGM committed to amending its privacy breach response framework to ensure timely RROSH assessments, reporting to the Commissioner, and notifying affected individuals for future breaches involving Canadians. The matter was found to be well-founded and conditionally resolved.

• Whether MGM had the obligation to report the breach to the OPC and notify affected Canadians
• Whether the MGM breach met the RROSH reporting and notification threshold
• Whether the personal information involved was sensitive
• Whether there was a high probability of misuse of the personal information
• Whether MGM notified the OPC and affected Canadians as soon as feasible

An individual complained that the Department of National Defence (DND) breached the Privacy Act by disclosing their identity as a workplace violence (WPV) complainant to an investigator conducting a separate administrative investigation into the complainant's conduct. DND argued the disclosure was a "consistent use" under paragraph 8(2)(a) of the Privacy Act, necessary to address allegations against the individual. The OPC found that while disclosure to labour relations was a consistent use, disclosure to the investigator was not, as the consent form created a reasonable expectation of confidentiality for the WPV complaint. The OPC concluded that the disclosure to the investigator was not directly connected to the original purpose of collecting the WPV complaint information. DND committed to implementing recommendations to ensure future disclosures align with participants' reasonable expectations.

• Whether the disclosure of the WPV complainant's identity to labour relations was a "consistent use" under paragraph 8(2)(a) of the Privacy Act
• Whether the disclosure of the WPV complainant's identity to an investigator for a separate administrative investigation was a "consistent use" under paragraph 8(2)(a) of the Privacy Act
• Whether the consent form provided by DND created a reasonable expectation of confidentiality regarding the complainant's identity

The complainant alleged that Shared Services Canada (SSC) improperly refused to process an access request for records related to informal official language complaints. SSC argued that the request, even after being narrowed to a one-year timeframe and specific keywords in email subject lines, did not meet the requirements of section 6 of the Access to Information Act because it would require tasking over 8,300 employees and create an unreasonable administrative burden. The Information Commissioner disagreed, stating that the term "reasonable effort" in section 6 refers to identifying records, not limiting the number of individuals tasked. The Commissioner also noted that the Act provides for time extensions for large requests and that the potential for redacting personal information under section 19 is not a valid reason to refuse processing. The Commissioner concluded that the request was sufficiently detailed and ordered SSC to process it.

• Whether the access request provided sufficient detail to enable an experienced employee to identify records with a reasonable effort under s.6 ATIA
• Whether the administrative burden on the institution constitutes a valid reason to refuse processing a request under s.6 ATIA
• Whether the potential for retrieving personal information that would be exempt under s.19 ATIA is a valid reason to refuse processing a request

The complainant alleged that Biron Health Group (Biron) sent him promotional emails without his consent after he underwent mandatory COVID-19 testing upon arrival at Montreal Trudeau Airport. He provided his email solely for test results. Biron initially believed it had implicit consent due to an established business relationship. The OPC found that Biron could not reasonably assume implicit consent, as travellers had no choice but to use Biron for mandatory testing and would not expect their health information to be used for marketing. Biron ceased the practice and deleted affected email addresses from its marketing database. The complaint was settled during the investigation.

• Whether Biron Health Group had implicit consent to send promotional emails to individuals undergoing mandatory COVID-19 testing
• Whether the collection of personal information for mandatory health testing could be used for secondary marketing purposes

The complainant alleged that Public Services and Procurement Canada (PSPC) failed to provide records in response to an access request concerning a contract awarded to Brookfield Global Integrated Solutions (BGIS) and a related subcontract. PSPC initially stated it could not identify relevant records, arguing the subcontract was not under its control. The investigation found that while the records were not in PSPC's physical possession, they were under its control for the purposes of the Access to Information Act, based on the legal relationship between PSPC and BGIS and the terms of their contract. The Commissioner concluded that PSPC did not conduct a reasonable search because it made no effort to obtain the subcontract and related documents from BGIS. The complaint was found to be well founded, and the Commissioner recommended PSPC retrieve and process the records. However, PSPC declined to implement the recommendations.

• Whether the subcontract and related records were "under the control" of Public Services and Procurement Canada (PSPC) for the purposes of the Access to Information Act
• Whether the contents of the record relate to an institutional matter
• Whether PSPC could expect to obtain a copy of the record upon request
• Whether PSPC conducted a reasonable search for records responsive to the request

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) improperly withheld information under paragraph 20(1)(c) of the Access to Information Act. The request sought records related to job creation estimates and estimated jobs maintained figures for projects that received assistance between 2011 and 2018. The complaint's scope was narrowed to information concerning eleven third parties, with only Toyota Motor Manufacturing Canada (Toyota) providing representations to support the exemption claim. The Commissioner found that neither Toyota nor ISED demonstrated a clear and direct connection between disclosure and a risk of material financial loss or harm to Toyota's competitive position, beyond mere speculation. Arguments regarding potential public misunderstanding were also deemed insufficient to meet the legal test for harm under s.20(1)(c), especially given that an explanatory note could address such concerns. Consequently, the Commissioner concluded that the information did not qualify for the exemption. The complaint was found to be well founded, and the Commissioner recommended full disclosure, though ISED indicated it would not fully implement the recommendation for some Toyota-related information.

• Whether s.20(1)(c) ATIA (financial impact on a third party) applies to job creation estimates and estimated jobs maintained figures
• Whether disclosure could result in material financial loss or gain to a third party
• Whether there is a reasonable expectation of harm beyond a mere possibility
• Whether disclosure could injure the competitive position of a third party
• Whether arguments of public misunderstanding are sufficient to meet the legal test for harm under s.20(1)(c)
• Whether an explanatory note could prevent potential harm to a third party
• Whether ISED met its burden of proof for applying s.20(1)(c) to information where third parties did not provide representations

The complainant alleged that the Vancouver Fraser Port Authority (VFPA) improperly withheld information under paragraphs 18(b), 18(d), 20(1)(b), and 20(1)(d) of the Access to Information Act, concerning records related to $103 million in funding from the National Trade Corridors Fund. The OIC found that VFPA did not demonstrate that all information withheld under paragraphs 18(b) and 18(d) met the exemption requirements. Specifically, VFPA agreed to disclose some information initially withheld under these sections. For paragraphs 20(1)(b) and 20(1)(d), neither VFPA nor the third party (Canadian National Railway) provided sufficient evidence to justify the exemptions. The Commissioner ordered VFPA to disclose all information withheld under paragraphs 20(1)(b) and 20(1)(d), and specific information withheld under paragraphs 18(b) and 18(d). VFPA subsequently agreed to implement the order, leading to a well-founded complaint.

• Whether s.18(b) ATIA (competitive position or negotiations of government institutions) was properly applied to fiscal year budgeting, Monitoring Committee, and project information
• Whether s.18(b) ATIA (competitive position or negotiations of government institutions) was properly applied to estimated project expenditures and contributions
• Whether the institution reasonably exercised its discretion under s.18(b) ATIA
• Whether s.18(d) ATIA (government financial interests, ability to manage economy, undue benefit) was properly applied to commodity information
• Whether s.18(d) ATIA (government financial interests, ability to manage economy, undue benefit) was properly applied to certain project details
• Whether s.18(d) ATIA (government financial interests, ability to manage economy, undue benefit) was properly applied to future development plans
• Whether s.18(d) ATIA (government financial interests, ability to manage economy, undue benefit) was properly applied to project costs
• Whether the institution reasonably exercised its discretion under s.18(d) ATIA
• Whether s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information) was properly applied to project descriptions and CN funding information
• Whether the information is financial, commercial, scientific or technical under s.20(1)(b) ATIA
• Whether the information is confidential by an objective standard under s.20(1)(b) ATIA
• Whether the information was supplied by a third party to a government institution under s.20(1)(b) ATIA
• Whether the third party consistently treated the information as confidential under s.20(1)(b) ATIA
• Whether s.20(1)(d) ATIA (negotiations by a third party) was properly applied to the name of a contributor and contribution amount from CN
• Whether there was a reasonable expectation of interference with third-party negotiations under s.20(1)(d) ATIA

The complainant alleged that the Department of Justice Canada (Justice) took an unreasonable 2,280-day extension to respond to an access to information request. Justice claimed the extension under paragraphs 9(1)(a) and 9(1)(b) of the Access to Information Act, citing a large volume of records and the need for consultations. The Information Commissioner found that while the request involved a large volume of records and responding within 30 days would interfere with operations, Justice failed to sufficiently justify the reasonableness of the 2,190-day extension claimed under 9(1)(a). Specifically, Justice did not explain how the duration of various processing steps was determined or why certain steps could not be conducted concurrently. However, the Commissioner found the 90-day extension for consultations under 9(1)(b) to be reasonable. Due to the unreasonable extension under 9(1)(a), Justice was deemed to have refused access. The complaint was found to be well-founded, and Justice was ordered to provide a final response forthwith.

• Whether the request was for a large volume of records or required searching through a large number of records under s.9(1)(a)
• Whether responding within 30 days would unreasonably interfere with the institution's operations under s.9(1)(a)
• Whether the length of the time extension claimed under s.9(1)(a) was reasonable
• Whether consultations with other institutions or bodies were necessary under s.9(1)(b)
• Whether the length of the time extension claimed under s.9(1)(b) was reasonable
• Whether the institution was in deemed refusal under s.10(3)

The Information Commissioner initiated a systemic investigation into Library and Archives Canada's (LAC) persistent delays in responding to access requests, prompted by a history of non-compliance with legislative deadlines. The investigation found that LAC failed to meet its obligation to provide timely access, with almost 80% of requests completed after the statutory deadlines in 2020-21. Key contributing factors identified were the backlog from suspending ATIP operations during the pandemic, problematic consultation practices with other institutions, inadequate infrastructure for processing classified records, the absence of a government-wide declassification program, and insufficient ATIP funding and resources. The Commissioner concluded the complaint was well-founded and issued ten recommendations to the Minister of Canadian Heritage to address these systemic issues. However, the Commissioner found the Minister's responses largely lacked urgency and concrete commitments, leading to concerns about the sufficiency of proposed measures. The Commissioner also tabled a special report to Parliament highlighting broader challenges in the access to information system.

• Whether Library and Archives Canada (LAC) met its obligation to provide timely access to records under subsection 4(2.1) and section 7 of the ATIA
• Whether LAC's suspension of ATIP operations during the early months of the pandemic contributed to delays and non-compliance
• Whether LAC's practices regarding consultations with other institutions were consistent with paragraph 9(1)(b) of the ATIA and the Interim Directive
• Whether LAC's lack of adequate infrastructure for digitizing, reviewing, and consulting on Secret and Top Secret records contributed to processing delays
• Whether the absence of a mandatory government-wide declassification program contributed to delays in processing classified records
• Whether the lack of adequate funding for LAC's ATIP office to support new programs introduced by other institutions contributed to its inability to provide timely access
• Whether the ATIP and Litigation Response Division's large workload, vacant positions, and staff instability contributed to delays in responding to access requests