Canadian Privacy Decisions

The complainant requested the Canada Emergency Wage Subsidy (CEWS) database for all recipient corporations from the Canada Revenue Agency (CRA). The CRA withheld the total amount of CEWS received by each company, citing exemptions under the Access to Information Act (ATIA), including subsection 24(1) (disclosure restricted by another law). The OIC found that the withheld information was about identifiable taxpayers and was prepared for the purposes of administering the Income Tax Act, and therefore properly withheld under subsection 24(1). Consequently, the complaint was found not well founded.

• Whether the CEWS database information was properly withheld under subsection 24(1) of the ATIA, citing section 241 of the Income Tax Act.
• Whether the information was properly withheld under paragraph 16(1)(c) (conduct of investigations) and subsection 19(1) (personal information) of the ATIA.

The complainant alleged that Public Services and Procurement Canada (PSPC) failed to respond to an access request for documents concerning the Copyright Media Clearance Program by the extended deadline. PSPC had not provided a response when the extended deadline of September 4, 2020, expired. The Information Commissioner found the complaint to be well-founded and ordered PSPC to provide a final response within 10 days.

• Whether the institution responded to the access request within the extended time limit.
• The implications of an institution failing to respond by the deadline.

The complainant alleged the Royal Canadian Mounted Police (RCMP) did not conduct a reasonable search for records related to the "E Norther" file. The RCMP initially refused to search the Legal Services Unit, claiming records would not be under their control. The Information Commissioner found this unreasonable, ordering the RCMP to search and process any responsive records found. The RCMP subsequently located additional records and provided a supplementary release to the complainant.

• Reasonableness of the search conducted by the institution.
• Determination of record control for access to information purposes.
• Scope of records requested by the complainant.

The complainant alleged that the Immigration and Refugee Board of Canada (IRB) failed to conduct a reasonable search for records containing all final decisions made between January 2018 and June 2020. The IRB's ATIP office mistakenly narrowed the request to only written decisions, excluding responsive audio recordings without the complainant's consent. The Information Commissioner found the complaint well-founded and ordered the IRB to process all responsive audio recordings.

• Reasonableness of search
• Definition of 'record' under ATIA
• Scope of access request
• Assistance to requesters

The complainant alleged that the Public Health Agency of Canada (PHAC) unreasonably extended the time to respond to an access request for correspondence sent and received by its president during a specific week. PHAC cited a large volume of records (estimated at 30,000 pages) and the need for consultations as justification for the extensive extension. The Information Commissioner found that PHAC provided sufficient justification for the time extension under paragraphs 9(1)(a) and 9(1)(b) of the Access to Information Act, making the complaint not well-founded.

• Reasonableness of time extension due to volume of records (ATIA s. 9(1)(a))
• Reasonableness of time extension due to consultations (ATIA s. 9(1)(b))
• Impact of request scope on institution's operations
• Complainant's willingness to narrow the scope of the request

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) improperly withheld Total Repayment figures related to the Technology Partnerships Canada (TPC) program, citing exemptions concerning financial impact on third parties (s. 20(1)(c)) and other provisions. The scope was narrowed to 21 third parties. The Information Commissioner found that neither ISED nor the third parties provided sufficient evidence to meet the requirements for these exemptions. Consequently, the Commissioner ordered ISED to disclose all the withheld information.

• Whether the Total Repayments figures meet the criteria for exemption under paragraph 20(1)(b) (confidential third-party information).
• Whether the Total Repayments figures meet the criteria for exemption under paragraph 20(1)(c) (financial impact on a third party).
• Whether the Total Repayments figures meet the criteria for exemption under paragraph 20(1)(d) (interference with third-party negotiations).
• The burden of proof on the institution and third parties to demonstrate that exemptions apply.

An institution applied to the Information Commissioner for permission to ignore two access requests, claiming they were vexatious and an abuse of the access to information process. The institution also argued it had fulfilled its duty to assist the requester. The Commissioner found the institution failed in its duty to assist and did not prove the requests were vexatious or an abuse of the process. Consequently, the Commissioner denied the institution's applications, requiring it to process the requests.

• Whether the access requests were vexatious
• Whether the access requests constituted an abuse of the right to access information
• Whether the institution fulfilled its duty to assist the requester

This investigation concerned MGM Resorts International's handling of a 2019 data breach that affected millions of guests, including nearly two million Canadians. The OPC initiated a complaint after media reports indicated a breach and MGM had not reported it. The investigation found that MGM failed to promptly assess the risk of significant harm (RROSH) posed by the breach and did not report it to the OPC or notify affected Canadians as soon as feasible. MGM has committed to updating its privacy breach response framework to ensure timely RROSH assessments and reporting.

• Whether the personal information involved in the breach posed a real risk of significant harm (RROSH) to affected Canadians.
• Whether MGM adequately assessed the RROSH.
• Whether MGM reported the breach to the OPC and notified affected Canadians as soon as feasible.
• Whether MGM's delay in assessing the breach and notifying Canadians contravened PIPEDA's mandatory breach reporting obligations.

The Department of National Defence (DND) disclosed the identity of a workplace violence (WPV) complainant and the investigation report to a second investigator, who was conducting a separate administrative investigation into the complainant's conduct. The OPC found that while disclosing the report to labour relations was a consistent use, disclosing it to the second investigator was not, as it was not a reasonably expected use of the information given the confidentiality assurances provided to the complainant. This disclosure was therefore found to be a contravention of the Privacy Act.

• Was the disclosure of the WPV complainant's identity and report to a second investigator a 'consistent use' under paragraph 8(2)(a) of the Privacy Act?
• Did DND's consent form clearly communicate potential uses and disclosures of the complainant's identity?
• Did the disclosure align with the reasonable expectations of the complainant regarding confidentiality?
• What corrective actions are necessary to ensure future compliance with privacy principles in WPV investigations?

The complainant alleged that Shared Services Canada (SSC) wrongfully refused to process an access request for records related to informal official language complaints. SSC argued that the request, even after narrowing its scope, did not meet the requirements of section 6 of the Access to Information Act because it would require tasking too many employees and would impose an unreasonable administrative burden. The Information Commissioner disagreed, finding the request sufficiently detailed and ordering SSC to process it.

• Whether the access request provided sufficient detail to enable an experienced employee to identify records with reasonable effort.
• Whether administrative burden on an institution is a valid reason to refuse processing a request.
• Whether the scope of the request necessitated tasking all employees of the department.
• Whether section 6.1 of the Act was the appropriate process to address claims of vexatious requests.

Biron Health Group sent promotional emails to travellers who had undergone COVID-19 testing upon arrival in Canada, using their email addresses collected for testing purposes. The complainant alleged this violated PIPEDA. Biron argued they assumed implicit consent due to a business relationship, but the OPC found this assumption unreasonable given the mandatory nature of the testing. Biron has since ceased the practice, deleted affected email addresses, and the complaint was settled.

• Use of personal information for secondary marketing purposes without consent
• Reasonableness of assuming implicit consent in a mandatory service context
• Nature of consent required for collecting and using health-related information

The complainant alleged that Public Services and Procurement Canada (PSPC) failed to provide records regarding a specific contract. PSPC stated they could not identify relevant records, claiming they were not in their possession. The Information Commissioner found that while the records (a subcontract and related documents) were not in PSPC's physical possession, they were under PSPC's control for the purposes of the Access to Information Act. Therefore, PSPC should have retrieved and processed these records.

• Whether records held by a third-party contractor are under the control of a federal institution.
• Whether the institution conducted a reasonable search for the requested records.
• The interpretation of the 'under the control' clause in the Access to Information Act.

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) improperly withheld job creation estimates under paragraph 20(1)(c) of the Access to Information Act. The scope was narrowed to 11 third parties. Only one third party, Toyota, provided representations to support the exemption. The Information Commissioner found that neither ISED nor Toyota sufficiently demonstrated that disclosure would cause material financial harm or prejudice competitive position. The Commissioner recommended disclosure of all information, but ISED stated it would continue to withhold certain information related to Toyota.

• Application of paragraph 20(1)(c) (financial impact on a third party)
• Sufficiency of representations from third parties
• Reasonable expectation of harm
• Necessity of an explanatory note

The complainant alleged that the Vancouver Fraser Port Authority (VFPA) improperly withheld records related to $103 million in funding from the National Trade Corridors Fund. The VFPA cited exemptions related to government interests, negotiations, and confidential third-party information. The Information Commissioner found that the VFPA failed to demonstrate that all withheld information met the requirements for exemptions under paragraphs 18(b) and 18(d). Furthermore, the VFPA and the third party, Canadian National Railway, did not demonstrate that the exemptions under paragraphs 20(1)(b) and 20(1)(d) were met. The Commissioner ordered the disclosure of all information withheld under paragraphs 20(1)(b) and 20(1)(d), and specific information withheld under paragraphs 18(b) and 18(d). The VFPA agreed to implement the order.

• Whether the Vancouver Fraser Port Authority properly applied exemptions under paragraphs 18(b), 18(d), 20(1)(b), and 20(1)(d) of the Access to Information Act.
• Whether the Vancouver Fraser Port Authority discharged its burden to demonstrate that the withheld information met the requirements of the cited exemptions.
• Whether the third party, Canadian National Railway, met the requirements for the application of exemptions under paragraphs 20(1)(b) and 20(1)(d).
• Whether the Vancouver Fraser Port Authority reasonably exercised its discretion in withholding information.

The complainant alleged that the Department of Justice Canada (Justice) took an unreasonable 2,280 days to respond to an access request. Justice claimed an extension under paragraphs 9(1)(a) and 9(1)(b) of the Access to Information Act due to the large volume and complexity of records and the need for consultations. The Information Commissioner found that while the volume of records and the need for consultations were valid reasons for an extension, Justice failed to sufficiently justify the length of the extension claimed under paragraph 9(1)(a). Therefore, the complaint was found to be well-founded, and the Commissioner ordered Justice to provide a final response forthwith.

• Reasonableness of time extension claimed due to volume of records (s. 9(1)(a) ATIA)
• Reasonableness of time extension claimed for consultations (s. 9(1)(b) ATIA)
• Justification for the duration of specific processing steps
• Failure to demonstrate the reasonableness of the claimed extension period