Canadian privacy & access decisions

The Office of the Privacy Commissioner of Canada (OPC) investigated the Canada Border Services Agency's (CBSA) contracting practices for the ArriveCAN application, focusing on measures to protect travellers' personal information handled by contractors. An individual's complaint and a parliamentary committee's motion prompted the review into whether contractors accessed personal information without required security clearances, potentially contravening sections 7 and 8 of the Privacy Act. The OPC found that while contracts included appropriate security clauses, there were issues with the accuracy and timeliness of security assessments (SRCLs) and overly broad task descriptions in Task Authorizations (TAs). Although vendors met organizational security requirements, one contractor worked for 18 months with an expired security clearance, exposing the CBSA to increased privacy risks. The CBSA implemented adequate administrative and technical safeguards, such as segregated environments and strict access controls, but six contractors were granted access to personal information not strictly necessary for their duties. Despite these shortcomings, the investigation found no evidence that personal information was actually used or disclosed in contravention of the Act. Consequently, the complaint was found to be not well-founded, but the OPC issued recommendations to the CBSA to strengthen its contracting and privacy practices, which the agency accepted.

• Whether the CBSA authorized contractors to access personal information collected through ArriveCAN without the required security clearance, in contravention of sections 7 and 8 of the Privacy Act
• Whether ArriveCAN contracts and Task Authorizations (TAs) contained appropriate clauses to ensure the protection of travellers’ personal information that contractors had access to
• Whether security requirements identified in contracts and TAs were accurate and specific
• Whether the CBSA complied with organizational security screening requirements for vendors
• Whether the CBSA complied with personnel security screening requirements for contractors
• Whether the CBSA implemented adequate administrative safeguards to protect personal information accessed by contractors
• Whether the CBSA implemented adequate technical safeguards to protect personal information accessed by contractors
• Whether the CBSA restricted contractor permissions and access to personal information to what was strictly necessary

An anonymous applicant complained that Public Services and Procurement Canada (PSPC) improperly withheld information under paragraphs 18(b) and 20(1)(b) of the Access to Information Act. The request sought annual rent figures for leases exceeding $500,000 signed by PSPC in specific cities between 2018 and 2022. PSPC and several third parties argued that disclosure would harm PSPC's competitive position and negotiations, and constitute confidential third-party financial information, also suggesting paragraphs 20(1)(c) and 20(1)(d). The Commissioner found PSPC's and the third parties' arguments for all claimed exemptions to be speculative, failing to demonstrate a reasonable expectation of probable harm or objective confidentiality. Specifically, the rent figures were not considered "supplied by" the third parties for the purpose of s.20(1)(b). Consequently, the complaint was found to be well founded, and the Commissioner ordered PSPC to disclose the records in full. PSPC subsequently gave notice that it would comply with the order.

• Whether PSPC improperly withheld information under paragraph 18(b) ATIA
• Whether disclosure of annual rent figures could reasonably be expected to harm the competitive position of PSPC under s.18(b) ATIA
• Whether disclosure of annual rent figures could reasonably be expected to interfere with contractual or other negotiations of PSPC under s.18(b) ATIA
• Whether PSPC's representations on harm under s.18(b) were speculative
• Whether PSPC improperly withheld information under paragraph 20(1)(b) ATIA
• Whether annual rent figures constitute financial, commercial, scientific or technical information under s.20(1)(b) ATIA
• Whether annual rent figures are confidential by an objective standard under s.20(1)(b) ATIA
• Whether annual rent figures are publicly available
• Whether the circumstances give rise to a reasonable expectation that annual rent figures would not be disclosed
• Whether the relationship between PSPC and third parties would be fostered for public benefit by confidentiality of annual rent figures
• Whether annual rent figures were "supplied by" the third party to PSPC under s.20(1)(b) ATIA
• Whether third parties consistently treated annual rent figures as confidential under s.20(1)(b) ATIA
• Whether PSPC improperly withheld information under paragraph 20(1)(c) ATIA
• Whether disclosure of annual rent figures could reasonably be expected to result in material financial loss or gain to a third party under s.20(1)(c) ATIA
• Whether disclosure of annual rent figures could reasonably be expected to prejudice a third party's competitive position under s.20(1)(c) ATIA
• Whether third parties' representations on harm under s.20(1)(c) were speculative
• Whether PSPC improperly withheld information under paragraph 20(1)(d) ATIA
• Whether disclosure of annual rent figures could reasonably be expected to interfere with the contractual or other negotiations of a third party under s.20(1)(d) ATIA
• Whether third parties' representations on interference under s.20(1)(d) were speculative
• Whether the complaint was well founded under s.30(1)(a) ATIA
• Whether an order for disclosure should be issued under s.36.1 ATIA

The complainant alleged that Indigenous Services Canada (ISC) failed to conduct a reasonable search for records related to a video posted on Facebook. The request specifically excluded draft copies, media articles, and French records where English equivalents existed. During the investigation, it was discovered that ISC's Communications and Public Affairs unit had removed records deemed to be drafts, including logistics, filming arrangements, and approvals, based on their interpretation of the exclusion criteria. This led to an incomplete initial search. Following the OIC's intervention, ISC located an additional 1,087 pages of records. The Commissioner found that while the appropriate offices were tasked, the initial removal of records based on an incorrect interpretation of "drafts" rendered the search unreasonable. The complaint was found to be well-founded, and ISC was ordered to process the newly found records and provide a supplementary response.

• Whether Indigenous Services Canada conducted a reasonable search for records
• Whether the institution's interpretation of 'draft copies' exclusion was appropriate