Canadian privacy & access decisions

The complainant alleged that the Canadian Institutes of Health Research (CIHR) improperly withheld information under subsections 18(a), 19(1), and 20(1)(b) of the Access to Information Act, concerning an individual's role on the Pfizer Lyme Disease Advisory Board and their research project. During the investigation, the complainant narrowed the scope to three specific sections of records withheld under paragraph 20(1)(b). The OIC sought representations from the third party (Nominated Principal Investigator via Queen's University), who had no concerns with disclosure. CIHR subsequently conceded that the threshold for paragraph 20(1)(b) had not been met and indicated preparedness to release the information. The Commissioner found that the information at issue, describing aspects of a proposed research network, was not financial, commercial, scientific, or technical as required by paragraph 20(1)(b). Therefore, the Commissioner concluded that the exemption did not apply. The complaint was found to be well founded, and CIHR was ordered to disclose the information.

• Whether the withheld information was financial, commercial, scientific, or technical under s.20(1)(b) ATIA
• Whether the information was confidential under s.20(1)(b) ATIA
• Whether the information was supplied by a third party to a government institution under s.20(1)(b) ATIA
• Whether the third party consistently treated the information as confidential under s.20(1)(b) ATIA

A federal institution applied to the Information Commissioner for approval to decline to act on two access to information requests, arguing they were vexatious and an abuse of the right of access under subsection 6.1(1) of the Access to Information Act. The institution claimed the requester submitted a high volume of requests, refused to narrow their scope, and engaged in intimidating communications, thereby diverting public resources and harassing the department. The Commissioner found that the institution failed to fulfill its duty to assist the requester under subsection 4(2.1) of the Act, as its communication was solely aimed at reducing scope without offering other assistance. Furthermore, the Commissioner determined that the institution did not provide clear and compelling evidence to support its claims that the requests were vexatious or an abuse of the right of access. The Commissioner denied the institution's application, requiring it to process the access requests.

• Whether the institution fulfilled its duty to assist obligations under subsection 4(2.1) of the Act
• Whether the access requests were vexatious under subsection 6.1(1) of the Act
• Whether the access requests constituted an abuse of the right to make a request under subsection 6.1(1) of the Act

The Office of the Privacy Commissioner of Canada (OPC) investigated Agronomy Company of Canada Ltd. following a complaint alleging inadequate safeguards, lack of accountability, and invalid consent for personal information collection and use, stemming from a data breach. A malicious actor gained access to Agronomy's systems, exfiltrating sensitive personal information of 845 individuals, including SINs, financial details, and identification documents, before deploying ransomware. The OPC found Agronomy failed to implement appropriate safeguards, citing a lack of multifactor authentication, network segregation, data encryption, and detection tools, which contributed to the breach. Furthermore, Agronomy lacked a comprehensive privacy policy, a designated privacy officer, and adequate staff training, indicating a failure in accountability. While these two aspects were found well-founded, Agronomy committed to significant improvements, leading to a conditionally resolved outcome. However, the OPC found the complaint regarding invalid consent for credit services not well-founded, as the complainant had signed a clearly labelled credit application and utilized the extended credit.

• Whether Agronomy implemented appropriate safeguards to adequately protect personal information under its control, as per PIPEDA Principle 4.7.
• Whether Agronomy's technical safeguards (multifactor authentication, network segregation, data encryption, detection and response tools) were appropriate for the sensitivity of the information.
• Whether Agronomy's organizational safeguards (incident response protocols, information management, security documentation, staff training) were adequate.
• Whether Agronomy was accountable for personal information under its control, including designating an individual for PIPEDA compliance and implementing policies and practices, as per PIPEDA Principle 4.1.
• Whether Agronomy obtained valid and meaningful consent for the collection and use of personal information for credit services, particularly sensitive information, as per PIPEDA Principle 4.3.