Canadian privacy & access decisions

The complainant alleged that the Canadian Security Intelligence Service (CSIS) failed to sufficiently identify redacted portions of records and the basis for withholding information in response to an access request for historical information about Warren Hart. CSIS used negative (white) redactions and cited exemptions only in the response letter, arguing that marking redactions on the records could cause harm. The Information Commissioner found that CSIS did not provide a cogent explanation for how clearly marked redactions and exemptions would reveal protected information. The Commissioner concluded that CSIS failed to meet its obligations regarding severance and the duty to assist. CSIS was recommended to provide a new response with clearly identified redactions and specific exemption provisions, and to cease using negative redactions and citing exemptions only in response letters. CSIS agreed to implement these recommendations.

• Whether CSIS sufficiently identified redacted portions of records
• Whether CSIS sufficiently identified the basis for withholding information
• Whether the use of negative (white) redactions by CSIS was appropriate
• Whether citing exemptions only in response letters by CSIS was appropriate
• Whether CSIS's practice contravened the duty to assist under subsection 4(2.1) ATIA
• Whether CSIS's practice contravened the severance requirement under section 25 ATIA
• Whether clearly marking redactions and exemptions on records would reveal protected information or cause harm

The complainant alleged that National Defence (DND) failed to conduct a reasonable search for records related to unidentified aerial phenomena (UAP) held by two named individuals. The investigation revealed that DND's Office of Primary Interest misread the request, limiting the search to only 'reports of UAP' instead of the broader 'general subject of UAP', and also unnecessarily restricted its search to keywords. The Office of the Information Commissioner (OIC) requested DND to perform an additional search, which resulted in the retrieval of 11 additional pages of records. The Commissioner concluded that DND did not conduct a reasonable search. The complaint was found to be well founded, and DND was ordered to provide access to the additional records.

• Whether National Defence conducted a reasonable search for records
• Whether the Office of Primary Interest misread the access request
• Whether limiting the search to keywords constituted a reasonable search

An individual complained that Transport Canada collected his personal information for the "Incentives for Zero-Emission Vehicles Program" (iZEV) without a publicly available Personal Information Bank (PIB) description, as required by the Privacy Act. Transport Canada launched the iZEV program in May 2019 but did not submit a PIB description to the Treasury Board Secretariat (TBS) for approval until 19 months later. The OPC found that both Transport Canada and TBS contributed to the contravention, as TBS failed to approve and publish the PIB description in a timely manner. Although Transport Canada eventually published the PIB, TBS declined to implement the OPC's recommendations for service standards, citing complexity, but outlined internal process improvements. The OPC acknowledged TBS's efforts to address the backlog.

• Whether Transport Canada failed to ensure personal information collected for the iZEV program was included in a publicly available PIB description as required by section 10 of the Privacy Act
• Whether Transport Canada obtained TBS approval for a new PIB before implementing the iZEV program as required by subsection 71(4) of the Privacy Act and the TBS Directive on Privacy Impact Assessment
• Whether TBS fulfilled its responsibility under section 11 of the Privacy Act to ensure timely publication of PIB descriptions
• Whether the lack of a timely PIB approval process by TBS impacts the operability of the PIB regime under the Privacy Act

Twenty complainants, current or former federal government employees, alleged that the Treasury Board of Canada Secretariat (TBS) improperly disclosed their personal information. TBS mistakenly sent two emails to 400 applicants for the Severe Phoenix Impacts program using the 'cc' field instead of 'bcc', revealing email addresses (some with names) and the fact they had filed a claim for Phoenix-related damages. The OPC found that the disclosure was not authorized under the Privacy Act, making the complaints well-founded. While TBS acknowledged the error, it initially deemed the breach non-material, a conclusion the OPC disagreed with, emphasizing the importance of contextual factors in assessing harm. TBS agreed to implement two of the OPC's three recommendations, but not the one concerning incorporating the findings on materiality into its policy instruments. The OPC concluded the complaints were well-founded and conditionally resolved in part, expressing ongoing concern about TBS's assessment of breach materiality.

• Whether the disclosure of personal information via email was authorized under the Privacy Act
• Whether the privacy breach was 'material' in nature according to TBS's guidelines
• Whether TBS's assessment of the breach's materiality was appropriate
• Whether the context of the personal information disclosed should be considered when assessing the risk of injury or harm

The complainant alleged that Library and Archives Canada (LAC) improperly withheld information under subsection 15(1) of the Access to Information Act, concerning records of the Intelligence Advisory Committee from 1989-1995. These records pertained to migration trends and global developments. The Office of the Information Commissioner (OIC) found that the Canadian Government had previously disclosed similar records and that the information reflected public and Parliamentary debate, leading the OIC to conclude that disclosure would not harm national security or international relations. Consequently, the OIC determined that the requirements for exemption under subsection 15(1) were not met. As a result of the OIC's intervention, LAC disclosed the records in their entirety on January 20, 2023. The complainant expressed satisfaction with this disclosure.

• Whether s.15(1) ATIA (national security and international relations) was properly applied to records of the Intelligence Advisory Committee, 1989-1995
• Whether disclosure of the records would cause harm to national security or international relations

An institution applied to the Information Commissioner under subsection 6.1(1) of the Access to Information Act to decline to act on an access request, arguing it was vexatious and an abuse of the right to make a request. The request sought all emails, text messages, and digital files from three Human Resources employees from the start of their employment. The Commissioner found that the institution had fulfilled its duty to assist the requester by attempting to clarify the overly broad request and explaining the significant burden it would impose. Despite these efforts, the requester refused to narrow the scope, stating the broadness was intentional to uncover potential misconduct. The Commissioner concluded that the request constituted an abuse of the right of access due to its excessive breadth, the undue burden it placed on the institution, and its potential to impede the rights of other requesters. Consequently, the Commissioner granted the institution's application.

• Whether the access request was an abuse of the right to make a request under s.6.1(1) ATIA
• Whether the institution fulfilled its duty to assist obligations under s.4(2.1) ATIA
• Whether the access request was vexatious under s.6.1(1) ATIA

The complainant alleged that Home Depot disclosed his personal information to Meta (formerly Facebook) without his knowledge and consent. Home Depot was sending in-store customers' hashed email addresses and purchase details to Meta via an "Offline Conversions" tool when customers requested an e-receipt. This data allowed Meta to measure ad effectiveness and use the information for its own business purposes, including targeted advertising. The OPC found that Home Depot failed to obtain valid consent, as its privacy statement was not readily available or sufficiently clear, and customers would not reasonably expect such disclosure. Home Depot discontinued the use of the tool in October 2022 in response to OPC recommendations. The complaint was deemed well-founded and resolved.

• Whether Home Depot obtained valid consent for disclosing customer personal information to Meta
• Whether the disclosure of personal information to Meta constituted a processing activity not requiring additional consent
• Whether Home Depot's Privacy Statement and Meta's Privacy Policy were sufficient to obtain meaningful implied consent
• Whether express opt-in consent was required for the disclosure of customer information to Meta
• Whether the information disclosed was sensitive
• Whether the disclosure was within the reasonable expectations of the individual
• Whether the ability to withdraw consent after the fact was sufficient

The complainant alleged that Transport Canada improperly withheld information under subsection 19(1) (personal information) and paragraph 20(1)(b) (confidential third-party financial, commercial, scientific or technical information) of the Access to Information Act. The request sought information related to applications and Minimum Safe Manning (MSM) Documents for the passenger ship, Queen of Cumberland. During the investigation, the complainant removed the s.19(1) aspect from the complaint. The OIC found that Transport Canada and the third party (BC Ferries) failed to demonstrate that all requirements for the s.20(1)(b) exemption were met. Specifically, the OIC was not convinced that all information was financial, commercial, scientific, or technical, nor that it was consistently treated as confidential or supplied by the third party. Consequently, the Commissioner ordered Transport Canada to disclose the information withheld under paragraph 20(1)(b). Transport Canada indicated it would likely comply with the order.

• Whether the information is financial, commercial, scientific or technical under s.20(1)(b)
• Whether the information is confidential under s.20(1)(b)
• Whether the information was supplied to a government institution by a third party under s.20(1)(b)
• Whether the third party has consistently treated the information as confidential under s.20(1)(b)
• Whether the relationship between the government and the third party is fostered for public benefit by the confidential communication

The complainant alleged that Employment and Social Development Canada (ESDC) improperly withheld information under subsections 19(1), 20(1)(b), and 24(1) of the Access to Information Act regarding records about Canadian universities' engagement in the Federal Contractors Program. The OIC removed the s.24(1) claim from the scope of the complaint as the only information withheld under it (business numbers) was no longer at issue. The Commissioner found that ESDC did not demonstrate that all information withheld under s.19(1) was personal information about identifiable individuals, nor did it appropriately exercise its discretion under s.19(2)(b). Furthermore, neither ESDC nor the third party (University of Waterloo) demonstrated that the requirements of s.20(1)(b) were met for a completed Employment Equity Achievement Awards Application Form. The complaint was found to be well founded, and the Commissioner ordered ESDC to disclose the information at issue. ESDC subsequently gave notice that it would fully implement the order.

• Whether information withheld under s.19(1) was personal information about identifiable individuals
• Whether ESDC properly severed non-personal information from personal information under s.19(1)
• Whether ESDC reasonably exercised its discretion under s.19(2)(b) regarding publicly available information
• Whether the Employment Equity Achievement Awards Application Form met the requirements of s.20(1)(b)
• Whether the information was financial, commercial, scientific or technical under s.20(1)(b)
• Whether the information was confidential under s.20(1)(b)
• Whether the third party consistently treated the information as confidential under s.20(1)(b)

The complainant alleged that Trans Mountain Corporation (TMC) improperly responded to an access request by invoking subsection 10(2) of the Access to Information Act, neither confirming nor denying the existence of records, and stating that if records existed, they would be withheld under subsection 16(2). The OIC found that TMC failed to demonstrate that the existence or absence of records itself warranted withholding, especially since TMC had previously confirmed the existence of similar records in response to a nearly identical request. The Commissioner also determined that TMC did not show how all responsive records, if they existed, could reasonably be expected to facilitate the commission of an offence under subsection 16(2). Consequently, the Commissioner concluded that TMC's reliance on subsection 10(2) was not justified. The complaint was found to be well founded, and TMC was ordered to provide a new response confirming or denying the existence of records and, if records exist, to provide access unless a specific exemption applies.

• Whether the institution met the requirements for invoking subsection 10(2) of the ATIA
• Whether the existence or absence of records itself is information that warrants being withheld under the Act
• Whether, if responsive records existed, they could reasonably be exempted under specific provisions of the Act
• Whether the institution's reliance on subsection 10(2) was a reasonable exercise of discretion
• Whether disclosure of records could reasonably be expected to facilitate the commission of an offence under subsection 16(2)

The Information Commissioner ceased investigation into seventeen complaints, finding them vexatious. The complaints alleged unreasonable time extensions taken by an institution. However, the Commissioner found that these seventeen requests sought the same information as a previous request from the same complainant, which had already been the subject of an OIC investigation where the time extension was deemed reasonable. The complainant had not pursued a Federal Court review of the previous finding. Evidence showed the institution was providing regular interim responses as committed, contrary to the complainant's assertion. The Commissioner concluded that the new complaints were an attempt to circumvent the OIC's previous findings and avoid the proper recourse mechanism of Federal Court review. Therefore, the Commissioner ceased investigation under paragraphs 30(4)(a) and (b) of the Access to Information Act.

• Whether the complaints were vexatious under s.30(4)(a) ATIA
• Whether further investigation was unnecessary under s.30(4)(b) ATIA
• Whether the new requests were substantively duplicative of a previously investigated complaint
• Whether the complainant was attempting to circumvent previous OIC findings