Canadian privacy & access decisions

The complainant alleged that the Old Port of Montreal Corporation Inc. improperly withheld information related to the "Autopsy of a Murder" exhibit under several sections of the Access to Information Act. The withheld records included contracts, photographs, and inventory lists. The institution claimed exemptions under paragraphs 18(b) and 18(d) for competitive position and financial interests, subsection 19(1) for personal information, and paragraphs 20(1)(c) and 20(1)(d) for third-party financial impact and negotiations. The Commissioner found that the institution failed to provide sufficient evidence to demonstrate a reasonable expectation of harm for the exemptions under section 18 and 20. Regarding subsection 19(1), the Commissioner determined that the photographs of human remains either did not identify an individual or related to individuals deceased for over 20 years, thus not qualifying as personal information. The complaint was found to be well-founded, and the Commissioner ordered the disclosure of all information at issue.

• Whether s.18(b) ATIA (competitive position of government institutions, negotiations by government institutions) was properly applied
• Whether s.18(d) ATIA (government financial interests, undue benefit to an individual) was properly applied
• Whether s.19(1) ATIA (personal information) was properly applied to photographs of human remains
• Whether s.19(1) ATIA (personal information) was properly applied to signatures (removed from scope)
• Whether s.20(1)(c) ATIA (financial impact on a third party) was properly applied
• Whether s.20(1)(d) ATIA (negotiations by a third party) was properly applied
• Whether the Coroner's office had a right to make representations as a third party under s.35(2)(c) ATIA

On November 30, 2018, Marriott International, Inc. announced a data security breach involving unauthorized access to a Starwood Hotels database, which it had acquired in 2016. The breach, spanning over four years, affected up to 12.8 million Canadian records, including passport and payment card details. The OPC launched an investigation into Luxury Hotels Canada, Marriott's Canadian operating company, following eleven complaints. The investigation found Marriott's security safeguards, accountability measures, and information retention practices to be inadequate, contravening PIPEDA Principles 4.7, 4.1.4, and 4.5. Specifically, Marriott failed to detect the breach sooner due to insufficient logging, monitoring, and multi-factor authentication, and retained personal information longer than necessary. While Marriott's notification to affected individuals was deemed adequate, the OPC had outstanding concerns regarding remote access, unencrypted data storage, and retention periods. The findings are well-founded and conditionally resolved, as Marriott committed to implementing the OPC's recommendations, including engaging an external assessor and reviewing its privacy framework.

• Whether personal information held by Marriott was protected by security safeguards appropriate to the sensitivity of the information as required by Principle 4.7 (Safeguards).
• Whether Marriott demonstrated due diligence and took steps to fulfil its responsibilities to implement policies and practices to protect personal information under Principle 4.1.4 (Accountability) when acquiring control of the Starwood network.
• Whether Marriott retained personal information for longer than necessary, relevant to Principle 4.5 (Limiting use, disclosure and retention).
• Whether the mitigation measures offered by Marriott to affected individuals were adequate to protect their personal information from unauthorized use, such as future identity theft, in accordance with Principle 4.7 (Safeguards).