Canadian privacy & access decisions

The complainant alleged that the Canada Border Services Agency (CBSA) improperly withheld the source code for the ArriveCAN application under subsection 16(2) of the Access to Information Act, which allows withholding information that could facilitate the commission of an offence. The CBSA argued that disclosure could allow malicious actors to hack the application or compromise user data. The Information Commissioner found that the CBSA reasonably exercised its discretion to withhold the source code at the time of the request, considering the sensitive nature of the application and the risks of disclosure.

• Whether the ArriveCAN source code could reasonably be expected to facilitate the commission of an offence if disclosed.
• Whether the CBSA reasonably exercised its discretion in deciding to withhold the source code.
• Whether severance of the source code was possible and reasonable.

The complainant alleged that the Impact Assessment Agency of Canada (IAAC) took an unreasonable amount of time to respond to an access request. The request was for communications related to designated projects in Western Canada. IAAC extended the response time by 880 days, but the Information Commissioner found that IAAC did not adequately justify the length of this extension, particularly under paragraph 9(1)(a) of the Access to Information Act. Consequently, the Commissioner deemed the extension invalid, ordered IAAC to respond by April 23, 2025, and found the complaint to be well-founded.

• Reasonableness of the 880-day time extension under subsection 9(1)(a) of the ATIA
• Whether IAAC demonstrated sufficient rigour in calculating the extension period
• Whether IAAC's delay constituted a deemed refusal of access under subsection 10(3) of the ATIA

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld their own DNA profile, citing subsection 24(1) of the Access to Information Act (disclosure restricted by another law). The RCMP argued that section 6.6 of the DNA Identification Act prohibits the disclosure of such information. The Information Commissioner found that the DNA Identification Act, which is listed in Schedule II of the ATIA, indeed restricts the disclosure of DNA profiles, and therefore upheld the RCMP's decision.

• Interpretation of subsection 24(1) of the Access to Information Act
• Application of section 6.6 of the DNA Identification Act
• Whether the complainant's DNA profile is information whose disclosure is restricted by another law

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld investigation reports into the deaths of two individuals under subsection 16(1)(a) of the Access to Information Act. The OIC found that the RCMP met all requirements for this exemption and reasonably exercised its discretion in withholding the information. The Commissioner recommended legislative amendments to allow disclosure of personal information about deceased individuals for compassionate reasons.

• Proper application of exemption 16(1)(a) (investigative bodies)
• Reasonable exercise of discretion by the institution
• Consideration of disclosure for compassionate reasons
• Overlap between the Privacy Act and Access to Information Act for deceased individuals