Canadian privacy & access decisions

The complainant alleged that the Canada Border Services Agency (CBSA) improperly withheld the complete source code for the ArriveCAN application under subsection 16(2) of the Access to Information Act. CBSA argued that disclosing the source code could reasonably be expected to facilitate the commission of an offence by allowing malicious actors to hack the application, impersonate it, or expose security vulnerabilities, thereby risking personal information. The OIC found that at the time of the request in September 2022, when ArriveCAN was mandatory and collected sensitive personal data, the disclosure of the source code could indeed facilitate an offence. The Commissioner also concluded that CBSA reasonably exercised its discretion by weighing the public interest in disclosure against the risks. Furthermore, the OIC accepted CBSA's argument that severance of the source code was not reasonable due to the unknown locations of potential vulnerabilities. Consequently, the complaint was deemed not well founded.

• Whether disclosure of the ArriveCAN source code could reasonably be expected to facilitate the commission of an offence under s.16(2) ATIA
• Whether CBSA reasonably exercised its discretion in deciding not to disclose the information under s.16(2) ATIA
• Whether severance of the source code was reasonable under s.25 ATIA

The complainant alleged that the Impact Assessment Agency of Canada (IAAC) took an unreasonable extension of time to respond to an access request for communications related to designated projects in Western Canada. IAAC had extended the response time by 880 days, citing paragraphs 9(1)(a), (b), and (c) of the Access to Information Act. The Commissioner found that while the request involved a large volume of records, IAAC failed to demonstrate that the 820-day extension taken under paragraph 9(1)(a) was reasonable, particularly regarding its estimated monthly review rate. Consequently, the Commissioner concluded that IAAC was deemed to have refused access under subsection 10(3) of the Act. The Commissioner ordered IAAC to provide a complete response to the access request by April 23, 2025. IAAC's President confirmed that the agency would implement the order, outlining steps to increase processing capacity and optimize ATIP processes.

• Whether the extension of time taken under s.9(1)(a) was for a reasonable period
• Whether the request was for a large number of records
• Whether meeting the 30-day deadline would unreasonably interfere with the institution’s operations
• Whether the institution is deemed to have refused access under s.10(3)

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld their DNA profile, generated from a biological sample, under subsection 24(1) of the Access to Information Act. The RCMP argued that section 6.6 of the DNA Identification Act, which is listed in Schedule II of the Access to Information Act, prohibits the disclosure of information contained in the DNA data bank. The Commissioner found that the DNA Identification Act indeed restricts the communication of such information, except in specific, limited circumstances not applicable to an access to information request. Therefore, the Commissioner concluded that the RCMP correctly applied subsection 24(1) to withhold the complainant's DNA profile. The complaint was found to be not well founded.

• Whether the information requested (complainant's DNA profile) is subject to subsection 24(1) of the Access to Information Act
• Whether section 6.6 of the DNA Identification Act prohibits the disclosure of the requested information
• Whether the DNA Identification Act is listed in Schedule II of the Access to Information Act