Canadian privacy & access decisions

The complainant challenged VIA Rail's decision to withhold information concerning a High Frequency Rail Proposal. VIA Rail had applied multiple exemptions under the Access to Information Act. The Information Commissioner found that VIA Rail failed to demonstrate that the withheld information properly fell within the scope of the claimed exemptions. Furthermore, VIA Rail did not perform a severance exercise to release non-exempt portions of the records. The Commissioner recommended that VIA Rail conduct a severance exercise, disclose all information not meeting exemption criteria, and properly exercise discretion for any remaining exempt information. Consequently, the complaint was deemed well founded.

• Whether the information fell within the scope of the exemptions claimed under s.18 ATIA
• Whether the information fell within the scope of the exemptions claimed under s.21 ATIA
• Whether VIA Rail conducted a proper severance exercise to disclose non-exempt information

The Office of the Privacy Commissioner of Canada (OPC) investigated a major data breach at Desjardins that affected close to 9.7 million individuals in Canada and abroad between 2017 and 2019. The breach was caused by a malicious employee who exfiltrated sensitive personal information, including names, dates of birth, social insurance numbers, and transaction histories. The OPC found that Desjardins contravened PIPEDA's principles regarding accountability, retention periods, and security safeguards. Specifically, Desjardins had inadequate organizational policies and procedures, critical gaps in employee training and awareness, ineffective access controls and data segregation, and insufficient oversight and monitoring. Additionally, Desjardins failed to handle personal information in accordance with retention and destruction requirements, retaining some inactive files for decades. While the complaints were found to be well-founded, Desjardins' mitigation measures offered to affected individuals were deemed adequate. Desjardins committed to implementing the OPC's recommendations to address the identified weaknesses.

• Whether personal information held by Desjardins was protected throughout its life cycle by security safeguards appropriate to the sensitivity of the information as required by PIPEDA Safeguards Principle 4.7.
• Whether Desjardins fulfilled its responsibilities to implement procedures to protect personal information and train its staff, as set out in Accountability Principle 4.1.
• Whether the personal information of individuals was handled in accordance with the retention and destruction requirements as set out in PIPEDA Principle 4.5, limiting use, disclosure and retention.
• Whether the mitigation measures offered by Desjardins to affected individuals were adequate to protect their personal information from unauthorized use, such as future identity theft, in accordance with PIPEDA Safeguards Principle 4.7.