Canadian Privacy Decisions

The complainant requested information regarding a High Frequency Rail Proposal from VIA Rail Canada. VIA Rail withheld the information citing several exemptions under the Access to Information Act. The Office of the Information Commissioner found that VIA Rail failed to prove the exemptions applied and did not perform a proper severance analysis to release non-exempt portions of the records. Consequently, the complaint was found to be well founded.

• Whether VIA Rail Canada properly applied exemptions under sections 18 and 21 of the ATIA.
• Whether VIA Rail Canada conducted an adequate severance exercise.
• Whether VIA Rail Canada exercised due diligence in responding to the access request.

This investigation examined Desjardins' compliance with PIPEDA following a significant data breach that occurred between 2017 and 2019, affecting nearly 9.7 million individuals. The Office of the Privacy Commissioner of Canada (OPC) found that Desjardins contravened PIPEDA principles regarding accountability, data retention, and security safeguards. While Desjardins' mitigation measures for affected individuals were deemed adequate, the OPC issued recommendations to address the identified contraventions.

• Adequacy of security safeguards throughout the personal information lifecycle.
• Compliance with accountability principles, including implementing procedures and training staff.
• Appropriateness of data retention and destruction practices.
• Effectiveness of mitigation measures offered to individuals affected by the breach.