Canadian Privacy Decisions

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) improperly withheld Total Repayment figures related to the Technology Partnerships Canada (TPC) program, citing exemptions concerning financial impact on third parties (s. 20(1)(c)) and other provisions. The scope was narrowed to 21 third parties. The Information Commissioner found that neither ISED nor the third parties provided sufficient evidence to meet the requirements for these exemptions. Consequently, the Commissioner ordered ISED to disclose all the withheld information.

• Whether the Total Repayments figures meet the criteria for exemption under paragraph 20(1)(b) (confidential third-party information).
• Whether the Total Repayments figures meet the criteria for exemption under paragraph 20(1)(c) (financial impact on a third party).
• Whether the Total Repayments figures meet the criteria for exemption under paragraph 20(1)(d) (interference with third-party negotiations).
• The burden of proof on the institution and third parties to demonstrate that exemptions apply.

An institution applied to the Information Commissioner for permission to ignore two access requests, claiming they were vexatious and an abuse of the access to information process. The institution also argued it had fulfilled its duty to assist the requester. The Commissioner found the institution failed in its duty to assist and did not prove the requests were vexatious or an abuse of the process. Consequently, the Commissioner denied the institution's applications, requiring it to process the requests.

• Whether the access requests were vexatious
• Whether the access requests constituted an abuse of the right to access information
• Whether the institution fulfilled its duty to assist the requester

A joint investigation by the OPC and three provincial privacy authorities found that Tim Hortons collected granular location data from users of its mobile app without an appropriate purpose and without valid consent. The company tracked users' locations even when the app was closed, inferring details like home and work locations, ostensibly for targeted advertising, but ultimately did not use the data for this stated purpose. The investigation also raised concerns about contractual protections with a third-party vendor and Tim Hortons' overall accountability.

• Collection and use of granular location data for an appropriate purpose
• Obtaining valid consent for location data collection
• Adequacy of contractual protections for data processed by third parties
• Tim Hortons' accountability for privacy practices