Canadian privacy & access decisions

The complainant alleged that the Public Health Agency of Canada (PHAC) took an unreasonable extension of time to respond to an access request for all correspondence, including emails, MS Teams messages, texts, and phone messages, sent and received by Iain Stewart between June 14 and June 21, 2021. PHAC notified the complainant of a 1,950-day extension under paragraphs 9(1)(a) and 9(1)(b) of the Access to Information Act. The Commissioner found that PHAC demonstrated the request involved a large volume of records (30,000 pages) and that meeting the 30-day deadline would unreasonably interfere with its operations, particularly given its role in the COVID-19 pandemic response and increased ATIP workload. The Commissioner also found that consultations were necessary and could not be completed within 30 days. Despite the lengthy extension, the Commissioner concluded that PHAC's calculation was reasonable given the circumstances, including the complexity of the records and the institution's processing capacity. Therefore, the complaint was not well founded.

• Whether the extension of time under s.9(1)(a) was unreasonable
• Whether the request was for a large number of records or required searching through a large number of records
• Whether meeting the 30-day deadline would unreasonably interfere with the institution’s operations
• Whether the extension of time under s.9(1)(a) was for a reasonable period, given the circumstances
• Whether the extension of time under s.9(1)(b) was unreasonable
• Whether the institution needed to carry out consultations on the requested records
• Whether the consultations could reasonably be completed within 30 days
• Whether the extension of time under s.9(1)(b) was for a reasonable period, given the circumstances
• Whether the time extension was validly claimed

An anonymous applicant complained that Innovation, Science and Economic Development Canada (ISED) improperly withheld "Total Repayment figures" related to several projects under the Technology Partnerships Canada (TPC) program, involving 21 third parties. ISED initially relied on paragraph 20(1)(c) of the Access to Information Act, while some third parties also raised paragraphs 20(1)(b) and 20(1)(d). The Commissioner found that the information was financial and commercial but not objectively confidential under paragraph 20(1)(b), as there was no reasonable expectation of non-disclosure for public funds, nor would confidentiality foster public benefit. For paragraph 20(1)(c), the Commissioner determined that neither ISED nor the third parties demonstrated a clear and direct connection between disclosure and a reasonable expectation of material financial harm or injury to competitive position, deeming their arguments speculative. Similarly, for paragraph 20(1)(d), insufficient evidence was provided to show that disclosure would interfere with contractual negotiations. Consequently, the complaint was found to be well-founded, and the Commissioner ordered ISED to disclose all the Total Repayments figures at issue.

• Whether the Total Repayment figures are financial or commercial information under s.20(1)(b) ATIA
• Whether the Total Repayment figures are confidential under s.20(1)(b) ATIA
• Whether the circumstances of communication gave rise to a reasonable expectation of non-disclosure for the Total Repayment figures under s.20(1)(b) ATIA
• Whether confidential communication of the Total Repayment figures would foster the relationship between third parties and ISED for public benefit under s.20(1)(b) ATIA
• Whether disclosure of the Total Repayment figures could reasonably be expected to result in material financial loss or gain to a third party under s.20(1)(c) ATIA
• Whether disclosure of the Total Repayment figures could reasonably be expected to injure the competitive position of a third party under s.20(1)(c) ATIA
• Whether a clear and direct connection between disclosure and harm was demonstrated for s.20(1)(c) ATIA
• Whether arguments of public misunderstanding justify withholding information under s.20(1)(c) ATIA
• Whether disclosure of the Total Repayment figures could reasonably be expected to interfere with contractual or other negotiations of a third party under s.20(1)(d) ATIA
• Whether a clear and direct connection between disclosure and interference (obstruction) was demonstrated for s.20(1)(d) ATIA

A joint investigation by federal and provincial privacy authorities found that the Tim Hortons App continuously tracked users' granular location data, often every few minutes, even when the app was closed. This data was used to infer home, work, travel status, and visits to competitors. The Offices concluded that Tim Hortons collected this sensitive information for an inappropriate purpose, as it never used the data for its stated goal of targeted advertising, and the privacy loss was disproportionate to any potential benefits. Furthermore, Tim Hortons failed to obtain valid consent, making misleading statements that the app only tracked location when open and not adequately informing users of the extensive nature and consequences of the tracking. Concerns were also raised about inadequate contractual protections with the third-party service provider, Radar, and a broader lack of accountability within Tim Hortons' privacy management. The matter was found well-founded and conditionally resolved, as Tim Hortons agreed to delete the collected data and establish a comprehensive privacy management program.

• Whether Tim Hortons collected or used personal information for an appropriate purpose under the Acts.
• Whether Tim Hortons obtained valid consent for the collection and use of granular location data.
• Adequacy of contractual protections for personal information transferred to third-party service providers.
• Tim Hortons' accountability and implementation of a privacy management program.