Canadian Privacy Decisions

The complainant alleged that Employment and Social Development Canada (ESDC) wrongly refused to process an access request for emails containing specific keywords, claiming they were not under its control. The emails were stored on ESDC servers and sent using a government account. However, the OIC found that the emails were entirely personal, had no institutional purpose, and were not integrated with ESDC's records. Therefore, the OIC concluded the emails were not under ESDC's control and not subject to the Access to Information Act, resulting in the complaint being not well founded.

• Whether the requested emails were under the control of Employment and Social Development Canada for the purposes of the Access to Information Act.

This report follows up on an earlier investigation into Statistics Canada's Financial Transactions Project and Credit Agency Data Project. While the initial investigation found no contraventions, it raised significant privacy concerns. This compliance monitoring report assesses whether Statistics Canada’s redesigned projects adequately incorporate the principles of necessity and proportionality. Although Statistics Canada has made progress in reducing the scope of data collection and implementing privacy-enhancing measures, the report concludes that the project plans still fall short in adequately describing public goals, demonstrating effectiveness, and analyzing privacy impacts.

• Adequacy of public goal descriptions for necessity and proportionality assessment.
• Demonstration of project effectiveness.
• Sufficiency of privacy impact analysis, including risk of harm.
• Alignment of Statistics Canada's necessity and proportionality framework with OPC criteria.