Canadian privacy & access decisions

The complainant alleged that Employment and Social Development Canada (ESDC) improperly stated it could not process an access request for emails to and from a named employee, containing specific keywords. ESDC argued the emails were not under its control, despite being on its servers, because they were personal and lacked business value. The Office of the Information Commissioner (OIC) investigated whether the records were "under the control" of ESDC, considering factors such as institutional purpose, relation to ESDC's mandate, and integration with other records. The OIC found the emails were entirely personal, had no institutional purpose, and ESDC had no authority to regulate their use or disposition. Therefore, the OIC concluded the emails were not under ESDC's control and not subject to the Access to Information Act. The complaint was deemed not well founded.

• Whether the requested emails were "under the control" of Employment and Social Development Canada (ESDC) as per the Access to Information Act
• Whether the contents of the emails related to an institutional matter and involved ESDC's mandate, obligations, functions, and operations
• Whether the emails were created to fulfill any ESDC officer's or employee's duties or functions and/or were intended for any employment-related purpose
• Whether the emails were created to fulfill a statutory requirement imposed on ESDC
• Whether ESDC relied on the emails when preparing government records
• Whether ESDC had any authority with regard to the use or disposition of the emails
• Whether communicating the contents of the emails required the authorization of an ESDC officer or employee
• Whether the emails were integrated with other ESDC records

This report is a compliance monitoring review by the Office of the Privacy Commissioner (OPC) of Statistics Canada's (StatCan) redesigned Financial Transactions Project and Credit Agency Data Project. It follows an earlier OPC investigation that found no contraventions of the Privacy Act but identified significant privacy concerns, leading to recommendations for StatCan to incorporate necessity and proportionality principles. The OPC assessed StatCan's progress, noting reductions in data collection and the implementation of privacy-enhancing measures like a data ethics secretariat and an external ethics body. However, the OPC found that the redesigned project plans still lacked sufficient specificity in describing public goals, failed to demonstrate effectiveness, and did not adequately analyze privacy impacts in context. The OPC concluded that while progress was made, "more work needs to be done" to fully meet its assessment criteria for necessity and proportionality. Consequently, the OPC issued four new recommendations, including describing public goals with greater precision, revisiting effectiveness, analyzing privacy in context, and resubmitting the plans for further review before final implementation. The outcome is classified as well-founded-conditionally-resolved, reflecting partial implementation and the need for further action.

• Whether the redesigned Financial Transactions Project and Credit Agency Data Project met the principles of necessity and proportionality.
• Whether the public goals of the projects were described with a level of specificity and precision commensurate with privacy impacts.
• Whether the effectiveness of the projects was demonstrated.
• Whether privacy impacts were given sufficient analysis in context, considering risk of harm to individuals and broad-based harms.
• Whether StatCan's Necessity and Proportionality Framework aligned with OPC's assessment criteria.
• Whether less privacy-intrusive alternatives were adequately considered and compared.