Canadian privacy & access decisions

An individual complained that the Department of National Defence (DND) breached the Privacy Act by disclosing their identity as a workplace violence (WPV) complainant to an investigator conducting a separate administrative investigation into the complainant's conduct. DND argued the disclosure was a "consistent use" under paragraph 8(2)(a) of the Privacy Act, necessary to address allegations against the individual. The OPC found that while disclosure to labour relations was a consistent use, disclosure to the investigator was not, as the consent form created a reasonable expectation of confidentiality for the WPV complaint. The OPC concluded that the disclosure to the investigator was not directly connected to the original purpose of collecting the WPV complaint information. DND committed to implementing recommendations to ensure future disclosures align with participants' reasonable expectations.

• Whether the disclosure of the WPV complainant's identity to labour relations was a "consistent use" under paragraph 8(2)(a) of the Privacy Act
• Whether the disclosure of the WPV complainant's identity to an investigator for a separate administrative investigation was a "consistent use" under paragraph 8(2)(a) of the Privacy Act
• Whether the consent form provided by DND created a reasonable expectation of confidentiality regarding the complainant's identity

The complainant alleged that Shared Services Canada (SSC) improperly refused to process an access request for records related to informal official language complaints. SSC argued that the request, even after being narrowed to a one-year timeframe and specific keywords in email subject lines, did not meet the requirements of section 6 of the Access to Information Act because it would require tasking over 8,300 employees and create an unreasonable administrative burden. The Information Commissioner disagreed, stating that the term "reasonable effort" in section 6 refers to identifying records, not limiting the number of individuals tasked. The Commissioner also noted that the Act provides for time extensions for large requests and that the potential for redacting personal information under section 19 is not a valid reason to refuse processing. The Commissioner concluded that the request was sufficiently detailed and ordered SSC to process it.

• Whether the access request provided sufficient detail to enable an experienced employee to identify records with a reasonable effort under s.6 ATIA
• Whether the administrative burden on the institution constitutes a valid reason to refuse processing a request under s.6 ATIA
• Whether the potential for retrieving personal information that would be exempt under s.19 ATIA is a valid reason to refuse processing a request