Canadian privacy & access decisions

The complainant challenged the Canadian Human Rights Commission's (CHRC) decision to withhold information under subsections 19(1) (personal information), section 22 (testing/auditing procedures), and section 23 (solicitor-client privilege) of the Access to Information Act. During the investigation, the CHRC agreed to release all information previously withheld under section 22 and some under section 23. The OIC found that while some information met the requirements for personal information under s.19(1), specific file numbers did not, as their disclosure would not identify an individual. Regarding solicitor-client privilege, the OIC found that certain draft investigation reports were not shown to have received legal review or advice, thus not meeting the exemption's criteria. The Commissioner recommended the disclosure of the file numbers and the draft investigation reports. The CHRC agreed to the recommendations and released the additional information.

• Whether s.19(1) personal information exemption applies to personal contact information of government employees, leave information, and names of CHRC complainants
• Whether s.19(1) personal information exemption applies to file numbers
• Whether the institution reasonably exercised discretion under s.19(2) for applicable personal information
• Whether s.22 testing/auditing procedures exemption applies
• Whether s.23 solicitor-client privilege exemption applies to communications between client and counsel for legal advice
• Whether s.23 solicitor-client privilege exemption applies to draft investigation reports
• Whether the institution reasonably exercised discretion under s.23 for applicable solicitor-client privileged information

A Canadian traveler complained that the Canada Border Services Agency (CBSA) inappropriately collected his cell phone passcode during a border inspection. The complainant argued the collection was unauthorized and unnecessary, as he offered to unlock the phone himself. The OPC acknowledged CBSA's authority under the Customs Act to require passcodes for digital device inspections, citing reasons such as preventing data alteration and ensuring evidence continuity. However, the OPC found that the CBSA officer failed to follow policy by not taking notes and not informing the complainant about passcode retention and the option to change it. The OPC also questioned the necessity of retaining passcodes when no further action was taken. The CBSA committed to providing more training and revising its policy to ensure passcodes are handled more sensitively.

• Whether the CBSA has the authority to require a traveller to provide a passcode to unlock a digital device for inspection purposes under the Customs Act
• Whether the CBSA officer followed internal policies regarding the collection and retention of personal information (passcodes)
• Whether the CBSA's retention of the passcode was necessary beyond the examination process when no further action was taken
• Whether passcodes constitute sensitive personal information