Canadian Privacy Decisions

The complainant alleged that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) failed to conduct a reasonable search for "School Narratives" and supporting documents. CIRNAC officials identified that records existed but refused to process them, citing confidentiality and a lengthy processing time. The Information Commissioner found the complaint well-founded, ordering CIRNAC to retrieve and process all responsive records and provide a new response to the request.

• Reasonableness of the search conducted by the institution
• Institution's refusal to process identified records
• Complainant's right of access to records under the control of a government institution

The complainant alleged that National Defence failed to conduct a reasonable search for records related to a selection process for Steward/Command Master Sailor. The Office of the Information Commissioner (OIC) investigation found that not all relevant offices were tasked and the search criteria were unclear. National Defence was ordered to complete the retrieval of all responsive records and provide a new response to the access request.

• Reasonable search
• Completeness of search
• Clarity of tasking for record retrieval

The complainant alleged that Indigenous Services Canada (ISC) did not conduct a reasonable search for records related to the Non-Insured Health Benefits Mental Health Counselling benefit, including a "detailed review" and related proposals and reviews. ISC initially claimed the "detailed review" was verbal and no records existed. However, further investigation revealed ISC had not conducted an adequate search, and a subsequent search located at least 170 pages of responsive documents. The Information Commissioner found the complaint well-founded and ordered ISC to complete the retrieval and processing of all responsive records and provide a new response to the complainant.

• Reasonableness of the search conducted by the institution
• Existence of records for "detailed review" mentioned in an internal briefing note
• Scope and completeness of the search efforts

The complainant alleged that Health Canada improperly withheld records related to Dukoral under various ATIA exemptions, including personal information, third-party commercial information, and solicitor-client privilege. While some exemptions like solicitor-client privilege were upheld, the Commissioner found that Health Canada did not sufficiently demonstrate that information withheld under commercial and advice/recommendations exemptions met the required criteria. The Commissioner ordered Health Canada to disclose specific information previously withheld.

• Confidential third-party commercial, financial, scientific or technical information (s. 20(1)(b))
• Financial impact on a third party (s. 20(1)(c))
• Advice or recommendations (s. 21(1)(a))
• Solicitor-client privilege (s. 23)

Immigration, Refugees and Citizenship Canada (IRCC) contravened the Privacy Act when an employee inadvertently sent 497 emails containing personal information to the wrong email addresses. The investigation found that IRCC had insufficient administrative and procedural controls to prevent such errors. While IRCC took steps to notify affected individuals and mitigate harm, the Office of the Privacy Commissioner recommended improvements to prevent future breaches. IRCC accepted these recommendations and implemented enhanced measures, leading the OPC to consider the matter resolved.

• Whether IRCC contravened section 8 of the Privacy Act by disclosing personal information to unintended recipients.
• Adequacy of IRCC's administrative and procedural controls to prevent accidental disclosures.
• Effectiveness of IRCC's measures to mitigate the impact of the breach on affected individuals.
• Sufficiency of IRCC's actions to reduce the risk of recurrence.

The complainant alleged that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) did not conduct a reasonable search for records related to the Wood Mountain (Lakota) First Nation land claim. While CIRNAC initially provided records from 2017 onwards, OIC investigation and research revealed potential missing records from 2009 to 2016. Following further searches prompted by the OIC, CIRNAC located additional records. The Information Commissioner found the complaint well-founded and ordered CIRNAC to complete the retrieval and processing of all responsive records and provide a new response to the complainant.

• Reasonableness of the search conducted by the institution
• Identification and location of all records responsive to the access request
• Completeness of the records provided to the complainant

An institution applied to the Information Commissioner for approval to decline an access request, arguing it was an abuse of the right to access information. The Commissioner agreed, finding the request constituted an abuse of the right to make a request. Consequently, the Commissioner granted the institution's application to decline to act on the request.

• Whether the access request constituted an abuse of the right to make a request under subsection 6.1(1) of the Access to Information Act.

An institution applied for approval to decline to act on five access requests, arguing they were vexatious and an abuse of the right to access information. The Information Commissioner found that two of the requests (A-2023-00305 and A-2023-00314) were indeed an abuse of the right to access. Consequently, the Commissioner approved the institution's decision to decline to act on those two specific requests. However, the institution failed to prove that the remaining three requests (A-2023-00303, A-2023-00308 and A-2023-00310) were vexatious or an abuse of the right to access.

• Whether access requests are vexatious
• Whether access requests constitute an abuse of the right to make a request
• Application of section 6.1 of the Access to Information Act

An institution applied to decline an access request, arguing it was vexatious, made in bad faith, and an abuse of the right to access information. The institution claimed it had fulfilled its duty to assist the requester. The Information Commissioner found that the institution had indeed made reasonable efforts to assist the requester and that the request, due to its breadth and the estimated 700,000 pages it would generate, constituted an abuse of the right to access information as it would unreasonably interfere with the institution's operations and hinder other requesters' access rights. The Commissioner granted the institution's application to decline to act on the request.

• Whether the institution fulfilled its duty to assist the requester prior to applying to decline the request.
• Whether the access request constituted an abuse of the right to access information.
• Whether the application to decline to act was submitted in a timely manner.
• The substantial volume of records and its impact on institutional operations and other requesters' access rights.