Canadian privacy & access decisions

The Office of the Privacy Commissioner of Canada (OPC) investigated six complaints against the Canada Border Services Agency (CBSA) regarding the examination of personal digital devices at ports of entry. Complainants, all Canadian citizens, questioned the CBSA's authority to conduct these searches. The OPC found that the CBSA contravened section 4 of the Privacy Act by exceeding its legal authority in one case (accessing online banking/social media) and section 6(1) by destroying records in two cases. Systemic issues were identified, including BSOs failing to follow CBSA's own policy on disabling internet connectivity, note-taking, and search thresholds. The OPC concluded all six complaints were well-founded and made several recommendations for operational changes and legislative reform. The CBSA accepted the operational recommendations, committing to new policies, mandatory training, oversight, and transparency, but disagreed with the legislative reform recommendations. Consequently, the operational issues are considered conditionally resolved.

• Whether CBSA's collection of personal information via digital device searches contravened section 4 of the Privacy Act.
• Whether the definition of "goods" under the Customs Act extends to electronic documents on digital devices.
• Whether CBSA's authority to search digital devices is limited to information stored on the device.
• Whether Border Services Officers (BSOs) complied with CBSA's internal policy (Operational Bulletin PRG-2015-31) regarding digital device examinations (e.g., airplane mode, note-taking, search threshold).
• Whether the copying of content from a digital device by a BSO was consistent with CBSA's legal authority and policy.
• Whether the CBSA complied with its obligations under subsection 6(1) of the Privacy Act to retain personal information used for administrative purposes.
• Whether the CBSA's practices regarding training, awareness, and accountability mechanisms for digital device searches were adequate.
• Whether the Customs Act requires amendment to include a clear legal framework and a higher threshold for digital device examinations.
• Whether the threshold for digital device examinations should be "reasonable grounds to suspect".

The complainant alleged that Loblaw collected more personal information than necessary for its $25 gift card program and was concerned about data transfers to a US-based third party. Loblaw requested ID (utility bill or driver's license) from some registrants to verify eligibility and prevent fraud, but initially failed to specify that only name and address were needed and other information could be redacted. The OPC found that Loblaw initially over-collected information under Principle 4.4, but this issue was resolved when Loblaw clarified its requirements. Regarding the cross-border transfer of data to a US Program Administrator, the OPC found that Loblaw had sufficient contractual safeguards in place to ensure a comparable level of protection (Principle 4.1.3) and was transparent about these transfers (Principle 4.8). No additional consent was required for the transfer of name and address information, as it was for the original purpose. The complaint was found well-founded and resolved for over-collection, and not well-founded for the data transfer issues.

• Whether Loblaw collected more personal information than necessary for the Loblaw Card Program (Principle 4.4)
• Whether Loblaw ensured a comparable level of protection for personal information transferred to a third party for processing (Principle 4.1.3)
• Whether Loblaw was required to obtain additional consent for the transfer of personal information for processing (Principle 4.3)
• Whether Loblaw was sufficiently open and transparent about its cross-border data transfers (Principle 4.8)