Canadian Privacy Decisions

The Information Commissioner reviewed an institution's application to decline acting on an access request. The institution argued the request was an abuse of the right of access. However, the Commissioner found the institution's submissions insufficient and noted they failed to assist the requester or adequately demonstrate an abuse of access rights. Consequently, the Commissioner denied the application.

• Whether the access request constitutes an abuse of the right of access.
• Sufficiency of the institution's evidence to support its application.
• The institution's duty to assist the requester.

The complainant alleged that National Defence improperly withheld information concerning the Intelligence Advisory Committee under exemptions related to international affairs/national security (subsection 15(1)) and personal information (subsection 19(1)). While the institution disclosed some information during the investigation, the Information Commissioner found that the remaining withheld information did not meet the requirements of subsection 15(1), as the potential harm from disclosure was not apparent. The Commissioner recommended full disclosure, but National Defence disagreed and chose not to implement the recommendation.

• Whether withheld information meets the criteria for exemption under subsection 15(1) of the ATIA.
• Whether the institution demonstrated a reasonable expectation of harm from disclosing the remaining information.
• Whether the institution reasonably exercised its discretion to withhold information.

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint against Aylo (formerly MindGeek) concerning its handling of user-uploaded intimate content. The OPC found that MindGeek failed to obtain valid consent for the collection, use, and disclosure of personal information, particularly highly sensitive intimate images. The OPC also determined that MindGeek did not provide an accessible or effective process for individuals to remove their non-consensual content from its websites. Furthermore, the investigation concluded that MindGeek lacked accountability for the personal information under its control. The complaint was found to be well-founded and remains unresolved.

• Validity of consent for collecting and using intimate images
• Effectiveness and accessibility of content takedown processes
• Accountability for personal information under control
• Jurisdiction over international operations