Canadian privacy & access decisions

The complainant alleged that National Defence (DND) improperly withheld information under subsections 15(1) and 19(1) of the Access to Information Act, concerning historical records of the Intelligence Advisory Committee. During the investigation, DND issued two supplementary responses, disclosing additional information, and the complainant narrowed the complaint to specific pages withheld under subsection 15(1). DND proposed a third supplementary response, agreeing to disclose more information but maintaining some redactions under subsection 15(1). The Information Commissioner concluded that the remaining withheld information did not meet the requirements of subsection 15(1), particularly regarding the absence of apparent harm from disclosure. The Commissioner recommended DND disclose all remaining information withheld under subsection 15(1). However, DND notified the Commissioner that it would not implement this recommendation. Consequently, the complaint was found to be well-founded.

• Whether information was properly withheld under s.15(1) ATIA (international affairs and national security)
• Whether information was properly withheld under s.19(1) ATIA (personal information)
• Whether disclosure of the remaining information could reasonably be expected to harm international affairs, defence, or national security
• Whether DND provided sufficient evidence of harm to justify the s.15(1) exemption
• Whether DND reasonably exercised its discretion to withhold the information

The OPC investigated Aylo (formerly MindGeek), a global technology company operating major pornographic websites like Pornhub, following a complaint from an individual whose intimate video was uploaded without her consent. The investigation focused on MindGeek's compliance with PIPEDA regarding consent for personal information collection, its content takedown process, and overall accountability. The OPC found that MindGeek failed to obtain valid and meaningful express consent directly from individuals depicted in highly sensitive content, relying instead on uploaders, which was deemed insufficient. MindGeek's content takedown process was also found to be not easily accessible, simple-to-use, or effective for individuals seeking removal of non-consensual content. These deficiencies demonstrated a broader lack of accountability for the vast amount of sensitive personal information under MindGeek's control. MindGeek disagreed with the findings and did not commit to implementing the OPC's recommendations, which included ceasing uploads without direct consent, deleting non-consensual content, and establishing a privacy management program. Consequently, the complaint was found to be well-founded and unresolved, with the OPC issuing several recommendations for compliance and independent oversight.

• Whether PIPEDA applied to MindGeek given its international operations but significant Canadian connection.
• Whether MindGeek obtained valid and meaningful consent for the collection, use, and disclosure of highly sensitive personal information (intimate images and associated identifiers) of individuals depicted in content uploaded to its websites, as required by Principle 4.3 and s. 6.1 of PIPEDA.
• Whether MindGeek's reliance on uploaders to attest consent constituted reasonable efforts to ensure meaningful consent.
• Whether MindGeek's "enhanced" consent practices implemented in 2020 remedied the contravention of consent requirements.
• Whether MindGeek provided individuals with an easily accessible, simple-to-use, and effective process for having their personal information removed from its websites, as required by Principles 4.10 and 4.10.2 of PIPEDA.
• Whether MindGeek's takedown process was effective at preventing further uploads of the same or other content depicting the requester.
• Whether MindGeek was accountable for the personal information under its control, as required by Principle 4.1 of Schedule 1 of PIPEDA.

A representative, on behalf of a deceased member's estate executor, requested personal information from the Department of National Defence (DND) related to an investigation into allegations against the deceased. DND processed the request informally and disclosed some information under subparagraph 8(2)(m)(i) of the Privacy Act, but did not explicitly state its refusal to process the request formally under paragraph 10(b) of the Privacy Regulations. The OPC investigated whether the representative was entitled to make the request for the purpose of administering the estate. The OPC found that while the representative was authorized to administer the estate, they did not sufficiently demonstrate a connection between the requested information and the administration of the estate. Therefore, the complaint was not well-founded, as the representative failed to meet the requirements of paragraph 10(b) of the Regulations.

• Whether the representative was authorized to make a request on behalf of the deceased under paragraph 10(b) of the Regulations
• Whether the request related only to the administration of the deceased's estate under paragraph 10(b) of the Regulations
• Whether DND complied with section 16 of the Privacy Act regarding refusal notifications
• Whether DND properly processed the request informally without explicit written consent and notification of rights