Canadian Privacy Decisions

The complainant alleged that the Canada Border Services Agency (CBSA) did not conduct a reasonable search for Microsoft Teams messages related to ArriveCAN. CBSA's policy retains these messages for only 30 days, but an administrative error delayed the processing of the request beyond this period, leading officials to believe no records existed. Although CBSA later found one relevant record in its corporate repositories during the investigation, the initial delay meant a reasonable search was not conducted at the time of the request. The complaint was found to be well founded.

• Reasonableness of the search conducted by the institution
• Timeliness of request processing
• Impact of administrative errors on the right of access
• Proper retention and retrieval of electronic records

The complainant alleged that the Canada Revenue Agency (CRA) improperly denied access to personal information related to five grievances, relying on exceptions under the Privacy Act. The OPC found that while the CRA conducted reasonable searches, it failed to adequately substantiate its use of paragraph 22(1)(b) of the Act to withhold information. Much of the withheld information was transactional and did not demonstrate a clear risk of harm upon disclosure. The complaint was found to be well-founded, but unresolved, as the CRA maintained its position on the withheld information.

• Proper application of paragraph 22(1)(b) of the Privacy Act regarding risk of harm.
• Adequacy of government institution's searches for responsive records.
• Substantiation of claims for withholding information under statutory exemptions.
• Requirement for case-by-case assessment when applying exemptions.