Canadian privacy & access decisions

The complainant alleged that the Port Alberni Port Authority (PAPA) improperly withheld information under several sections of the Access to Information Act in response to a request for documents related to the lease or sale of its assets. The investigation focused on withheld company names and financial amounts. PAPA claimed exemptions under paragraphs 18(a), 18(b), 18(c), subsection 19(1), and paragraphs 20(1)(b) and 20(1)(c). The Commissioner found that PAPA failed to demonstrate that the withheld information met the requirements for any of the claimed exemptions. Specifically, PAPA did not show that the financial information had substantial value, that its disclosure would harm its competitive position or interfere with negotiations, or that the information was scientific/technical from government research. The Commissioner also determined that a company name was not personal information and that the third-party commercial information was not objectively confidential nor was a clear link established between disclosure and financial harm. Consequently, the Commissioner ordered PAPA to disclose the redacted information. PAPA agreed to implement the order, and the complaint was found to be well founded.

• Whether s.18(a) ATIA (government financial, commercial, scientific or technical information) applied to the withheld amounts related to equipment rental
• Whether the withheld financial information had substantial value under s.18(a) ATIA
• Whether s.18(b) ATIA (competitive position of government institutions or negotiations by government institutions) applied to the withheld amounts related to equipment rental
• Whether disclosure of the information would reasonably be expected to harm PAPA's competitive position or interfere with negotiations under s.18(b) ATIA
• Whether s.18(c) ATIA (government scientific or technical information obtained from research) applied to any withheld information
• Whether the withheld information was scientific or technical, obtained through government research, and if its disclosure would jeopardize publication rights under s.18(c) ATIA
• Whether s.19(1) ATIA (personal information) applied to the name of a company
• Whether the company name constituted personal information under s.19(1) ATIA
• Whether s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information) applied to the third party's name and leased premises information
• Whether the third-party information was confidential by an objective standard under s.20(1)(b) ATIA
• Whether s.20(1)(c) ATIA (financial impact on a third party) applied to portions of a lease agreement and specific amounts
• Whether disclosure of the information would reasonably be expected to cause material financial loss or gain to the third party or injure its competitive position under s.20(1)(c) ATIA

The Office of the Privacy Commissioner of Canada (OPC) investigated the Royal Canadian Mounted Police (RCMP) following the loss of an unencrypted USB storage device containing sensitive personal information of 1,741 individuals. The investigation focused on whether the RCMP contravened section 8 of the Privacy Act regarding disclosure, the appropriateness of its breach response, and the sufficiency of its safeguards for USB devices. The OPC found that the RCMP contravened section 8 due to unauthorized disclosure, as the device was lost, unencrypted, and its contents were copied and offered for sale. While the RCMP's notification to affected individuals and mitigation steps were generally appropriate after discovery, the initial reporting of the loss was significantly delayed. Furthermore, the RCMP failed to implement adequate safeguards, as its own policies for procurement, inventory, and encryption of USB devices were not followed, and security awareness training was insufficient. Despite the RCMP accepting the OPC's recommendations to strengthen safeguards, audit procedures, and awareness programs, it refused to commit to specific timelines for implementation. Consequently, the complaint was found to be well-founded and unresolved.

• Whether the RCMP disclosed personal information in contravention of section 8 of the Privacy Act
• Whether the RCMP's response to the privacy breach was appropriate in the circumstances
• Whether the RCMP's measures to protect personal information contained on USB storage devices were sufficient
• Whether RCMP personnel failed to report the loss of the USB storage device to authorities in a timely manner
• Whether the RCMP's policies and procedures for procurement, inventory, and encryption of USB devices were followed and enforced
• Whether the RCMP's security and privacy awareness training for members was effective and sufficient
• Whether the RCMP's policy compliance monitoring for USB device use was adequate