Canadian privacy & access decisions

The Office of the Privacy Commissioner of Canada (OPC) investigated the Royal Canadian Mounted Police (RCMP) following the loss of an unencrypted USB storage device containing sensitive personal information of 1,741 individuals. The investigation focused on whether the RCMP contravened section 8 of the Privacy Act regarding disclosure, the appropriateness of its breach response, and the sufficiency of its safeguards for USB devices. The OPC found that the RCMP contravened section 8 due to unauthorized disclosure, as the device was lost, unencrypted, and its contents were copied and offered for sale. While the RCMP's notification to affected individuals and mitigation steps were generally appropriate after discovery, the initial reporting of the loss was significantly delayed. Furthermore, the RCMP failed to implement adequate safeguards, as its own policies for procurement, inventory, and encryption of USB devices were not followed, and security awareness training was insufficient. Despite the RCMP accepting the OPC's recommendations to strengthen safeguards, audit procedures, and awareness programs, it refused to commit to specific timelines for implementation. Consequently, the complaint was found to be well-founded and unresolved.

• Whether the RCMP disclosed personal information in contravention of section 8 of the Privacy Act
• Whether the RCMP's response to the privacy breach was appropriate in the circumstances
• Whether the RCMP's measures to protect personal information contained on USB storage devices were sufficient
• Whether RCMP personnel failed to report the loss of the USB storage device to authorities in a timely manner
• Whether the RCMP's policies and procedures for procurement, inventory, and encryption of USB devices were followed and enforced
• Whether the RCMP's security and privacy awareness training for members was effective and sufficient
• Whether the RCMP's policy compliance monitoring for USB device use was adequate

The complainant alleged that the Canada Border Services Agency (CBSA) improperly withheld information related to cybersecurity and data breach risk assessments of the ArriveCAN application under subsection 16(2) and paragraph 20(1)(d) of the Access to Information Act. During the investigation, CBSA initially disclosed some records but continued to withhold others under subsection 16(2) and additionally claimed subsection 19(1). The Commissioner found that while some information met the requirements of subsection 16(2) (facilitating an offence), other portions did not. Furthermore, the Commissioner concluded that CBSA failed to properly exercise its discretion under subsection 19(2) regarding personal information, as it did not demonstrate efforts to seek consent or consider public availability. The complaint was found to be well founded. Although the Commissioner issued an initial report with orders, CBSA subsequently made further disclosures, and the complainant indicated satisfaction, making a formal order unnecessary.

• Whether s.16(2) ATIA (facilitating the commission of an offence) was properly applied to cybersecurity review information, including intranet/internal network addresses and specific vulnerabilities
• Whether s.16(2) ATIA was properly applied to statements related to asset identification and valuation, lists of components, summaries of changes, names of reference documents, and executive overviews
• Whether CBSA reasonably exercised its discretion under s.16(2) ATIA for information that met the exemption's requirements
• Whether s.19(1) ATIA (personal information) was properly applied to pictures and contact information of KPMG employees
• Whether CBSA made reasonable efforts to seek consent for disclosure of personal information under s.19(2)(a) ATIA
• Whether CBSA considered if personal information was publicly available under s.19(2)(b) ATIA
• Whether CBSA properly exercised its discretion under s.19(2) ATIA