Canadian privacy & access decisions

The complainant alleged that Fisheries and Oceans Canada (DFO) improperly withheld At-Sea Observer (ASO) data for black dogfish bycatch from 2000-2021 under paragraphs 20(1)(b) and 20(1)(c) of the Access to Information Act, and that it applied an unofficial "Rule of 5" policy. During the investigation, DFO also suggested the information could fall under subsection 19(1). The Commissioner found that DFO failed to demonstrate that the information met the requirements for exemption under paragraph 20(1)(b), as it was not shown to be financial, commercial, scientific, or technical, nor objectively confidential, nor consistently treated as confidential by third parties. Similarly, DFO's arguments for withholding under paragraph 20(1)(c) were deemed speculative and lacked evidence of a reasonable expectation of harm without identifiable third parties. The Commissioner also concluded that the information did not meet the requirements of subsection 19(1) because there was no serious possibility of identifying individuals, a finding supported by the Office of the Privacy Commissioner. Finally, the investigation revealed that DFO did not apply the alleged "Rule of 5" policy to this access request. The complaint was found to be well founded, and DFO was ordered to disclose all the information.

• Whether the requested information was financial, commercial, scientific, or technical under s.20(1)(b) ATIA.
• Whether the requested information was confidential under s.20(1)(b) ATIA.
• Whether the requested information was supplied by a third party under s.20(1)(b) ATIA.
• Whether the third party consistently treated the information as confidential under s.20(1)(b) ATIA.
• Whether disclosure of the information could reasonably be expected to cause material financial impact on a third party or injure its competitive position under s.20(1)(c) ATIA.
• Whether the information constituted personal information under s.19(1) ATIA.
• Whether DFO applied an unofficial internal policy ("Rule of 5") to refuse access to the information.
• Whether DFO adequately identified third parties for notification under s.33 and s.35(2)(c) ATIA.