Canadian privacy & access decisions

The complainant alleged that Public Services and Procurement Canada (PSPC) improperly withheld 96,781 pages of records under section 23 (solicitor-client and litigation privilege) of the Access to Information Act. The records related to the negotiation of a 1991 lease for the Louis St-Laurent Building. PSPC applied section 23 in a blanket manner, claiming both solicitor-client and litigation privilege. The Information Commissioner found that while some information met the requirements for solicitor-client privilege, PSPC failed to demonstrate that any information met the requirements for litigation privilege. Furthermore, PSPC's exercise of discretion was deemed unreasonable as it considered irrelevant factors and failed to consider relevant ones. The Commissioner also concluded that PSPC failed to adhere to section 25 by not performing a proper severance exercise. The complaint was found to be well founded, and PSPC was ordered to disclose specific types of records, all records not meeting solicitor-client privilege, and to reconsider its discretion for information genuinely subject to solicitor-client privilege.

• Whether the information met the requirements for solicitor-client privilege under s.23 ATIA
• Whether the information met the requirements for litigation privilege under s.23 ATIA
• Whether PSPC reasonably exercised its discretion to withhold information under s.23 ATIA
• Whether PSPC adhered to its severance obligations under s.25 ATIA

The complainant alleged that Environment and Climate Change Canada (ECCC) improperly withheld information under several exemptions of the Access to Information Act related to Taseko Mines Limited’s New Prosperity Project. The OIC investigated claims under subsections 16(2), 19(1), paragraphs 20(1)(d), 21(1)(a), 21(1)(b), and section 23. During the investigation, the complainant narrowed the scope, removing all information withheld under subsection 16(2) from the complaint. The Commissioner found that ECCC did not demonstrate that the requirements for paragraphs 20(1)(d), 21(1)(a), 21(1)(b), or section 23 were met for certain information. However, where the requirements for discretionary exemptions were met, ECCC was found to have reasonably exercised its discretion. The Commissioner ordered ECCC to disclose specific information that did not meet the exemption requirements. ECCC agreed to comply with the order, and the complaint was deemed well founded.

• Whether s.16(2) facilitating the commission of an offence applied
• Whether s.19(1) personal information applied
• Whether ECCC reasonably exercised its discretion under s.19(2)
• Whether s.20(1)(d) negotiations by a third party applied
• Whether ECCC reasonably exercised its discretion under s.20(5)
• Whether ECCC reasonably exercised its discretion under s.20(6)
• Whether s.21(1)(a) advice or recommendations applied
• Whether ECCC reasonably exercised its discretion under s.21(1)(a)
• Whether s.21(1)(b) accounts of consultations or deliberations applied
• Whether ECCC reasonably exercised its discretion under s.21(1)(b)
• Whether s.23 solicitor-client and litigation privilege applied
• Whether ECCC reasonably exercised its discretion under s.23

A complainant alleged that the Canada Revenue Agency (CRA) inappropriately disclosed her adoptive child's name and her personal information to the child's biological mother, contravening section 8 of the Privacy Act. The child's name had been changed for safety reasons after a closed adoption. The OPC found that, on the balance of probabilities, the CRA likely disclosed the child's adoptive name to the biological mother, leading to significant negative impacts on the family. The investigation also revealed deficiencies in the CRA's internal procedures for safeguarding adopted children's personal information. The OPC issued recommendations to revise procedures, provide comprehensive training, and implement oversight measures. The CRA agreed to implement two of the three recommendations, but declined the oversight measure, leading to a "well-founded and not resolved" finding.

• Whether the CRA disclosed the child’s adoptive name to the biological mother in contravention of section 8 of the Privacy Act
• Whether the CRA's internal procedures for safeguarding adopted children's personal information were adequate

The complainant alleged that the Canada Border Services Agency (CBSA) failed to conduct a reasonable search for Microsoft Teams messages related to ArriveCAN. The CBSA initially informed the complainant that no such records existed, citing a 30-day retention period for MS Teams messages. However, the OIC's investigation revealed that an administrative error prevented the request from being promptly entered into CBSA's case management system, causing a significant delay in processing. This delay meant that by the time the request was actioned, the MS Teams messages would have been automatically deleted. Despite this, CBSA policy required business-related information from MS Teams to be saved to corporate repositories. During the investigation, CBSA searched these repositories and located one responsive record, which was subsequently provided to the complainant. The Commissioner found that the CBSA did not conduct a reasonable search initially due to the processing delays and failure to task program areas, but acknowledged that a reasonable search was eventually completed during the investigation.

• Whether the institution conducted a reasonable search for records
• Whether the administrative error in processing the request impacted the search for records
• Whether the institution's MS Teams retention policy and corporate repository policy were followed

The complainant alleged that the Canada Revenue Agency (CRA) improperly denied access to personal information related to five grievances, relying on exceptions in subsection 12(1), paragraph 22(1)(b), and section 26 of the Privacy Act. The OPC found that while the CRA conducted reasonable searches, it failed to substantiate its use of some exemptions, particularly paragraph 22(1)(b). The CRA did not demonstrate a clear and direct connection between disclosure and a risk of harm, instead relying on general assertions. The OPC concluded that the complainant did not receive all entitled personal information and found the complaint well-founded. The OPC recommended the CRA reassess its reliance on paragraph 22(1)(b) and disclose more information. However, the CRA maintained its position, leading the OPC to consider the complaint unresolved.

• Whether the Canada Revenue Agency conducted reasonable searches for responsive records
• Whether the Canada Revenue Agency properly applied subsection 12(1) of the Privacy Act to withhold information
• Whether the Canada Revenue Agency properly applied paragraph 22(1)(b) of the Privacy Act to withhold information
• Whether the Canada Revenue Agency properly applied section 26 of the Privacy Act to withhold information
• Whether the Canada Revenue Agency demonstrated a clear and direct connection between disclosure and a risk of harm under paragraph 22(1)(b)
• Whether general assertions of harm are sufficient to justify withholding information under paragraph 22(1)(b)
• Whether the mere fact of an ongoing investigation meets the threshold for harm under paragraph 22(1)(b)
• Whether the potential for strategic advantage is sufficient to justify withholding information under paragraph 22(1)(b)
• Whether professional expertise alone is sufficient to substantiate an exemption claim under paragraph 22(1)(b)
• Whether a case-by-case assessment is required for the application of paragraph 22(1)(b)