Canadian privacy & access decisions

The complainant alleged that the Canada Revenue Agency (CRA) improperly withheld employee timesheet information under subsection 19(1) of the Access to Information Act. The request was for timesheets from April 19 to May 3, 2023, a period coinciding with a labour strike. The OIC accepted that User ID and PRI, if disclosed, would reveal an employee's choice to participate in or cross a picket line, thus constituting personal information not related to their position or function. However, for the remaining timesheet data (Date, Att/Abs type, Att/Abs text, Company, Status, Hours), the OIC found CRA's argument for withholding to be speculative and lacking concrete evidence that disclosure would lead to identification, especially given the large number of employees and various reasons for absence. The OIC concluded that this remaining information did not meet the requirements of subsection 19(1). The Commissioner ordered CRA to disclose the information that did not meet the requirements of subsection 19(1). CRA gave notice that it would partially implement the order, intending to withhold information associated with leave codes used by fewer than 10 employees.

• Whether User ID and PRI on timesheets constitute personal information under s.19(1) ATIA
• Whether the release of User ID and PRI would reveal an employee's personal choice regarding strike participation, thus not falling under the s.3(j) Privacy Act exception
• Whether the remaining timesheet information (Date, Att/Abs type, Att/Abs text, Company, Status, Hours) constitutes personal information under s.19(1) ATIA
• Whether there is a serious possibility that disclosing the remaining timesheet information would lead to the identification of individuals
• Whether CRA's evidence for identification was speculative or concrete
• Whether CRA reasonably exercised its discretion under s.19(2) ATIA for information meeting s.19(1) requirements