Canadian privacy & access decisions

The Office of the Privacy Commissioner of Canada (OPC) launched a Commissioner-initiated investigation (CII) into a privacy breach at WestJet that occurred on June 12, 2025. An unauthorized third party gained access to an employee's administrative account, bypassed multi-factor authentication, deployed ransomware, and exfiltrated data affecting approximately 5.1 million Canadian employees and customers. The breach exposed names, dates of birth, email addresses, mailing addresses, phone numbers, gender, travel booking information, and passport details, but no credit card numbers or SINs. WestJet took immediate containment measures, reported the breach, and provided direct and indirect notifications, credit monitoring, and identity theft protection services. WestJet has committed to further actions, including an external security assessment and providing a summary report to the OPC by August 7, 2026, to ensure the adequacy of its updated security safeguards and prevent future breaches. The CII will be discontinued upon the Commissioner being satisfied that WestJet has fulfilled all commitments.

• Adequacy of security safeguards under PIPEDA
• Adequacy of notifications to affected individuals under PIPEDA
• Whether WestJet's post-breach remediation actions and future commitments provide a fair and reasonable response to the incident

The Office of the Privacy Commissioner of Canada (OPC) initiated complaints against X Corp. and X.AI LLC following reports that their AI chatbot, Grok, generated millions of sexualized deepfakes of identifiable individuals. The investigation focused on whether valid consent was obtained for the collection, use, and disclosure of personal information for this purpose, and if such practices were appropriate under PIPEDA. The OPC found that neither company obtained valid consent, noting the sensitive nature of the information, the unreasonableness of individuals' expectations, and the significant risk of harm. Furthermore, the OPC concluded that the generation of sexualized deepfakes was inappropriate, as the loss of privacy and harm far outweighed any benefits, and less privacy-invasive means were available. While the companies implemented some safeguards, the OPC deemed their initial response insufficient and their current measures unproven. Consequently, the matter was found well-founded, with the OPC making several recommendations for improved safeguards, proactive monitoring, and annual third-party audits, while committing to ongoing monitoring.

• Whether PIPEDA applies to X Corp. and X.AI LLC, specifically regarding the existence of a "real and substantial connection" to Canada.
• Whether deepfakes of identifiable individuals, including sexualized deepfakes, constitute "personal information" under PIPEDA.
• Whether X Corp. and X.AI LLC obtained valid consent for the collection, use, and disclosure of personal information to generate sexualized deepfakes, as required by Principle 4.3 of PIPEDA.
• Whether express consent was required for the generation of sexualized deepfakes, considering the sensitivity of the information, individuals' reasonable expectations, and the risk of significant harm (Principle 4.3.4, 4.3.5, and s.6.1 of PIPEDA).
• Whether X Corp. and X.AI LLC are accountable for ensuring valid consent for content generated by their tools in the course of commercial activity.
• Whether a reasonable person would consider the collection, use, and disclosure of personal information for the purpose of an image generation service capable of producing sexualized deepfakes to be appropriate in the circumstances, as per subsection 5(3) of PIPEDA.
• Whether the organizations had a legitimate need or bona fide business interest that extended to providing an image generation tool capable of producing non-consensual sexualized deepfakes.
• Whether less privacy-invasive means were available to achieve the organizations' purposes at comparable cost and benefits.
• Whether the loss of privacy and risk of harm associated with sexualized deepfakes were proportionate to the benefits of the practice.
• Whether X Corp. and X.AI LLC's initial response and implemented safeguards were sufficient and effective in preventing the generation of sexualized deepfakes.

The Office of the Privacy Commissioner of Canada (OPC) launched a systemic investigation into the Canada Revenue Agency (CRA) following media reports and a complaint regarding widespread unauthorized disclosures and modifications of taxpayer personal information. The investigation, a Special Report to Parliament, examined whether the CRA had adequate safeguards to protect taxpayer data from identity theft and fraudulent activities. The OPC found that the CRA contravened subsections 6(2) and 8(2) of the Privacy Act due to shortcomings in its prevention, monitoring, detection, remediation, and governance practices. While acknowledging the CRA's efforts to improve its security posture, the OPC identified specific weaknesses, such as delayed implementation of mandatory multi-factor authentication (MFA) and insufficient tracking of individual breaches. The OPC issued nine recommendations to the CRA, covering areas like strengthening MFA, enhancing phone authentication, adopting zero-trust principles, improving attack surface management, and refining breach tracking and governance. The CRA accepted eight recommendations in full and one in part, leading to a "well-founded and conditionally resolved" outcome.

• Whether the CRA adequately protected personal information against unauthorized disclosure and modification
• Whether the CRA contravened subsection 6(2) of the Privacy Act regarding accuracy of personal information
• Whether the CRA contravened subsection 8(2) of the Privacy Act regarding disclosure of personal information
• Whether the CRA's prevention measures were adequate
• Whether the CRA implemented mandatory multi-factor authentication (MFA) in a timely manner and with sufficient strength
• Whether the CRA's authentication processes by phone were strong enough
• Whether the CRA considered and integrated a zero-trust approach into its security measures
• Whether the CRA had sufficient visibility over its attack surface and managed it effectively
• Whether the CRA's vetting, training, and awareness tools were effective for employees and third parties
• Whether the CRA's monitoring and detection approach was tailored to the threats and risks leading to Unauthorized Use of Taxpayer Information by a Third Party (UUTP)
• Whether the CRA's remediation efforts for individual UUTPs were adequate, including root cause analysis
• Whether the CRA's governance processes for addressing UUTPs were coordinated, comprehensive, and efficient

This joint investigation by the OPC, CAI, OIPC-BC, and OIPC-AB examined OpenAI OpCo, LLC's compliance with federal and provincial privacy laws regarding its ChatGPT service. The Offices investigated OpenAI's collection, use, and disclosure of personal information for model training, consent practices, openness, accuracy, individual rights (access, correction, deletion), data retention, and accountability. While OpenAI challenged jurisdiction and argued for implied consent, the Offices largely found contraventions in its initial practices, particularly concerning the overbroad collection of personal information from public sources and user interactions without valid consent or sufficient transparency. However, in response to the preliminary report, OpenAI committed to implementing significant privacy-enhancing measures, including a new filtering tool for training data, improved transparency, and enhanced individual rights processes. Consequently, the OPC found the matter well-founded and conditionally resolved under PIPEDA, expecting continued implementation and improvement of these measures. The OIPC-AB and OIPC-BC, due to stricter provincial consent requirements, found the consent issues well-founded and unresolved, while the CAI had mixed outcomes, also finding some issues unresolved. The Offices will monitor OpenAI's implementation of the agreed-upon recommendations.

• Whether the Offices had jurisdiction over OpenAI's activities under federal and provincial privacy laws.
• Whether OpenAI collected, used, and disclosed personal information for purposes that a reasonable person would consider appropriate in the circumstances.
• Whether OpenAI obtained valid consent for the collection and use of personal information from publicly accessible websites and licensed third-party sources for model training.
• Whether OpenAI obtained valid consent and met its obligation to inform individuals with respect to the collection and use of personal information included in their interactions with ChatGPT.
• Whether OpenAI obtained valid consent and met its obligation to inform individuals with respect to the disclosure of personal information collected from various sources via ChatGPT.
• Whether OpenAI was sufficiently open and transparent about its models and information handling practices.
• Whether OpenAI took reasonable steps to ensure that the information it generates about individuals is as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.
• Whether OpenAI provided individuals with the ability to obtain access to their personal information.
• Whether OpenAI provided individuals with the ability to correct their personal information.
• Whether OpenAI provided individuals with the ability to remove/delete their personal information from its models.
• Whether OpenAI established appropriate retention and disposal procedures for the personal information that it collects, uses, and discloses.
• Whether OpenAI met its accountability requirements in respect of the personal information under its control.
• Whether the personal or domestic purposes exemption applied to OpenAI's commercial activities.
• Whether the publicly available information exception applied to OpenAI's collection of personal information from the Internet.
• Whether the journalistic, historical, or genealogical material exception under Quebec's Private Sector Act applied to OpenAI's model training data.
• Whether section 9.1 of Quebec's Private Sector Act (privacy by default) applied to ChatGPT's privacy settings.

The Office of the Privacy Commissioner of Canada (OPC) investigated the Canada Border Services Agency's (CBSA) contracting practices for the ArriveCAN application, focusing on measures to protect travellers' personal information handled by contractors. An individual's complaint and a parliamentary committee's motion prompted the review into whether contractors accessed personal information without required security clearances, potentially contravening sections 7 and 8 of the Privacy Act. The OPC found that while contracts included appropriate security clauses, there were issues with the accuracy and timeliness of security assessments (SRCLs) and overly broad task descriptions in Task Authorizations (TAs). Although vendors met organizational security requirements, one contractor worked for 18 months with an expired security clearance, exposing the CBSA to increased privacy risks. The CBSA implemented adequate administrative and technical safeguards, such as segregated environments and strict access controls, but six contractors were granted access to personal information not strictly necessary for their duties. Despite these shortcomings, the investigation found no evidence that personal information was actually used or disclosed in contravention of the Act. Consequently, the complaint was found to be not well-founded, but the OPC issued recommendations to the CBSA to strengthen its contracting and privacy practices, which the agency accepted.

• Whether the CBSA authorized contractors to access personal information collected through ArriveCAN without the required security clearance, in contravention of sections 7 and 8 of the Privacy Act
• Whether ArriveCAN contracts and Task Authorizations (TAs) contained appropriate clauses to ensure the protection of travellers’ personal information that contractors had access to
• Whether security requirements identified in contracts and TAs were accurate and specific
• Whether the CBSA complied with organizational security screening requirements for vendors
• Whether the CBSA complied with personnel security screening requirements for contractors
• Whether the CBSA implemented adequate administrative safeguards to protect personal information accessed by contractors
• Whether the CBSA implemented adequate technical safeguards to protect personal information accessed by contractors
• Whether the CBSA restricted contractor permissions and access to personal information to what was strictly necessary

A joint investigation by the Office of the Privacy Commissioner of Canada (OPC) and provincial privacy regulators (CAI, OIPC BC, OIPC AB) examined TikTok Pte. Ltd.'s compliance with federal and provincial private sector privacy laws. The investigation focused on TikTok's collection, use, and disclosure of personal information for ad targeting and content personalization, with a particular emphasis on practices affecting children. The Offices found that TikTok's age assurance measures were inadequate, leading to the collection and use of sensitive personal information from a large number of underage users for purposes deemed inappropriate. Furthermore, TikTok failed to obtain valid and meaningful consent from both adult and youth users due to unclear, inaccessible, and incomplete privacy communications, including regarding biometric information and cross-border data transfers. The CAI specifically identified contraventions related to Quebec's transparency and privacy-by-default obligations. While TikTok disagreed with the findings, it committed to implementing enhanced age assurance mechanisms, improving privacy communications, and limiting ad targeting for under-18 users. The Offices concluded the matter as well-founded and conditionally resolved, contingent on TikTok's satisfactory implementation of these significant commitments.

• Whether TikTok was collecting, using, and disclosing personal information, particularly with respect to children, for an appropriate, reasonable, and legitimate purpose.
• Whether TikTok's age assurance mechanisms were effective in preventing underage users from accessing the platform.
• Whether TikTok obtained valid and meaningful consent from its users for tracking, profiling, targeting, and content personalization.
• Whether TikTok's privacy communications provided sufficient upfront, clear, and comprehensive information to adult users to ensure meaningful consent.
• Whether TikTok adequately explained its collection and use of users' biometric information to ensure meaningful consent.
• Whether TikTok's privacy communications were adequate to obtain meaningful consent from youth (13-17), considering their cognitive development and potential harms from targeted ads.
• Whether TikTok met its obligations under Quebec's Private Sector Act to inform persons concerned about the collection and use of personal information for user profiles, ad targeting, and content personalization.
• Whether TikTok ensured that privacy settings provided the highest level of privacy by default under Quebec's Private Sector Act.

The Office of the Privacy Commissioner of Canada (OPC) and the UK Information Commissioner (ICO) jointly investigated a data breach at 23andMe Inc., a direct-to-consumer genetic testing company, which affected almost 7 million customers globally, including 319,000 in Canada. The investigation focused on the adequacy of 23andMe's security safeguards and its breach notification practices following a credential stuffing attack. The OPC found that 23andMe failed to implement appropriate safeguards, such as mandatory multi-factor authentication, robust compromised-password checks, and effective detection systems, given the highly sensitive nature of genetic and health information. Additionally, 23andMe's breach notifications to the OPC and affected individuals were deemed inadequate in content and timing, as they initially omitted crucial details like raw DNA data compromise and the data being offered for sale. However, 23andMe subsequently implemented significant security enhancements and updated its notification processes. Consequently, the OPC concluded both issues were well-founded but resolved due to the satisfactory corrective measures taken by the company. This report also highlighted the ongoing bankruptcy proceedings of 23andMe and the Commissioners' commitment to ensuring privacy obligations are met if customer data is transferred.

• Whether 23andMe had appropriate safeguards to protect highly sensitive personal information under its control, specifically against credential stuffing attacks.
• Whether 23andMe's prevention measures, including mandatory Multi-factor Authentication (MFA), compromised-password checks, and minimum password requirements, were adequate.
• Whether 23andMe's detection measures, including detection systems, digital fingerprinting, and device history, were adequate to identify ongoing attacks.
• Whether 23andMe adequately investigated anomalies and claims of breach prior to public disclosure.
• Whether 23andMe's breach response, including the timeliness of disabling active user sessions, disabling raw DNA download features, and implementing mandatory MFA, was adequate.
• Whether 23andMe adequately notified the OPC about the breach, including the completeness of information provided and timeliness.
• Whether 23andMe adequately notified affected individuals about the breach, including the completeness of information provided and timeliness.
• Whether the data breach created a real risk of significant harm to affected individuals, triggering notification obligations.
• Whether 23andMe's methodology for identifying and notifying individuals whose raw DNA was downloaded by the Threat Actor was adequate.

The Office of the Privacy Commissioner of Canada (OPC) investigated the Royal Canadian Mounted Police (RCMP) following the loss of an unencrypted USB storage device containing sensitive personal information of 1,741 individuals. The investigation focused on whether the RCMP contravened section 8 of the Privacy Act regarding disclosure, the appropriateness of its breach response, and the sufficiency of its safeguards for USB devices. The OPC found that the RCMP contravened section 8 due to unauthorized disclosure, as the device was lost, unencrypted, and its contents were copied and offered for sale. While the RCMP's notification to affected individuals and mitigation steps were generally appropriate after discovery, the initial reporting of the loss was significantly delayed. Furthermore, the RCMP failed to implement adequate safeguards, as its own policies for procurement, inventory, and encryption of USB devices were not followed, and security awareness training was insufficient. Despite the RCMP accepting the OPC's recommendations to strengthen safeguards, audit procedures, and awareness programs, it refused to commit to specific timelines for implementation. Consequently, the complaint was found to be well-founded and unresolved.

• Whether the RCMP disclosed personal information in contravention of section 8 of the Privacy Act
• Whether the RCMP's response to the privacy breach was appropriate in the circumstances
• Whether the RCMP's measures to protect personal information contained on USB storage devices were sufficient
• Whether RCMP personnel failed to report the loss of the USB storage device to authorities in a timely manner
• Whether the RCMP's policies and procedures for procurement, inventory, and encryption of USB devices were followed and enforced
• Whether the RCMP's security and privacy awareness training for members was effective and sufficient
• Whether the RCMP's policy compliance monitoring for USB device use was adequate

The Office of the Privacy Commissioner of Canada (OPC) conducted a special investigation into the Royal Canadian Mounted Police's (RCMP) collection of open-source information under Project Wide Awake (PWA), triggered by a complaint from MP Charlie Angus. The investigation focused on the RCMP's use of third-party services, specifically Babel Street's Babel X, for collecting personal information from various online sources. The OPC found that the RCMP failed to conduct adequate due diligence to ensure that the personal information collected via Babel X and its data providers complied with Canadian privacy laws, particularly PIPEDA. Furthermore, the OPC determined that the RCMP did not meet its transparency obligations under Section 11 of the Privacy Act, as its Personal Information Bank (PIB) descriptions were inadequate in detailing the types and purposes of open-source information collected. The RCMP did not agree to implement the OPC's recommendations, including ceasing collection from problematic Babel X sources until a thorough review was completed and updating its PIB descriptions with sufficient granularity. Consequently, both issues were found to be well-founded and unresolved.

• Whether the RCMP's collection of personal information via Social Studio complied with Section 4 of the Privacy Act.
• Whether the RCMP's collection of personal information via Babel X complied with Section 4 of the Privacy Act.
• Whether the RCMP conducted adequate due diligence on the lawfulness of collection practices of Babel X and its data providers.
• Whether Section 4 of the Privacy Act permits the collection of personal information from a third-party agent that collected, used, or disclosed the information in contravention of a law that third party is subject to.
• Whether the RCMP's publicly available descriptions of its open-source information gathering are granular enough to meet transparency obligations under Section 11 of the Privacy Act.
• Whether the RCMP's published descriptions clarify limits on purposes for collection under Section 11 of the Privacy Act.
• Whether the RCMP's descriptions of open-source information collection and related purposes are adequate under Section 11 of the Privacy Act.

The Office of the Privacy Commissioner of Canada (OPC) conducted a special investigation into cyber attacks that led to unauthorized disclosures and modifications of personal information held by the Canada Revenue Agency (CRA) and Employment and Social Development Canada (ESDC). Attackers used credential stuffing and identity theft to access and alter sensitive financial, banking, and employment information of tens of thousands of Canadians through the CRA's sign-in portal and ESDC's GC Key service. The OPC found that both CRA and ESDC contravened sections 6(2) and 8 of the Privacy Act due to inadequate safeguards. Key deficiencies included under-assessment of identity authentication levels, inadequately informed and accountable security decision-making, and a lack of effective monitoring. The OPC issued six recommendations to CRA and ESDC, covering improved authentication practices, coordinated security decision-making, and enhanced monitoring. Both departments accepted the recommendations, with ESDC's acceptance of one recommendation conditional on funding. The OPC concluded the matters for CRA and ESDC as well-founded and conditionally resolved, while other departments using GC Key had varying outcomes.

• Whether Canada Revenue Agency (CRA) contravened section 8 of the Privacy Act by failing to prevent unauthorized disclosure of personal information.
• Whether Employment and Social Development Canada (ESDC) contravened section 8 of the Privacy Act by failing to prevent unauthorized disclosure of personal information.
• Whether CRA contravened subsection 6(2) of the Privacy Act by failing to take all reasonable steps to ensure the accuracy of personal information.
• Whether ESDC contravened subsection 6(2) of the Privacy Act by failing to take all reasonable steps to ensure the accuracy of personal information.
• Whether CRA and ESDC adequately assessed the level of identity authentication warranted for their online services.
• Whether CRA and ESDC's identity assurance practices adequately protected against identity theft.
• Whether CRA and ESDC's credential assurance practices adequately protected against credential stuffing.
• Whether CRA and ESDC had adequately informed and accountable security decision-making processes.
• Whether interdepartmental information sharing and accountability systems were adequate to protect personal information.
• Whether CRA and ESDC conducted comprehensive vulnerability assessments and penetration testing.
• Whether CRA and ESDC had effective monitoring to detect and promptly contain the ongoing breach.
• Whether other federal departments using the GC Key service experienced fraudulent access or modification of personal information.

The Office of the Privacy Commissioner of Canada (OPC) investigated 16 complaints against the Department of National Defence (DND) and the Canadian Armed Forces (CAF) regarding their COVID-19 vaccination attestation requirements. Complainants alleged unreasonable collection, improper use, insufficient access controls in the Monitor MASS system leading to unauthorized disclosure, and inaccurate data. The OPC found that the collection of vaccination status information, including for accommodation requests, directly related to DND's operating programs for health and safety and operational readiness, satisfying section 4 of the Privacy Act. The use of this information was also deemed consistent with the purposes for which it was collected, in line with section 7. While concerns were raised about Monitor MASS access controls, the OPC found no evidence of actual unauthorized disclosures, thus deeming this allegation not well-founded, though it did recommend improved oversight which DND declined. Furthermore, DND was found to have taken reasonable steps to ensure the accuracy of vaccination status data under section 6(2). The OPC also concluded that the measures were necessary and proportional given the pandemic context and the CAF's unique operational role.

• Whether the collection of personal information, including vaccination status and accommodation request details, by DND/CAF related directly to an operating program or activity of the institution as required by section 4 of the Privacy Act.
• Whether the use of the personal information collected under the Directive was authorized under section 7 of the Privacy Act, specifically for applying administrative consequences.
• Whether the use of Monitor MASS for collection and storage of CAF members' vaccination status resulted in unauthorized disclosure of information due to insufficient access controls, contrary to section 8(1) of the Privacy Act.
• Whether DND took reasonable steps to ensure that personal information used for determining the COVID-19 vaccination status of CAF members was accurate, up-to-date, and complete as required by section 6(2) of the Privacy Act.
• Whether the COVID-19 vaccination attestation requirements and associated information collection were necessary and proportional, applying the OPC's four-part test.

The Office of the Privacy Commissioner of Canada (OPC) tabled a Special Report to Parliament summarizing investigations and advisory initiatives concerning the federal government's privacy practices during the COVID-19 pandemic. The report examined vaccine mandates for domestic travel, entry into Canada, and federal employees, as well as the ArriveCAN application, the collection of de-identified mobility data, and information sharing under the Emergencies Act. Overall, the OPC found that federal institutions generally complied with the Privacy Act, with some exceptions and areas for improvement. A significant finding was a breach of the Privacy Act by the Canada Border Services Agency (CBSA) due to an error in the ArriveCAN app that inaccurately identified approximately 10,000 fully vaccinated travellers as needing to quarantine; this issue was subsequently corrected. The Treasury Board of Canada also contravened section 11 of the Privacy Act by not timely publishing a Personal Information Bank description, which was later rectified. The report also included a PIPEDA investigation where Biron Health Group improperly used personal information for marketing, which was settled. The OPC made several recommendations to various institutions regarding necessity, proportionality, transparency, and safeguarding of personal information, some of which were accepted, while others, like a recommendation to the Department of National Defence regarding oversight of a data system, were not. The report emphasized the need for modernized privacy laws and clear guidance for information sharing during crises.

• Whether the collection of COVID-19 vaccination status for domestic travel was lawful under the Privacy Act
• Whether the collection of COVID-19 vaccination status for domestic travel was necessary and proportional
• Whether the handling of personal information collected for domestic travel vaccine mandates was reasonable
• Whether the collection of COVID-19 vaccination status for entry into Canada was lawful under the Privacy Act
• Whether the collection of COVID-19 vaccination status for entry into Canada was necessary and proportional
• Whether the collection of federal employees' vaccination status and related medical/religious information was lawful under the Privacy Act
• Whether the collection of federal employees' vaccination status and related medical/religious information was necessary and proportional
• Whether the Monitor-MASS system used by DND/CAF had adequate oversight to prevent unauthorized access to personal information
• Whether there were inappropriate disclosures of personal information related to federal employee vaccination status
• Whether the Treasury Board of Canada contravened section 11 of the Privacy Act by not timely publishing a Personal Information Bank description
• Whether the Canada Border Services Agency (CBSA) took all reasonable steps to ensure the accuracy of information in the ArriveCAN app under section 6 of the Privacy Act
• Whether the collection and use of de-identified mobility data by PHAC constituted the collection of personal information under the Privacy Act
• Whether Biron Health Group obtained valid consent under PIPEDA for using personal information collected for COVID-19 testing for marketing purposes
• Whether information sharing by RCMP, FINTRAC, and CSIS under the Emergencies Act complied with the Privacy Act
• Whether information sharing under the Emergencies Act was necessary and proportionate
• Whether there was clear direction and guidance for information sharing under the Emergencies Act
• Whether appropriate safeguards were in place for personal information shared under the Emergencies Act
• The need for modernized privacy laws to address necessity, proportionality, and de-identified information
• The importance of transparency and accountability in government initiatives involving personal information during crises

The Office of the Privacy Commissioner of Canada (OPC) investigated complaints from federal public service employees against several separate employers regarding COVID-19 vaccination attestation requirements. Employees alleged that the collection, use, and disclosure of their vaccination status and accommodation requests contravened the Privacy Act. The OPC examined whether the information collected related directly to an operating program or activity (s.4) and if its uses and disclosures were authorized (s.7 and s.8). The OPC found that the collection was directly related to the employers' occupational health and safety programs and that uses and disclosures were consistent with the purpose of collection. Additionally, the OPC assessed the necessity and proportionality of these measures, concluding they were necessary and proportional given the emergency context of the pandemic. Consequently, the OPC found the complaints to be not well-founded. However, the OPC recommended that Canada Post Corporation refine its access controls for sensitive information and that all institutions conduct structured necessity and proportionality analyses for future privacy-invasive programs.

• Whether the information collected by the respondents related directly to an operating program or activity of the institution as required by section 4 of the Privacy Act
• Whether uses and disclosures of information relating to employee vaccination status and requests for accommodation were authorized under sections 7 and 8 of the Privacy Act
• Whether the information collected was necessary and proportional
• Whether the measure was demonstrably necessary to meet a specific need
• Whether the measure was likely to be effective in meeting that need
• Whether there was a less privacy-intrusive way of achieving the same end
• Whether the loss of privacy was proportional to the need

The Office of the Privacy Commissioner of Canada (OPC) investigated 40 complaints against the Treasury Board of Canada Secretariat (TBS) and 19 other federal institutions regarding COVID-19 vaccination attestation requirements for federal employees. Complainants alleged unreasonable collection, lack of transparency, and inappropriate disclosure of personal information. The OPC found that the collection of vaccination status and accommodation information related directly to the institutions' operating programs and activities, such as health and safety and human resources management, and that transparency requirements under subsection 5(2) of the Privacy Act were met. However, TBS contravened subsection 11(1) of the Act by failing to update its personal information bank index within the required timeframe, though this issue was subsequently resolved. The OPC also found no systemic contraventions of disclosure provisions under section 8. While necessity and proportionality are not direct legal requirements of the Privacy Act, the OPC assessed the policy against these principles and found it to be necessary and proportional under the circumstances, despite weaknesses in TBS's documentation. The OPC recommended that TBS assess future privacy-invasive measures using a four-part test, a recommendation TBS did not commit to.

• Whether the information collected by institutions related directly to an operating program or activity of the institution as required by section 4 of the Privacy Act.
• Whether institutions properly met the transparency requirements of subsection 5(2) of the Privacy Act regarding informing individuals of the purpose of collection.
• Whether the Treasury Board of Canada Secretariat (TBS) complied with subsection 11(1) of the Privacy Act by publishing an index of personal information banks.
• Whether disclosures of personal information collected under the Policy were authorized under section 8 of the Privacy Act.
• Whether the collection of personal information was necessary and proportional, applying the OPC's four-part test.

The Office of the Privacy Commissioner of Canada (OPC) investigated 12 complaints against the Public Health Agency of Canada (PHAC) and Health Canada regarding their collection and use of de-identified mobility data during the COVID-19 pandemic. Complainants alleged PHAC secretly collected data on 33 million mobile devices. PHAC maintained it only used de-identified and aggregated data, arguing the Privacy Act did not apply as no personal information was collected. The OPC's primary issue was whether the mobility data constituted "personal information" under Section 3 of the Privacy Act, specifically if de-identification and safeguards reduced re-identification risk below the "serious possibility" threshold. The investigation examined two data streams, from TELUS and BlueDot, and assessed the de-identification techniques, aggregation levels, access controls, and contractual safeguards in place. The OPC concluded that the combination of these measures reduced the risk of identifying individuals below the "serious possibility" threshold. Consequently, the complaints were found to be not well-founded, as the data did not meet the definition of personal information under the Act. Despite this finding, the OPC made several recommendations to PHAC concerning ongoing assessment of de-identification techniques, due diligence with data providers, and enhanced transparency, which PHAC accepted.

• Whether mobility data collected and used by PHAC constituted "personal information" as defined under Section 3 of the Privacy Act.
• Whether de-identification techniques and safeguards against re-identification were sufficient to reduce the risk of an individual being identified below the "serious possibility" threshold.
• Whether access to data within TELUS's system constituted "collection" under the Privacy Act.
• Whether de-identification alone is sufficient to render mobility data non-personal.
• Whether robust contractual and physical protections were in place to limit access and use of de-identified data.
• Whether acceptable data aggregation levels and access controls existed for aggregated mobility data.
• Whether PHAC was sufficiently transparent with the public about its use of mobility data.