Canadian privacy & access decisions

A military officer complained that the Department of National Defence (DND) inappropriately disclosed his personal medical information to the Department of Justice (DOJ), and that the DOJ inappropriately collected it, for litigation purposes. The complainant had initiated a lawsuit against DND, naming the Attorney General of Canada as respondent. DND disclosed the information, including physical and mental health files, to the DOJ in response to a document collection order for defending against the lawsuit. The OPC found that both the collection by DOJ and disclosure by DND were permissible under the Privacy Act, specifically paragraph 8(2)(d), as the disclosure was to the Attorney General for use in legal proceedings involving the Government of Canada. The OPC also noted that the Act makes no distinction based on the sensitivity of personal information and that doctor-patient confidentiality is not a general privilege in Canadian law. Both complaints were found to be not well-founded.

• Whether the collection of the complainant's personal medical information by the DOJ from the DND contravened the Privacy Act
• Whether the disclosure of the complainant's personal medical information by the DND to the DOJ contravened the Privacy Act
• Whether the collection by DOJ related directly to an operating program or activity of the institution under s.4 of the Privacy Act
• Whether the collection by DOJ was permissible under s.5(1) of the Privacy Act given the disclosure under s.8(2)(d)
• Whether the disclosure by DND was to the Attorney General of Canada under s.8(2)(d) of the Privacy Act
• Whether the disclosure by DND was for use in legal proceedings involving the Crown in right of Canada or the Government of Canada under s.8(2)(d) of the Privacy Act
• Whether the sensitivity of medical information impacts the permissibility of disclosure under the Privacy Act
• Whether doctor-patient confidentiality prevents disclosure under the Privacy Act for litigation purposes
• Whether the safeguarding measures for the disclosed information were adequate