Fisheries and Oceans Canada (Re), 2026 OIC 54

Date: 2026-07-22
OIC file number: 5823-01597
Access request number: A-2022-01164

Summary

The complainant alleged that Fisheries and Oceans Canada (DFO) had improperly withheld information under paragraphs 20(1)(b) (confidential third party financial, commercial, scientific or technical information) and 20(1)(c) (financial impact on a third party) of the Access to Information Act in response to an access request. The complainant also alleged that DFO applied an unofficial internal policy to refuse access to the information. These allegations fall under paragraph 30(1)(a) of the Act. The access request was for specified At-Sea Observer (ASO) data for the non-retained bycatch species black dogfish for all fisheries operating in Canadian Northwest Atlantic Fisheries Organization subareas 0, 1, 2, 3 and 4 from 2000-2021 from the DFO Newfoundland region.

DFO could not show that it met all the requirements of these exemptions and it was unable to identify the third parties. However, the investigation showed that DFO did not apply an unofficial internal policy to refuse access to the information.

The Information Commissioner ordered that DFO disclose all of the information. DFO gave notice to the Commissioner that it would implement the order. The complaint is well founded.

Complaint

[1]The complainant alleged that Fisheries and Oceans Canada (DFO) had improperly withheld information under paragraphs 20(1)(b) (confidential third party financial, commercial, scientific or technical information) and 20(1)(c) (financial impact on a third party) of the Access to Information Act in response to an access request.

[2]The complainant also alleged that DFO applied an unofficial internal policy called the “Rule of 5” to refuse access to the information.

[3]These allegations fall under paragraph 30(1)(a) of the Act.

[4]The access request was for At-Sea Observer (ASO) data for the non-retained bycatch species black dogfish for all fisheries operating in Canadian Northwest Atlantic Fisheries Organization (NAFO) Subareas 0, 1, 2, 3 and 4 from 2000-2021 from the DFO Newfoundland region, specifically the year, NAFO area, gear type, ASO coverage, targeted species, black dogfish total weight, and black dogfish total number discarded.

Investigation

[5]During the investigation, DFO indicated that, although it did not decide also to rely on subsection 19(1) (personal information) to withhold the information, it believed that the information would still meet the requirements of subsection 19(1). As a result, I also examined whether subsection 19(1) could apply to the information.

Preliminary issue: identity of the third parties

[6]When an institution withholds information that includes information related to third parties, the third parties and/or the institution bears the burden of showing that refusing to grant access is justified.

[7]Section 33 of the Act requires that an institution advise the Office of the Information Commissioner (OIC) of any third party that the institution notified or would have notified under subsection 27(1) if it had intended to disclose the record or part thereof.

[8]As such, the OIC requested that DFO identify and provide contact information for any such third parties. In refusing to do so, DFO indicated that identifying the harvesters would be a very onerous task. More specifically, DFO explained that while it could access the original dataset and provide Canadian Fishing Vessel (CFV) numbers for each row, matching those CFVs to specific harvesters or companies would require submitting combinations of year, fishery, and CFV numbers to Statistics Canada or Licensing for further processing. Furthermore, while the identities of ASOs were known, DFO indicated that they were not the third parties to whom the information belongs.

[9]Notwithstanding DFO's failure to advise the OIC as to the identity of the relevant third parties, paragraph 35(2)(c) requires that the OIC provide third parties with a reasonable opportunity to make representations if:

the Information Commissioner intends to make an order, under subsection 36.1(1), requiring the disclosure of a record or a part of a record — or to recommend the disclosure of a record or a part of a record — that contains, or that the Commissioner has reason to believe might contain, trade secrets of the third party, information described in paragraph 20(1)(b) or (b.1) that was supplied by the third party or information the disclosure of which the Commissioner can reasonably foresee might effect a result described in paragraph 20(1)(c) or (d) in respect of the third party, and
the third party can reasonably be located

[10]In this instance, the identities of the third parties were not discernible to the OIC on the face of the record. In the absence of such information from DFO, the OIC was therefore unable to locate any such third parties. As the second condition of paragraph 35(2)(c) was not met, the requirement to provide a reasonable opportunity to make representations to any third parties was not triggered.

Paragraph 20(1)(b): confidential third-party financial, commercial, scientific or technical information

[11]Paragraph 20(1)(b) requires institutions to refuse to disclose confidential financial, commercial, scientific or technical information provided to a government institution by a third party (that is, a private company or individual, but not the person who made the access request).

[12]To claim this exemption, institutions must show the following:

The information is financial, commercial, scientific or technical.
The information is confidential.
The third party supplied the information to a government institution.
The third party has consistently treated the information as confidential.

[13]When these requirements are met, and the third party to whom the information relates consents to its disclosure, subsection 20(5) requires institutions to reasonably exercise their discretion to decide whether to disclose the information.

[14]In addition, when the requirements are met, subsection 20(6) requires institutions to reasonably exercise their discretion to decide whether to disclose the information for public health or public safety reasons, or to protect the environment, when both of the following circumstances (listed in subsection 20(6)) exist:

disclosure of the information would be in the public interest; and
the public interest in disclosure clearly outweighs any financial impact on the third party, any prejudice to the security of the third party’s structures, networks or systems, or competitive position, or any interference with its contractual or other negotiations.

[15]However, subsections 20(2) and 20(4) specifically prohibit institutions from using paragraph 20(1)(b) to refuse to disclose information that contains the results of product or environmental testing carried out by or on behalf of a government institution, unless the testing was done for a fee for an individual or an organization other than a government institution.

Does the information meet the requirements of the exemption?

[16]DFO applied paragraphs 20(1)(b) and 20(1)(c) concurrently to withhold all of the information in the response.

Is the information financial, commercial, scientific or technical?

[17]In order to justify withholding information under paragraph 20(1)(b), DFO was required to demonstrate that the information constituted financial, commercial, scientific, or technical information.

[18]DFO argued that information relating to "bycatches" can have commercial value in that bycatches are not discarded in every case and may in fact have market value. Further, certain types of information could reveal harvesters’ fishing strategies, which DFO asserted constituted the harvesters' commercial information. DFO further argued that the withheld information constituted scientific information, in part, given its potential use in considering impacts on sensitive species and in scientific modelling.

[19]However, for the reasons that follow, I am not convinced that any of the information can be characterized as commercial, financial or scientific. Firstly, clearly the data relates to discarded fish, therefore the assertion that the targeted species constitutes the commercial and/or financial information of the harvesters is without merit. These fish have no "catch value" for the harvesters.

[20]Secondly, the codes related to certain types of information do not appear to constitute commercial information of the harvester. These seem to be standardized regulatory classifications. While it may relate to their commercial undertakings, this is not on its own sufficient to qualify the information as commercial within the ordinary meaning of that term. It is not enough that the records have financial or commercial implications; the records must contain financial or commercial information (see Appleton & Associates v. Canada (Privy Council Office), 2007 FC 640). The codes are uniform, mandatory, and publicly defined, and DFO has not shown how they can reasonably be characterized as commercial information belonging to any particular harvester.

[21]Finally, while DFO may use this data for scientific purposes, this subsequent use does not render the information scientific in the hands of the harvesters. Rather, the data reflects routine operational observations, not scientific analysis, interpretation, or conclusions.

[22]The test for paragraph 20(1)(b) is conjunctive, meaning that the inapplicability of any of the conditions negates the application of paragraph 20(1)(b) (Preventous Collaborative Health v. Canada (Health), 2024 FC 1214 at para 27). When the information at issue does not constitute financial, commercial, scientific or technical information, the requirements of the exemption cannot be met.

[23]I conclude that the information is not financial, commercial, scientific and/or technical information. The first criterion for exemption is not met.

Is the information confidential?

[24]In order for paragraph 20(1)(b) to be applied, the record must be objectively confidential. In Air Atonabee Ltd. v. Canada (Minister of Transport), 1989 CanLII 10334 (FC), the Federal Court outlined three specific sub-criteria, each of which must be met, for the information to be considered confidential:

the information is not otherwise available from public sources;
the information originates and is communicated with a reasonable expectation of confidence that it will not be disclosed; and
the relationship between the government and third party is not contrary to the public interest and will be fostered for public benefit by keeping the information confidential.

[25]I find that the information is not otherwise available from public sources.

[26]Regarding whether the information originated and was communicated with a reasonable expectation of confidence that it will not be disclosed, DFO explained that there are confidentiality agreements in place between the harvesters, ASOs and DFO. Although requested, DFO failed to provide a copy of any such agreement.

[27]DFO further asserted that it is authorized by legislation to hold, view, and use this data for management and scientific purposes, but not to disclose without approval unless it is in an aggregated format. Similarly, while asked to elaborate on what legislative authorities DFO was relying on, DFO failed to provide this information to the OIC.

[28]Finally, DFO explained the process ASOs follow when reporting catch to DFO. According to DFO, the third parties treat this information as confidential and therefore expect DFO will do the same.

[29]Given DFO's failure to substantiate the bases on which a reasonable expectation of confidentiality existed, and in the absence of evidence from the third parties, themselves, I am not persuaded that the harvesters had a reasonable expectation that their information would be held in confidence by DFO. While assurances of confidentiality may be persuasive, courts have consistently indicated that parties cannot contract out of the Act (Brookfield Lepage Johnson Controls Facility Management Services v. Canada (Minister of Public Works and Government Services), 2003 FCT 254 at paragraph 16)). Without being able to review any of the confidentiality agreements, I cannot assess the extent, impact and legality of such an agreement.

[30]Similarly, unless a prohibition on disclosure is incorporated into the Act by way of Schedule II, no statutory prohibition on disclosure is paramount to the right of access contained in the Act. As DFO did not identify any such provision, I am unable to consider its impact on the reasonable expectations of the third parties.

[31]By failing to substantiate its argument either through the provision of examples of confidentiality agreements or by identifying relevant statutory provisions, DFO has not met its burden to demonstrate the third parties had a reasonable expectation of confidence in this information. Vague references to agreements or legislation are insufficient. This illustrates the importance of identifying third parties to the OIC. The third parties, who may have the strongest interest in non-disclosure, are often best placed to make such arguments.

[32]Despite the alleged initial expectation of confidentiality between harvesters and ASOs, there is no reasonable assurance that this confidentiality extends once the information is in DFO’s possession.

[33]Finally, to demonstrate the objective confidentiality of the information, the relationship between the government and the third party must not be contrary to the public interest, and confidentiality must serve a public benefit.

[34]DFO represented that mandated coverage involves an expectation that harvesters and third parties will cooperate and assist the ASO in collecting the required data. Mandated coverage refers to situations where participation in data-collection activities is compulsory under regulatory or program requirements, rather than voluntary. DFO argued that ASOs may experience increased difficulties in deploying and conducting their activities at sea if a harvester is challenged or criticized by a Non-Governmental Organization because ASO data was released showing a significant amount of bycatch, attributable to them specifically, leading to a mistrust of the ASO process and ultimately increased departure of ASOs from the field and reduced capacity to provide information to DFO. It remains unclear, however, how the amount of bycatch would be attributable to a specific harvester in this case.

[35]DFO argued that releasing information that damages the relationship between any of the three (DFO, harvesters, ASOs) will put strain on the daily work that is necessary for the smooth running of the fishery. DFO considered that protecting the relationships between DFO and the third parties is extremely important to the ongoing work in all fisheries.

[36]While DFO is concerned that releasing bycatch information could strain its relationship with harvesters and ASOs, the risk of damaging these relationships is mitigated by the fact that participation in the observer program is mandated by law, and is not contingent on voluntary cooperation or satisfaction with how the data is ultimately used or disclosed.

[37]Finally, DFO argued that the relationship is aligned with the public interest because it enables accurate data collection, sustainable fisheries management, and compliance monitoring.

[38]DFO failed to adequately address how the relationship would be fostered for the public benefit by keeping the information confidential; the points raised fall short of demonstrating that confidentiality is what fosters a public-interest relationship within the meaning of the principle.

[39]I conclude that the withheld information has not been shown to be objectively confidential.

Is the information supplied by a third party?

[40]DFO indicated that the information is collected from and by third party entities under the auspices of the Fisheries Act and stored on DFO servers. I conclude that the third requirement for the exemption is met.

Has the third party has consistently treated the information as confidential?

[41]DFO acknowledged that the subject matter expert has no direct knowledge of the steps or precautions taken by individual harvesters to protect their catch information, aside from the general knowledge that most fishers are “very protective” of such information.

[42]Per Merck Frosst (2012) at para 47, “direct and objective evidence” is needed to conclude that this requirement is met. DFO was unable to provide such evidence in the absence of representations from the third parties.

[43]I conclude that DFO has not demonstrated that the third parties consistently treat the information as confidential.

[44]DFO did not show that the information meets the requirements of the first, second and fourth criteria. I conclude that the information does not meet the requirements of paragraph 20(1)(b).

[45]Since the information does not meet the requirements of paragraph 20(1)(b), I also investigated whether DFO had properly applied paragraph 20(1)(c) to the same information.

Paragraph 20(1)(c): financial impact on a third party

[46]Paragraph 20(1)(c) requires institutions to refuse to disclose information that, if disclosed, could reasonably be expected to have a material financial impact on a third party (that is, a private company or individual, but not the person who made the access request) or harm its competitive position.

[47]To claim this exemption with regard to financial impact on a third party, institutions must show the following:

Disclosing the information could result in material financial loss or gain to the third party.
There is a reasonable expectation that this harm could occur—that is, the expectation is well beyond a mere possibility.

[48]To claim this exemption with regard to competitive position, institutions must show the following:

Disclosing the information could injure the competitive position of the third party.
There is a reasonable expectation that this prejudice could occur—that is, the expectation is well beyond a mere possibility.

[49]When these requirements are met, and the third party to whom the information relates consents to its disclosure, subsection 20(5) requires institutions to reasonably exercise their discretion to decide whether to disclose the information.

[50]In addition, when the requirements are met, subsection 20(6) requires institutions to reasonably exercise their discretion to decide whether to disclose the information for public health or public safety reasons, or to protect the environment, when both of the following circumstances (listed in subsection 20(6)) exist:

disclosure of the information would be in the public interest; and
the public interest in disclosure clearly outweighs any financial impact on the third party, any prejudice to the security of the third party’s structures, networks or systems, or competitive position, or any interference with its contractual or other negotiations.

[51]However, subsections 20(2) and 20(4) specifically prohibit institutions from using paragraph 20(1)(c) to refuse to disclose information that contains the results of product or environmental testing carried out by or on behalf of a government institution, unless the testing was done for a fee for an individual or an organization other than a government institution.

Does the information meet the requirements of the exemption?

[52]DFO applied paragraph 20(1)(c) to withhold all of the information in the response.

[53]Without identifiability, the harm test under paragraph 20(1)(c) cannot be met.

[54]DFO argued that the disclosure of the requested information would reasonably be expected to prejudice the competitive position of the affected harvesters. The institution explained that the single-species bycatch data, when combined with external knowledge of the relatively small number of harvesters operating in the relevant fishery, would enable third parties to infer individual harvesters’ total bycatch, overall catch levels, and associated landing values. DFO also argued that the detailed information in certain categories could reveal strategic information and that even without names, these details might allow recognition of vessels in fisheries with few participants. According to DFO, this information constitutes commercially sensitive data that is not otherwise publicly available. Releasing it would allow competitors or other market participants to derive insights into each harvester’s business operations, thereby placing them at a competitive disadvantage. DFO further submitted that releasing this information could strain contractual relationships between ASOs and harvesters.

[55]DFO also asserted that total catch or landings could “theoretically” be estimated by applying generic ratios of bycatch to reported landings. These ratios, DFO argued, could be used to estimate commercial catches for identifiable enterprises if combined with other datasets. However, I do not agree that the records at issue contain identifiable third parties. Even DFO considered that attempting to identify the vessels with the resources it has at its disposal would be onerous.

[56]DFO did not provide any links to where this cross-referenced information could be found, nor did it identify with certainty (i.e. not speculation) any publicly available information pertaining to the individuals or companies involved in harvesting. DFO has not demonstrated that the information in the dataset, or the identities of vessels, could reasonably be inferred from public information, as it has not shown what datasets exist, how they could be cross-referenced, or how such cross-referencing would lead to identification.

[57]DFO further contended that releasing non-aggregated by-catch data would set a precedent enabling multiple requests for similar data across species, which could then be combined to refine estimates. The present request concerns non-retained bycatch with no commercial value. DFO’s suggestion that black dogfish may become economically significant in the future or that future targeted access requests could be combined is speculative. The exemption cannot be applied to protect hypothetical future interests.

[58]DFO’s concern regarding the public availability of the information centered on the mosaic effect. DFO noted that 78% of the dataset comes from fishery cells with fewer than five vessels. A fishery cell is a small square or zone on a map that scientists and managers use to keep track of what’s happening in the water, like where fish are, how many are caught, and how healthy the ecosystem is. DFO represented that it also releases other fishery information, such as licence and quota data, and harvesters often know each other’s activities. When combined with “low participation rates” due to costs and labour shortages, DFO represented these factors could allow vessels or harvesters to be identified.

[59]These claims remain speculative and unsupported by evidence, especially when DFO itself has not identified the third parties. Paragraph 20(1)(c) requires a demonstrable risk of harm, not hypothetical or theoretical possibilities.

[60]DFO has not demonstrated that disclosure could reasonably be expected to result in material financial loss or gain to a third party, or that it could reasonably be expected to injure a third party’s competitive position. I conclude that that the information does not meet the requirements of paragraph 20(1)(c).

Subsection 19(1): personal information

[61]Subsection 19(1) requires institutions to refuse to disclose personal information.

[62]To claim this exemption, institutions must show the following:

The information is about an individual—that is, a human being, not a corporation.
There is a serious possibility that disclosing the information would identify that individual.
The information does not fall under one of the exceptions to the definition of “personal information” set out in paragraphs 3(j) to 3(m) of the Privacy Act (for example, business contact information for public servants).

[63]When these requirements are met, institutions must then consider whether the following circumstances (listed in subsection 19(2)) exist:

The person to whom the information relates consents to its disclosure.
The information is publicly available.
Disclosure of the information would be consistent with section 8 of the Privacy Act.

[64]When one or more of these circumstances exist, subsection 19(2) of the Access to Information Act requires institutions to reasonably exercise their discretion to decide whether to disclose the information.

Does the information meet the requirements of the exemption?

[65]During the course of the investigation, DFO indicated that it could have applied subsection 19(1) to fully withhold the information in the records, though it never indicated that it had now decided to rely on the exemption. Given that subsection 19(1) is a mandatory exemption, I have examined whether the information meets the requirements.

[66]As established in Gordon v. Canada (Health), 2008 FC 258 at paragraph 34, information qualifies as personal information if there is a serious possibility that an individual could be identified, either directly or by combining it with other information.

[67]DFO reiterated that it is relying on the mosaic effect regarding the concern of re-identification, as there are certain harvesters represented in the information who are one-person fishing enterprises.

[68]A cell with 1-2 vessels only shows that a few vessels operated in that combination of year/gear/NAFO/directed fishery. It does not reveal vessel names, registration numbers, owner names, trip dates, landing ports, quota holdings or individual catch logs. It also does not reveal which trip produced the bycatch, which port the vessel used, which crew was aboard, or which licence holder was involved. Without these identifiers, the data remains non-personal and non-attributable.

[69]Further, DFO described the difficulties its subject-matter experts would have in identifying the third parties. This directly undermines DFO’s claim that vessels could be easily identified by the public using the “mosaic effect.” If DFO’s own subject-matter experts acknowledge that re-identifying harvesters from the dataset would be difficult and resource-intensive, then the argument that an ordinary person could do so using limited publicly available information is not credible.

[70]In accordance with section 36.2 of the Act, the OIC consulted the Office of the Privacy Commissioner (OPC) in respect of the information in the records. The OPC agreed with the OIC that DFO has not provided sufficient evidence to demonstrate that the information is specific to individual harvesters and/or widely recognized as belonging to operators/employees of specific vessels. Without such evidence, the OPC did not see how the information at issue relates to specific individuals, and therefore, would not meet the definition of personal information as defined by section 3 of the Privacy Act.

[71]Further, based on the information provided, the OPC agreed that the risk of re-identification appears to be speculative rather than probable. The jurisprudence requires that re-identification be probable, realistic, and based on more than conjecture. The arguments for re-identification made by DFO rely on assumptions about what fishers know, assumptions about cross-referencing, and assumptions about the participation patterns of individual vessels.

[72]In light of the above, I conclude that the information does not meet the requirements of subsection 19(1) because there is no serious possibility that disclosing the information would identify the harvester.

Other Matters

[73]The complainant alleged that DFO relied on an internal policy called “The Rule of 5” to refuse access to the information.

[74]DFO explained the “Rule of 5” as follows: “[it] means there should be at least five people or personally identifying variables aggregated in the data set,” because “[w]ith data sets smaller than five, the likelihood of disclosing information about identifiable individuals increases”. It requires that data be aggregated to include at least five distinct entities (vessels, companies or harvesters) per category (area, period, species). DFO argued that this statistical approach limits the possibility of linking information to a particular actor, even by cross-checking with other sources.

[75]The investigation revealed that, while DFO might use this policy for informal disclosures, DFO did not apply the Rule of 5 when responding to the access request.

[76]I conclude that DFO did not withhold the information in the response to the request on the basis of an internal policy called the “Rule of 5”.

Outcome

[77]The complaint is well founded because DFO improperly withheld the information under paragraph 20(1)(b) and paragraph 20(1)(c) when it responded to the access request.

Order

I order the Minister of Fisheries and Oceans to disclose the records in full.

Initial report and notice from institution

On June 18, 2026, I issued my initial report to the Minister of Fisheries and Oceans setting out my order.

On July 16, 2026, the Acting Director of the Access to Information and Privacy Division gave me notice that DFO would be implementing the order.

Review by Federal Court

When an allegation in a complaint falls under paragraph 30(1)(a), (b), (c), (d), (d.1) or (e) of the Act, the complainant has the right to apply to the Federal Court for a review. When the Information Commissioner makes an order(s), the institution also has the right to apply for a review. The complainant and/or institution must apply for a review within 35 business days after the date of this report. When they do not, the Privacy Commissioner may apply for a review within the next 10 business days. Whoever applies for a review must serve a copy of the application for review to the relevant parties, as per section 43. If no one applies for a review by these deadlines, the order takes effect on the 46th business day after the date of this report.

Other recipient of final report

As required by subsection 37(2), this report was provided to the Privacy Commissioner of Canada.