Canada Border Services Agency (Re) 2025 OIC 12
Date: 2025-02-26
OIC file number: 5823-04210
Access request number: A-2024-03015
Summary
The complainant alleged that the Canada Border Services Agency (CBSA) did not conduct a reasonable search for records in response to an access request made under the Access to Information Act. The request was for Microsoft Teams (MS Teams) messages created between September 1, 2023, and December 6, 2023, containing a list of keywords related to ArriveCAN. The allegation falls under paragraph 30(1)(a) of the Act.
CBSA retains MS Teams messages for 30 days. However, CBSA only began processing the access request more than 30 days after it received it, due to it not being promptly entered it into its case management system. As a result, access to information officials, assuming all relevant records would have already been destroyed, did not ask program areas for records. Instead, CBSA told the complainant that no such records existed.
CBSA policy requires business-related information shared on MS Teams to be saved to corporate repositories before the 30-day mark passes. In light of questions about this during the investigation, CBSA searched these repositories and identified one relevant record, which it provided to the complainant. Regardless, the delay in asking program areas for records undoubtedly had a detrimental effect on the requester’s right of access.
The complaint is well founded.
No order was required, since CBSA disclosed the only record responsive to the access request.
Complaint
[1] The complainant alleged that the Canada Border Services Agency (CBSA) did not conduct a reasonable search for records in response to an access request made under the Access to Information Act. The request was for Microsoft Teams (MS Teams) messages created between September 1, 2023 and December 6, 2023 containing a list of specific keywords related to ArriveCAN. The allegation falls under paragraph 30(1)(a) of the Act.
Investigation
[2] CBSA was required to conduct a reasonable search for records that fall within the scope of the access request—that is, one or more experienced employees, knowledgeable in the subject matter of the request, must have made reasonable efforts to identify and locate all records reasonably related to the request.
[3] A reasonable search involves a level of effort that would be expected of any fair, sensible person tasked with searching for responsive records where they are likely to be stored.
[4] This search does not have to be perfect. An institution is therefore not required to prove with absolute certainty that further records do not exist. Institutions must, however, be able to show that they took reasonable steps to identify and locate responsive records.
Did the institution conduct a reasonable search for records?
[5] In response to the access request, CBSA notified the complainant that the requested records do not exist as MS Teams messages have a retention period of 30 days. The complainant alleges that messages ought to have existed at the time their request was received, December 6, 2023.
[6] During the course of the investigation, the Office of the Information Commissioner (OIC) requested documentation related to CBSA’s search for responsive records.
[7] CBSA explained that on November 9, 2023, it on-boarded to the new Treasury Board Secretariat Access to Information and Privacy (ATIP) Online Request Service (AORS). As a result, the process for how it received requests changed.
[8] CBSA confirmed that the request was received on December 6, 2023. However, due to the implementation of the AORS, an administrative error occurred in the receipt and registration of the request. This error resulted in the request not being entered into CBSA’s AccessPro Case Management (APCM) system, the software CBSA uses to process access requests.
[9] CBSA therefore only began working on the request once it became aware of the error, on January 18, 2024.
[10] After it receives a request, one of the first steps an institution must undertake is to task the request to the Offices of Primary Interest (OPI). Receiving a tasking is the trigger for OPIs to search for and produce records related to an access request.
[11] CBSA’s retention policy for MS Teams messages, is 30 calendar days. MS Teams messages are automatically deleted once the retention period expires and no back-ups are made. Since CBSA began processing the request more than 30 days after it was received, CBSA did not task for records and instead provided the complainant with a no records response.
[12] CBSA explained that, after becoming aware that this request was not properly captured, it implemented new quality assurance processes. These quality assurance processes, although manual, ensure that all requests are registered in a timely manner so that tasking and retrieving records responsive to all requests begins as soon as possible.
[13] During the course of the investigation, CBSA confirmed that it had provided instructions to all staff in July 2021 to save information of business value to corporate repositories, as the 30-day retention of Teams messages would be implemented starting August 2021. The following message was sent to all CBSA staff on July 29, 2021 as part of “The CBSA Daily”:
Starting August 10, chats on CBSA Teams will be retained for 30 days only. After this period, the content will be automatically purged.
CBSA employees are responsible for making sure that all business-related information shared on CBSA Teams is documented and saved in Apollo [CBSA’s corporate repository].
[14] In response to questions posed during the investigation, CBSA searched corporate repositories for records that would fall within the scope of the present request and identified one responsive record which was provided to the complainant in a supplementary release.
[15] There is no doubt that a delay in tasking the OPIs to retrieve relevant records had a detrimental impact on the requester’s right of access. The right of access applies to all records under the control of an institution at the time the request is made regardless of whether they are transitory or of business value.
[16] The underlying systems and work processes used by ATIP units within the Federal Public Service must function appropriately to ensure access rights are preserved.
[17] In light of all of the above, I conclude the CBSA did not conduct a reasonable search for records in response to the access request. However, given the search efforts conducted during the course of the investigation, I am satisfied that a reasonable search has now been conducted.
Outcome
[18] The complaint is well founded because CBSA did not conduct a reasonable search for records in response to the access request.
[19] An order is not necessary however, given CBSA conducted a reasonable search during the course of the investigation.
[20] This investigation revealed several issues with the processing of this request including but not limited to: the request not being entered into CBSA’s APCM system on time; failing to task relevant OPIs on time; and an inadequate search for records as evidenced by the additional record that was ultimately found and sent to the complainant.
[21] It is imperative for the President of the CBSA to take immediate action to ensure that these issues are isolated and not indicative of larger systemic access issues at the CBSA. It should be noted that the OIC has received numerous complaints relating to the processing of access requests on the subject of ArriveCan and I have therefore initiated my own investigation. Should there be systemic access issues found, the results of my investigation will be reported separately.
Review by Federal Court
When an allegation in a complaint falls under paragraph 30(1)(a), (b), (c), (d), (d.1) or (e) of the Act, the complainant has the right to apply to the Federal Court for a review. The complainant must apply for this review within 35 business days after the date of this report and must serve a copy of the application for review to the relevant parties, as per section 43.