Canada Mortgage and Housing Corporation (Re), 2025 OIC 30

Date: 2025-05-20
OIC file number: 5820-03930
Access request number: AF-2020-00065/JMH

Summary

The complainant alleged that the Canada Mortgage and Housing Corporation (CMHC) had improperly withheld information under the following provisions of the Access to Information Act:

paragraph 18(a) (government financial, commercial, scientific or technical information);
paragraph 18(b) (competitive position of government institutions, negotiations by government institutions);
subsection 19(1) (personal information);
paragraph 20(1)(b) (confidential third-party financial, commercial, scientific or technical information);
paragraph 20(1)(c) (financial impact on a third party);
paragraph 20(1)(d) (negotiations by a third party);
paragraph 21(1)(a) (advice or recommendations); and
paragraph 21(1)(b) (accounts of consultations or deliberations).

This was in response to an access request for all records regarding mortgage loans inadvertently insured and/or sold by the Laurentian Bank of Canada (Laurentian Bank or the bank) under its securitization program, including but not limited to information that was more particularly described (i.e. in 8 bullet points). The allegation falls under paragraph 30(1)(a) of the Act.

CMHC released some information during the investigation. Following the supplementary release, a limited number of partially-withheld records remained at issue and CMHC only maintained exemptions under subsection 20(1) (third-party information). The parties did not demonstrate that the requirements of the applied exemptions were met for some of the third-party information at issue.

The Information Commissioner ordered that CMHC disclose certain information where the parties had not demonstrated that the requirements of the exemptions were met. CMHC gave notice to the Commissioner that it would not comply with parts of the order and would apply to the Federal Court under subsection 41(2) of the Act. The complaint is well founded.

Complaint

[1] The complainant alleged that the Canada Mortgage and Housing Corporation (CMHC) had improperly withheld information under the following provisions of the Access to Information Act:

paragraph 18(a) (government financial, commercial, scientific or technical information);
paragraph 18(b) (competitive position of government institutions, negotiations by government institutions);
subsection 19(1) (personal information);
paragraph 20(1)(b) (confidential third-party financial, commercial, scientific or technical information);
paragraph 20(1)(c) (financial impact on a third party);
paragraph 20(1)(d) (negotiations by a third party);
paragraph 21(1)(a) (advice or recommendations); and
paragraph 21(1)(b) (accounts of consultations or deliberations).

[2] This was in response to an access request for all records regarding mortgage loans inadvertently insured and/or sold by the Laurentian Bank of Canada (Laurentian Bank or the bank) under its securitization program, including but not limited to information that was more particularly described (i.e. in 8 bullet points). The allegation falls under paragraph 30(1)(a) of the Act.

[3] During the investigation, the complainant decided it was no longer necessary for the Office of the Information Commissioner (OIC) to investigate CMHC’s response to portions of the request (namely, information related to bullets 2, 3, 4 and 8 of the access request text). Consequently, pages 182-197, 254-314, 319-366, 1007-1014 and 3046-3103 of the records remain within the scope of the complaint.

Investigation

[4] When an institution withholds information related to a third party, the third party and/or the institution bears the burden of showing that refusing to grant access is justified.

[5] On November 8, 2024, CMHC disclosed portions of the records, which it had withheld under multiple exemptions when it responded to the access request. CMHC continued to rely on paragraphs 20(1)(b), 20(1)(c) and 20(1)(d) to withhold portions of the records at issue. No other exemptions remain at issue, as CMHC has ceased reliance on them or they were not applied to the records that remain at issue.

[6] The OIC sought representations from the complainant, Laurentian Bank and CMHC, and I have considered the parties’ representations in coming to my conclusions.

[7] I note that the bank raised subsection 19(1) (personal information) in its representations. The only information remaining at issue that could be considered personal information is the information related to individual loans. For the reasons that follow, no examination of subsection 19(1) was required, as I find this information to be exempt under paragraph 20(1)(b).

Paragraph 20(1)(b): confidential third-party financial, commercial, scientific or technical information

[8] Paragraph 20(1)(b) requires institutions to refuse to disclose confidential financial, commercial, scientific or technical information provided to a government institution by a third party (that is, a private company or individual, but not the person who made the access request).

[9] To claim this exemption, institutions must show the following:

The information is financial, commercial, scientific or technical.
The information is confidential.
The third party supplied the information to a government institution.
The third party has consistently treated the information as confidential.

Does the information meet the requirements of the exemption?

[10] CMHC applied paragraph 20(1)(b) to all of the information that remains at issue, concurrently with paragraph 20(1)(c) and paragraph 20(1)(d).

[11] I accept that most of the information is financial, commercial and/or technical in nature, such as the raw data and review methodology. I find, however, that the parties have not established this to be true for certain information that remains withheld. The fact that a record was created within a context that may have financial or commercial implications is insufficient to establish that the entire record contains information that is financial or commercial under paragraph 20(1)(b) of the Act (Appleton & Associates v. Canada (Clerk of the Privy Council Office), 2007 FC 640, para. 26). Of the information remaining at issue, I find the following information does not meet this requirement:

the “Next Steps” section (pages 188, 197 and 1014) of CMHC’s report; and
CMHC’s observations where the information is not financial or technical in nature (pages 185, 188, 196, 1014).

[12] Laurentian Bank asserted that disclosure of the portfolio summaries would “reveal Laurentian practices and processes, including with respect to documentations, income verification and property valuation” and “the relationship and interactions between Laurentian and an industry actor acting as a quasi-regulatory body”. I note that, for the information I have found does not meet the first requirement of the exemption, the withheld information does not fall within these categories.

[13] With respect to the second requirement, that the information is objectively confidential, the information must be assessed against three conditions:

The information must not be available from sources otherwise accessible by the public.
It must originate and be communicated with a reasonable expectation that it will not be disclosed.
It must be communicated, whether required by law or otherwise, in a relationship between government and the party supplying it that is either a fiduciary relationship or one that is not contrary to the public interest. This relationship must be fostered for public benefit by the confidential communication. (see: Air Atonabee Ltd. v. Canada (Minister of Transport), [1989] F.C.J. No. 453).

[14] None of the information that remains withheld appears to be available in the public domain.

[15] During the processing of the request, Laurentian Bank indicated to CMHC that confidentiality provisions in the National Housing Act shield this information from disclosure. The OIC accepts that these provisions are indicative of Laurentian Bank’s reasonable expectation of confidentiality, however, the information can only be withheld under paragraph 20(1)(b) if all of the requirements of the exemption are met.

[16] I accept that the relationship between Laurentian Bank and CMHC is not contrary to the public interest, and I am satisfied that this relationship is fostered for the public benefit by confidential communication of information meeting all other requirements of the exemption.

[17] In light of the above, I find that the information at issue meets the second requirement of the exemption, where it also meets the other requirements of paragraph 20(1)(b).

[18] Turning to the third requirement of the exemption, I accept that some of the withheld information was supplied by Laurentian Bank to CMHC, or that disclosure would otherwise reveal information supplied by Laurentian Bank. I am not convinced, however, that all of the information that remains withheld was supplied by Laurentian Bank or that further severance is not possible to release information that does not reveal the information supplied by Laurentian Bank.

[19] The case law under paragraph 20(1)(b) has repeatedly distinguished between information supplied by a third party and independent observations made based on information that has been supplied (see, for example: Merck at paras. 152‐158; Canada (Transport) v. Air Transat A.T. Inc., 2019 FCA 286, at paras. 71-81; Hibernia Management and Development Company Ltd. v. Canada - Newfoundland and Labrador Offshore Petroleum Board, 2012 FC 417 at paras. 52-53). Much of the information within CMHC’s report consists of CMHC’s own observations and does not reveal the information the bank supplied to CMHC for the review. Consequently, I am not convinced that the following information meets this requirement:

The types of files CMHC decided to exclude from its sample (pages 183, 191, 1008);
The confidence level and margin of error (pages 183, 191, 1008);
Results of the file review where they do not reveal the information supplied by Laurentian Bank, including:
- the percentage of sampled files that were compliant/eligible, non-compliant/not eligible, supported/unsupported (pages 184-186, 188, 191, 193-196, 1009, 1011-1014);
- The titles of the results tables and the categories chosen by CMHC for the review, listed on the left side of the tables (pages 184, 187, 192, 195, 1010, 1013);
The number of data elements reviewed (pages 186, 194, 1012); and
CMHC’s observations where they do not reveal the information supplied by Laurentian Bank (pages 185, 188, 196, 1014);
The “Next Steps” section (pages 188, 197 and 1014) of CMHC’s report.

[20] The information within CMHC’s reports that does meet the requirement of being supplied by the bank is limited to:

The results broken down by specific categories, (pages 184, 187, 192, 195, 1010, 1013);
Details relating to specific bank products (pages 185, 188, 196, 1014); and
Details of the type of proof required by the bank (pages 185, 188, 196, 1014).

[21] I am satisfied that Laurentian Bank has consistently treated the information that remains at issue as confidential, so as to meet the final requirement of the exemption.

[22] I conclude that the information remaining at issue meets the requirements of paragraph 20(1)(b), with the exception of the information that is not financial, commercial and/or technical in nature and was not supplied by a third party, as outlined above, on pages 183-188, 191-197, 1008-1014.

[23] Where the information meets the requirements of paragraph 20(1)(b), I did not examine the other exemptions CMHC applied to the same information, which includes the information related to individual loans and the decision trees which reveal information about the bank’s internal processes.

Paragraph 20(1)(c): financial impact on a third party

[24] Paragraph 20(1)(c) requires institutions to refuse to disclose information that, if disclosed, could reasonably be expected to have a material financial impact on a third party (that is, a private company or individual, but not the person who made the access request) or harm its competitive position.

[25] To claim this exemption with regard to financial impact on a third party, institutions must show the following:

Disclosing the information could result in material financial loss or gain to the third party.
There is a reasonable expectation that this harm could occur—that is, the expectation is well beyond a mere possibility.

[26] To claim this exemption with regard to competitive position, institutions must show the following:

Disclosing the information could injure the competitive position of the third party.
There is a reasonable expectation that this prejudice could occur—that is, the expectation is well beyond a mere possibility.

Does the information meet the requirements of the exemption?

[27] CMHC applied paragraph 20(1)(c), concurrently with paragraph 20(1)(b) and paragraph 20(1)(d), to withhold the information that remains at issue.

[28] In its representations, Laurentian Bank identified harms that could result from disclosure of the information:

financial harm via effects on public and customer confidence;
confusion, misunderstanding and misleading conclusions in the industry and media;
mischaracterization of data by competitors to bolster their own market position; and
usage of data by competitors to benchmark or improve their processes, without Laurentian Bank gaining access to similar information of its competitors.

[29] Since I have already found that certain information meets the requirements of paragraph 20(1)(b), including Laurentian Bank’s internal policies, procedures and client information, it is not necessary to consider how disclosure of such information could result in harm to Laurentian Bank.

[30] With respect to the balance of the information, I am not convinced that the requirements of paragraph 20(1)(c) are met.

[31] Paragraph 20(1)(c) requires evidence showing the financial impact disclosing the information could have on a third party and its competitive position, and how likely that impact would be. The parties must demonstrate a clear and direct connection between the disclosure of specific information and a risk of harm well beyond the merely possible (see: Merck at paras. 197, 206).

[32] The bank’s representations on paragraph 20(1)(c) focus mainly on information I have already found to be exempt under paragraph 20(1)(b). The bank raised the issue of public misunderstanding more generally, which could apply to the information I have found was not supplied by the bank (CMHC’s work product). The Supreme Court has held that decision makers should be sceptical about claims that the public misunderstanding of disclosed information will inflict harm on third parties, and that refusing to disclose information for this reason would undermine the purpose of access to information legislation (see: Merck at para. 224).

[33] Additionally, any link to the identified harms would seem to be diminished by the public availability of some of the information. Although Laurentian Bank indicated that the information the bank made available drew significant media and market attention, the bank provided no evidence to demonstrate that this negative attention resulted in material financial harm to the bank or harm to the bank’s competitive position, despite the OIC raising this point with the bank.

[34] Beyond stating that the information meets the requirements of paragraph 20(1)(c), CMHC made no representations supporting the application of this exemption. Although CMHC made representations as to how disclosure could harm CMHC, paragraph 20(1)(c) protects third parties from financial harm, not government institutions.

[35] I conclude that the information does not meet the requirements of paragraph 20(1)(c).

Paragraph 20(1)(d): negotiations by a third party

[36] Paragraph 20(1)(d) requires institutions to refuse to disclose information that, if disclosed, could reasonably be expected to interfere with the contractual or other negotiations of a third party (that is, a private company or individual, but not the person who made the access request).

[37] To claim this exemption, institutions must show the following:

A third party is or will be conducting contractual or other negotiations.
Disclosing the information could interfere with those negotiations.
There is a reasonable expectation that this harm could occur—that is, the expectation is well beyond a mere possibility.

Does the information meet the requirements of the exemption?

[38] CMHC applied paragraph 20(1)(d), concurrently with paragraphs 20(1)(b) and 20(1)(c), to withhold the information that remains at issue.

[39] Since I have already found that certain information meets the requirements of paragraph 20(1)(b), including Laurentian Bank’s internal policies, procedures, client information, it is not necessary to consider how disclosure of such information could result in harm to Laurentian Bank.

[40] With respect to the balance of the information, I am not convinced that the requirements of paragraph 20(1)(d) are met.

[41] Based on Laurentian Bank’s representations, I am satisfied that the bank has ongoing contractual negotiations which could be relevant to the information at issue. In particular, the bank indicated that it “is engaged on an ongoing basis in multiple contractual negotiations, at a customer/mortgage level, regarding securitizations, with business partners and shareholders” and that disclosure would risk obstruction of its due diligence and negotiation process.

[42] Interference, in the context of paragraph 20(1)(d), has been interpreted by the courts as meaning “obstruction” – as indicated by the corresponding word for interference in the French version, “entraver”. (see Blood Band v. Canada (Minister of Indian Affairs and Northern Development), 2003 FC 1397, para. 49; Canada (Information Commissioner) v. Canada (Minister of External Affairs), [1990] 3 F.C. 665 (F.C.T.D.), paras. 24-25).

[43] Beyond stating that the information meets the requirements of paragraph 20(1)(d), CMHC made no representations supporting the application of this exemption.

[44] Laurentian Bank’s representations do not identify any specific information the disclosure of which could obstruct the identified negotiations or explain the link between this information and the harm to negotiations. With only CMHC’s work product remaining at issue, I find that neither CMHC nor the bank have provided sufficient representations to explain how disclosure of this information could reasonably be expected to result in harm to the bank’s negotiations.

[45] I conclude that the information does not meet the requirements of paragraph 20(1)(d).

Outcome

[46] The complaint is well founded.

Order

I order the President of CMHC to disclose the following information not supplied by a third party on pages 183-188, 191-197, 1008-1014:

the types of files CMHC decided to exclude from its sample;
the confidence level and margin of error of the sample chosen by CMHC;
the results of the file review where they do not reveal information supplied by Laurentian Bank;
The number of data elements reviewed;
CMHC’s observations where they do not reveal information supplied by Laurentian Bank; and
The next steps listed in CMHC’s report.

Initial report and notice from institution

On March 20, 2025, I issued my initial report to the President setting out my orders.

On April 24, 2025, CMHC’s Access to Information and Privacy Coordinator gave me notice that CMHC would not be implementing the order. CMHC indicated it can only implement parts 1 and 2 of my order. CMHC indicated that it cannot or can only partially implement parts 3, 4, 5 and 6 of my order. CMHC maintains that some of the information I am ordering disclosed is exempt from disclosure under paragraphs 20(1)(b), 20(1)(c) and 20(1)(d) and indicated that it intends to apply to the Federal Court, in accordance with subsection 41(2) of the Act.

Review by Federal Court

When an allegation in a complaint falls under paragraph 30(1)(a), (b), (c), (d), (d.1) or (e) of the Act, the complainant has the right to apply to the Federal Court for a review. When the Information Commissioner makes an order(s), the institution also has the right to apply for a review. The complainant and/or institution must apply for a review within 35 business days after the date of this report. When they do not, third parties may apply for a review within the next 10 business days. Whoever applies for a review must serve a copy of the application for review to the relevant parties, as per section 43. If no one applies for a review by these deadlines, the order(s) takes effect on the 46th business day after the date of this report.

Other recipient of final report

As required by subsection 37(2), this report was provided to Laurentian Bank.