Canada Revenue Agency (Re), 2025 OIC 5

Date: 2025-02-11
OIC file number: 5823-02877
Access request number: A-2023-170226

Summary

The complainant alleged that Canada Revenue Agency (CRA) had improperly withheld information under subsection 19(1) (personal information) of the Access to Information Act. This was in response to a request for time sheets of CRA employees from April 19 – May 3, 2023. The allegation falls within paragraph 30(1)(a) of the Act.

CRA showed that the time span of the information requested coincided with the period of the Public Service Alliance of Canada labour strike. As a result, the release of the User ID and PRI, if disclosed alongside the other time sheet information, would reveal an employee’s personal choice to either participate in the strike or cross the picket line.

CRA was not able to demonstrate that that there is a serious possibility that disclosing the remaining time sheet information would lead to the identification of the individuals to whom the information relates.

The Information Commissioner ordered that CRA disclose the information that does not meet the requirements of 19(1).

CRA gave notice to the Commissioner that it would partially implement the order.

The complaint is well founded.

Complaint

[1]        The complainant alleged that the Canada Revenue Agency (CRA) had improperly withheld information under subsection 19(1) (personal information) of the Access to Information Act. This was in response to a request for time sheets of CRA employees from April 19 – May 3, 2023. The allegation falls within paragraph 30(1)(a) of the Act.

Investigation

[2]        When an institution withholds information under an exemption, it bears the burden of showing that refusing to grant access is justified.

Subsection 19(1): personal information

[3]        Subsection 19(1) requires institutions to refuse to disclose personal information.

[4]        To claim this exemption, institutions must show the following:

• The information is about an individual—that is, a human being, not a corporation.
• There is a serious possibility that disclosing the information would identify that individual.
• The information does not fall under one of the exceptions to the definition of “personal information” set out in paragraphs 3(j) to 3(m) of the Privacy Act (for example, business contact information for public servants).

[5]        When these requirements are met, institutions must then consider whether the following circumstances (listed in subsection 19(2)) exist:

• The person to whom the information relates consents to its disclosure.
• The information is publicly available.
• Disclosure of the information would be consistent with section 8 of the Privacy Act.

[6]        When one or more of these circumstances exist, subsection 19(2) of the Access to Information Act requires them to reasonably exercise their discretion to decide whether to disclose the information.

Does the information meet the requirements of the exemption?

[7]        CRA applied subsection 19(1) to withhold employee time sheets for the period of April 19 – May 3, 2023 in their entirety. The fields contained on the timesheets include the following:

• User ID
• PRI
• Date
• Att / Abs type
• Att/Abs text
• Company
• Status
• Hours

[8]        Employee time sheets may, in some circumstances, fall under the exception to the definition of personal information set out in paragraph 3(j) of the Privacy Act, as they contain information about individuals who are or were officers or employees of a government institution that relate to the position or functions of those individuals.  However, in this case, the time span of the information requested coincides with the period of the Public Service Alliance of Canada labour strike. As a result, I accept that the release of the User ID and PRI, if disclosed alongside the other time sheet information, would reveal an employee’s personal choice to either participate in the strike or cross the picket line. This decision does not relate to the position or function of that individual and therefore, does not fall under the exception found at paragraph 3(j).

[9]        Turning to the remaining time sheet information (Date, Att/Abs type, Att/Abs text, Company, Status, Hours), CRA argued that, by comparing the timesheet data against a log of individuals who were present at the picket line for each day of the strike, there is a strong possibility that one could make assumptions as to who did and did not cross the picket line during the strike.

[10]      The Federal Court in Gordon v Canada (Health), 2008 FC 258 (Gordon), at paragraph 34 held that:

Information will be about an identifiable individual where there is a serious possibility that an individual could be identified through the use of that information, alone or in combination with other available information.

[11]      In John Howard Society of Canada v. Canada (Public Safety), 2022 FC 1459 (John Howard), the Federal Court highlighted the importance of evidence in demonstrating the serious possibility of identification. Relying on Gordon, the court in John Howard found that evidence which is speculative and lacking concreteness was insufficient to meet the requirements of subsection 19(1).

[12]      For the reasons that follow, I am not convinced that there is a serious possibility that disclosing the remaining time sheet information would lead to the identification of the individuals to whom the information relates.

[13]      Firstly, CRA’s evidence is entirely speculative. CRA argued that there is a strong possibility that one could make assumptions as to who did and did not cross the picket line during the labour strike by comparing the time sheet data against the strike log and engaging in a “process of elimination”. CRA, however, made no attempt to demonstrate the likelihood that this comparison and process of elimination analysis would result in identification. As such, it remains unclear whether or not it is even possible to engage in such an analysis of the data with the end result being the identification of individuals within the time sheet. While CRA is not required to show conclusively such an analysis would result in identification, CRA must do more than simply assert that there is a strong possibility that an individual could “make assumptions”.

[14]      Secondly, the log relates to 1300 employees. This alone greatly decreases the possibility that any one employee could be identified with any sort of precision.

[15]      Finally, during the specified time period, employees may have been absent from work for any variety of reasons (unpaid leave per the strike, vacation, sick time, long term leave etc), but, nonetheless, not present at the picket line. Therefore, the employee’s absence or presence at the picket line is not determinative of their status that day, further obfuscating any attempt to engage in an accurate comparison analysis.

[16]      For these reasons, it is my view that CRA’s assertion that an individual will be able to make assumptions about which time sheet data relates to which individual “is at most a mere possibility and not a serious possibility.” (John Howard at para. 69)

[17]      Prior to issuing an order in respect of the information in question, I consulted the Office of the Privacy Commissioner (OPC) in accordance with section 36.2 of the Act. The OPC agreed with my assessment, indicating “that, based on the fact that there are over 1300 employee records that are responsive to the request, and as previously noted, with the User ID and PRI removed…we see no indication that there would exist a “serious possibility” that an individual could be identified based on the release of the remaining data fields.”

[18]      As a result, I conclude that some of the withheld information (Date, Att/Abs type, Att/Abs text, Company, Status, Hours) does not meet the requirements of subsection 19(1).

Did the institution reasonably exercise its discretion to decide whether to disclose the information?

[19]      For the information that meets the requirements of subsection 19(1), CRA was required to reasonably exercise its discretion under subsection 19(2) to decide whether to disclose the information when one or more of the circumstances described in subsection 19(2) existed when it responded to the access request.

[20]      CRA confirmed that the circumstances set out in paragraph 19(2) did not exist at the time the request was processed. Given the number of individuals at issue, I accept that it would not have been reasonable for CRA to seek consent to disclose, and the information is not publicly available. CRA also demonstrated that disclosure of the information would not have been consistent with section 8 of the Privacy Act.

[21]      I conclude that none of the circumstances set out in subsection 19(2) that would permit the disclosure of personal information existed. 

Outcome

[22]      The complaint is well founded.

Order

I order the Minister of National Revenue to do the following:

• Disclose all redacted information that does not meet the requirements of subsection 19(1) as described in my final report.

Initial report and notice from institution

On December 13, 2023, I issued my initial report to the Minister of National Revenue setting out my order.

On January 9, 2025, the Director of the Access to Information and Privacy Directorate gave me notice that they would partially be implementing the order. The Director asserted there was certain information, which had not been brought to the OIC’s attention during the investigation, that ought to remain withheld under subsection 19(1). Specifically, the Director indicated that they would not disclose information associated with leave codes that had been used by fewer than 10 employees.

I remind the Minister that, if they do not intend to fully implement my order they must apply to the Federal Court for a review by the deadline set out below.

Review by Federal Court

When an allegation in a complaint falls under paragraph 30(1)(a), (b), (c), (d), (d.1) or (e) of the Act, the complainant has the right to apply to the Federal Court for a review. When the Information Commissioner makes an order(s), the institution also has the right to apply for a review. The complainant and/or institution must apply for a review within 35 business days after the date of this report. When they do not, the Privacy Commissioner may apply for a review within the next 10 business days. Whoever applies for a review must serve a copy of the application for review to the relevant parties, as per section 43. If no one applies for a review by these deadlines, the order(s) takes effect on the 46th business day after the date of this report.

Other recipients of final report

As required by subsection 37(2), this report was provided to the Privacy Commissioner of Canada.