Canadian Broadcasting Corporation (Re), 2025 OIC 15
Date: 2025-03-06
OIC file number: 5823-02070
Access request number: A-2023-00019
Summary
The complainant alleged that the Canadian Broadcasting Corporation (CBC) had improperly withheld information under section 17 (safety of individuals) and subsection 19(1) (personal information) of the Access to Information Act in response to an access request. The request was for all communications between specific CBC and Twitter employees since January 1, 2018, which was prior to Twitter becoming X. The allegation falls under paragraph 30(1)(a) of the Act.
During the investigation, the CBC disclosed some of the information it had withheld under subsection 19(1) and section 17 but also applied subsection 16(2) (facilitating the commission of an offence) to some of the remaining information withheld under section 17. The Commissioner concluded that this information did not meet the requirements of either subsection 16(2) or section 17.
The CBC argued that disclosing the name and contact information of a member of its information security team would facilitate the commission of an offence by making it possible for hackers to access CBC computer systems. However, the CBC did not show how disclosing the information would reasonably be expected to lead to this result. In addition, the employee’s name and contact information were already available on LinkedIn and elsewhere online.
The CBC also withheld the names and Twitter handles of several CBC journalists who were the subject of online posts the CBC had identified as instances of harassment and requested to be taken down, although it disclosed the content of the posts themselves during the investigation. The CBC argued that also disclosing the identifying information of journalists who were calling out online harassment could lead to these individuals’ being subject to retaliatory online attacks, resulting in psychological harm.
The Commissioner found that the threats to individuals’ safety envisioned under section 17 could include psychological harm. Nonetheless, she concluded that, in this case, the CBC neither showed that the harm went beyond distress nor addressed the reasonable expectation of the harm occurring if the information were disclosed.
The Commissioner ordered the CBC to disclose the information withheld under subsection 16(2) and section 17. The CBC gave notice to the Commissioner that it would implement the order.
The complaint is well founded.
Complaint
[1] The complainant alleged that the Canadian Broadcasting Corporation (CBC) had improperly withheld information under the following provisions of the Access to Information Act in response to an access request:
- section 17 (safety of individuals); and
- subsection 19(1) (personal information)
[2] The allegation falls under paragraph 30(1)(a) of the Act.
[3] The request was for all communications between specific CBC employees and Twitter employees, since January 1, 2018.
Investigation
[4] When an institution withholds information under an exemption, it bears the burden of showing that refusing to grant access is justified.
[5] During the investigation, CBC decided to also rely on subsection 16(2) (facilitating the commission of an offence) to withhold some of the information already withheld under section 17.
[6] On August 1, 2024, CBC provided a supplementary disclosure, releasing information that had been withheld under section 17 and subsection 19(1) at the time CBC responded to the access request. CBC continued to withhold certain individuals’ names, contact information and Twitter handles under subsection 16(2), section 17 and subsection 19(1). The complainant informed the Office of the Information Commissioner (OIC) that they were not satisfied with the supplementary disclosure and requested that the OIC continue the investigation into the information that remained withheld under subsection 16(2) and section 17.
Subsection 16(2): facilitating the commission of an offence
[7] Subsection 16(2) allows institutions to refuse to disclose information that, if disclosed, could reasonably be expected to facilitate the commission of an offence.
[8] To claim this exemption, institutions must show the following:
- Disclosing the information (for example, information on criminal methods or techniques, or technical details of weapons, as set out in paragraphs 16(2)(a) to (c)) could facilitate the commission of an offence.
- There is a reasonable expectation that this harm could occur—that is, the expectation is well beyond a mere possibility.
[9] When these requirements are met, institutions must then reasonably exercise their discretion to decide whether to disclose the information.
Does the information meet the requirements of the exemption?
[10] During the investigation, CBC applied subsection 16(2) to withhold the name and contact information of a specific CBC employee on every page of the responsive records where it appeared. This information was concurrently withheld under section 17.
[11] CBC claimed that releasing this information would facilitate the commission of an offence against several of CBC’s critical systems, as well as against the methods employed to protect them. CBC based its claim on the fact that this employee has a specific role in the information security team and Managing Data Center for CBC, with access to CBC’s critical technology system and security gateway. Compromising this gateway through this employee’s account could allow someone to gain administrative access to the critical system and to sabotage it, or to disrupt email delivery for the entire organization.
[12] CBC added that because of the ongoing cybersecurity threats that affect its resources on an everyday basis, CBC needs to protect them as best as possible by withholding this information.
[13] Ultimately, CBC’s argument rests on the premise that knowing the identity of this particular employee would facilitate attacks against its IT systems. While CBC’s evidence supports that such attacks do take place, for the reasons that follow, I find that CBC has failed to demonstrate the necessary clear and direct linkage between disclosure of the information and the resulting alleged harm.
[14] First, CBC did not clearly explain how an individual in possession of the information at issue could use it to access their account inside CBC’s system and perpetrate an offense.
[15] Additionally, several other CBC employees have their name or contact information disclosed in the responsive records. It remains unclear how the accounts of these employees to whom the disclosed information relates would not be affected by the threats described by CBC, or how the account of the employee to whom the information at issue relates would be particularly vulnerable to threats compared to other employees’ accounts.
[16] Finally, in the course of the investigation, the OIC brought to CBC’s attention that some of the information for this CBC employee was publicly available on online platforms, such as LinkedIn or RocketReach. It appears that this employee was not constrained from publicly sharing this information. CBC failed to reconcile this with its assertion that this same information rendered CBC’s IT systems more vulnerable to attacks. CBC, in its representations, did not demonstrate that the harm was reasonably expected to occur.
[17] In light of the above, I conclude that the information does not meet the requirements of subsection 16(2).
[18] Since the information does not meet the requirements of subsection 16(2), I also examined whether the CBC had properly applied section 17 to the same information.
Section 17: safety of individuals
[19] Section 17 allows institutions to refuse to disclose information that, if disclosed, could reasonably be expected to threaten an individual’s safety.
[20] To claim this exemption, institutions must show the following:
- Disclosing the information could threaten the safety or health of an individual.
- There is a reasonable expectation that this harm could occur—that is, the expectation is well beyond a mere possibility.
[21] When these requirements are met, institutions must then reasonably exercise their discretion to decide whether to disclose the information.
Does the information meet the requirements of the exemption?
CBC applied section 17 to withhold the names and Twitter (now X) handles of several CBC journalists, as well as the title and contact information of one of the journalists.
[22] CBC also withheld information of a specific employee who is not a journalist.
[23] Regarding the information that relates to CBC journalists:
[24] During the course of the investigation, CBC reviewed its exercise of discretion and disclosed portions of the records previously withheld under section 17, including Twitter posts and comments, several individuals’ Twitter handles or profile pictures, as well as URLs. On these records, only the names and Twitter handles of CBC’s journalists remain withheld.
[25] CBC asserted that disclosure of the withheld information could result in online harassment targeting these CBC journalists, which in turn, could cause psychological harm to said journalists and, for this reason, the information warrants exemption under section 17. CBC provided examples of previous occurrences of harassment to illustrate this situation.
[26] CBC argued that in defining “safety” for the purposes of section 17, it is understood to include psychological as well as physical well-being. CBC referred to the Government of Canada’s definition of a psychologically healthy and safe workplace to reinforce its position that an individual’s mental well-being is as much a matter of safety in the workplace as their physical well-being.
[27] Turning to the information at issue, while the tweets - and therefore the identity of the CBC journalists who were named in the tweets - were at one time publicly available, CBC explained that disclosure in the context of these records would reveal that these tweets were identified by either the journalists themselves or other employees working at CBC as being specific examples of online harassment. CBC argued that disclosing the identity of CBC journalists who were calling out online harassment would increase the likelihood that these individuals would receive retaliatory online harassment and communications, therefore threatening their safety.
[28] That being said, CBC decided to provide the complainant with a supplementary response during the course of the investigation. CBC’s supplementary disclosure is inconsistent with their assertion that disclosure of the identities of the journalists who were the target of these tweets threatens the safety of these individuals. The content disclosed by CBC was already publicly available and could easily identify the journalists involved, using their profile picture and/or a combination of other elements such as the date of the posts or information contained within comments on the posts. The disclosed URLs also point directly to the remaining withheld information. CBC failed to address how the supplementary release was consistent with the rationale supporting its application of section 17.
[29] CBC added that there is an ongoing pattern where public conversations focused on raising awareness about online harassment of journalists prompt further online harassment in the form of personal, violent, racist or sexist comments, and provided examples to the OIC of such behaviour.
[30] CBC also relied on an academic study (Magdalena Celuch et al., “Online Harassment and Hate Among Media Professionals: Reactions to One’s Own and Others’ Victimization,” Journalism and Mass Communication Quarterly, Vol. 100(3): (Online, January 27, 2023)) to support its claim that online harassment was causing real harm to its employees. CBC argued that the study demonstrated:
- firstly, that journalists and other media professionals are at heightened risk for online harassment just by the very nature of their job; and
- secondly, that such harassment is even more likely when journalists engage with specific comments or commentators online.
[31] While section 17 of the Act has received little judicial treatment, corresponding provisions in the Ontario Freedom of Information and Protection of Privacy Act have been considered by the courts, including by the Supreme Court of Canada. In Ontario (Community Safety and Correctional Services) v. Ontario (Information and Privacy Commissioner), 2014 SCC 31, the court confirmed that in regards to an exemption meant to protect against harm to an individual, the correct test to apply is the "reasonable expectation of probable harm" test as set out in Merck Frosst Canada Ltd. v. Canada (Health), 2012 SCC 3.
[32] This standard was applied by the Federal Court in Martin v. Canada (Health), 2016 FC 796, where the Federal Court held that “[i]n order to rely on the exemption contained under section 17, the party resisting disclosure must be able to demonstrate a direct link between disclosure of the documents and the alleged harm with detailed and convincing evidence in order to establish that these outcomes are reasonably probable”.
[33] Thus, CBC had to demonstrate a risk of harm that is well beyond the merely possible or speculative although it need not prove that disclosure will in fact result in such harm. The evidence must demonstrate a clear and direct connection between the disclosure of the specific information and the harm alleged. An individual’s subjective fear, while relevant, may not be enough to justify the exemption (for example, see Order of the Ontario Information and Privacy Commissioner, Order PO-2003).
[34] Regarding the types of harms that are encompassed within section 17, I agree with CBC’s position that psychological harm may meet the requirements of this exemption. Further to CBC’s submissions, I note that this position is consistent with the position taken by the Treasury Board Secretariat (TBS). The TBS Manual indicates that “[t]he types of individual safety interests that could be threatened are relatively broad ... and may also include psychological injury.” I further note that the TBS Manual goes on to specify that: “Psychological injury is more than the causing of distress. It implies that disclosure might lead to or exacerbate an existing mental illness or psychological disorder or cause a person to become suicidal. For example, the disclosure of police photographs of a particularly gruesome murder scene may threaten the mental health of the deceased’s widow or widower who is already suffering from depression, even if the murder happened more than 20 years ago.”
[35] However, while I agree that psychological harms may be included within this exemption, the harm must be serious and go beyond distress. In this instance, CBC relies on an academic article that references other studies regarding the impacts of online harassment, as well as several online sources which discuss the harms of cyberbullying and online harassment.
[36] After reviewing the study in question, I note that while it does provide context about the impact of online harassment on journalists, the authors themselves noted that any generalizations beyond a Finnish context should be approached with caution, and that there are important cross-cultural differences in how online harassment is experienced and handled by journalists.
[37] While I accept that CBC provided general evidence showing that online harassment may result in serious psychological harms for some individuals, I find that CBC has failed to address the likelihood of those harms manifesting in this particular instance. Since CBC didn’t provide any other specific representations, general assertions of harms are insufficient to accept the application of section 17.
Regarding the information related to a CBC employee who is not a journalist:
[38] CBC applied section 17 to withhold the same information for which I have already concluded that paragraph 16(2) does not apply.
[39] CBC explained that in addition to the general representations applicable to every individual whose information has been withheld under section 17, this employee has a sensitive role in the information security team and Managing Data Center for CBC. In this role, this employee handles all takedown requests for hateful messages on social media. According to CBC, this, in turn, increases the likelihood they would become a target of online harassment by people whose messages have been taken down or blocked from the accounts of CBC/Radio-Canada’s journalists, members of the Senior Executive team, lawyers, etc.
[40] CBC also explained that the decision to withhold the information related to this employee, even though this information is publicly available, was based on the individual’s own request to have it protected.
[41] CBC added that it was not unreasonable to infer that the individuals prone to sending hateful and harassing messages were more likely to direct their violence and attacks towards a specific person who would appear to be responsible for their messages being taken down.
[42] CBC did not, however, reconcile its decision to withhold this information under section 17 with its decision to disclose the identities of other CBC employees involved in identifying and requesting the removal of tweets. Although asked, CBC failed to explain why the safety of these other individuals would not be equally at risk. I find that absent a convincing explanation, this undercuts CBC’s assertion that disclosure could reasonably be expected to threaten the safety of this one employee and not others.
[43] Additionally, unlike CBC journalists who are actively involved in preparing and presenting journalistic work, this employee appears less likely to attract negative attention as they don’t actively engage with the public on social media platforms for the purpose of their work.
[44] Therefore, CBC failed to demonstrate that disclosing the employee’s identity, in this specific context, could reasonably be expected to lead to online harassment.
[45] In light of the above, I am of the view that CBC has not demonstrated how the disclosure of the information relating to this specific employee could reasonably be expected to threaten the safety or health of the employee.
[46] I conclude that none of the withheld information meets the requirements of section 17.
Outcome
[47] The complaint is well founded:
- The information does not meet the requirements of subsection 16(2).
- The information does not meet the requirements of section 17.
Orders
I order the President of the Canadian Broadcasting Corporation to disclose the information withheld under subsection 16(2) and section 17. The information that must be disclosed can be found on pages 5, 8 to 10, 13 to 15, 17 to 22, 24 to 26, and 28.
Initial report and notice from institution
On January 24, 2025, I issued my initial report to the President setting out my order.
On February 18, 2025, the Director of Access to Information and Privacy gave me notice that CBC would be implementing the order.
Review by Federal Court
When an allegation in a complaint falls under paragraph 30(1)(a), (b), (c), (d), (d.1) or (e) of the Act, the complainant has the right to apply to the Federal Court for a review. When the Information Commissioner makes an order(s), the institution also has the right to apply for a review. Whoever applies for a review must do so within 35 business days after the date of this report and serve a copy of the application for review to the relevant parties, as per section 43. If no one applies for a review by this deadline, the order(s) takes effect on the 36th business day after the date of this report.