WxT Language switcher

Health Canada (Re), 2026 OIC 36

Date: 2026-03-27
OIC file number: 5823-04320
Access request number: A-2023-000426

Summary

The complainant alleged that Health Canada had improperly withheld information under the following provisions of the Access to Information Act:

  • subsection 13(1) (confidential information from government bodies);
  • subsection 19(1) (personal information);
  • paragraph 20(1)(b) (confidential third-party financial, commercial, scientific or technical information); and
  • paragraph 20(1)(c) (financial impact on a third party).

This was in response to an access request for records related to the Periodic Safety Update Report #3 for COVID-19 Vaccine provided to the European Medical Agency (EMA) on August 18, 2022. The allegation falls under paragraph 30(1)(a) of the Act.

Health Canada and the third party did not establish how any of the information met the requirements of paragraphs 20(1)(b) or 20(1)(c), although some of the information meets the requirements of subsection 13(1) and 19(1). The Information Commissioner ordered that Health Canada disclose the information withheld under only third-party exemptions and the information withheld under subsection 13(1) that has been made public. Health Canada gave notice to the Commissioner that it would comply with the order. The complaint is well founded.

Complaint

[1]The complainant alleged that Health Canada had improperly withheld information under the following provisions of the Access to Information Act:

  • subsection 13(1) (confidential information from government bodies);
  • subsection 19(1) (personal information);
  • paragraph 20(1)(b) (confidential third-party financial, commercial, scientific or technical information); and
  • paragraph 20(1)(c) (financial impact on a third party).

[2]This was in response to an access request for records related to the Periodic Safety Update Report #3 for COVID-19 Vaccine provided to the European Medical Agency (EMA) on August 18, 2022. The allegation falls under paragraph 30(1)(a) of the Act.

[3]During the investigation, the complainant decided it was no longer necessary for the Office of the Information Commissioner (OIC) to investigate the application of subsection 19(1) to the names of individuals who were not federal government employees.

Investigation

[4]When an institution withholds information related to a third party, the third party and/or the institution bears the burden of showing that refusing to grant access is justified.

[5]I considered the representations made by the complainant, Health Canada and Pfizer in coming to my conclusions.

Subsection 13(1): confidential information from government bodies

[6]Subsection 13(1) requires institutions to refuse to disclose information obtained in confidence from certain government bodies.

[7]To claim this exemption, institutions must show the following:

  • The information was obtained from one of the following government bodies;
  • a government of a foreign state or an institution of a foreign state;
  • an international organization of states or an institution of such an organization;
  • a provincial government or institution;
  • a municipal or regional government or institution; or
  • an aboriginal government or council listed in subsection 13(3).
  • The information was obtained from the government body in confidence—that is, with the understanding that it would be treated as confidential.

[8]When these requirements are met, institutions must then consider whether the following circumstances (listed in subsection 13(2)) exist:

  • The government body from which the information was obtained consents to its disclosure.
  • That body has already made the information public.

[9]When one or both of these circumstances exist, subsection 13(2) requires institutions to reasonably exercise their discretion to decide whether to disclose the information.

Does the information meet the requirements of the exemption?

[10]Health Canada withheld certain information under subsection 13(1) where it was obtained by Health Canada from its observer sitting in on meetings of the EMA’s Pharmacovigilance Risk Assessment Committee (PRAC) meetings.

[11]I accept that the information was obtained by a government body of the type described in paragraph 13(1)(b): the EMA.

[12]Health Canada indicated that its participation in the PRAC meetings was governed by a confidentiality agreement. As such, I find that the information was obtained in confidence and therefore meets the second requirement of the exemption.

[13]I conclude that the information meets the requirements of subsection 13(1).

Did the institution reasonably exercise its discretion to decide whether to disclose the information?

[14]Since the information meets the requirements of subsection 13(1), Health Canada was required to reasonably exercise its discretion under subsection 13(2) to decide whether to disclose the information when one or both of the circumstances described in subsection 13(2) existed when it responded to the access request.

[15]Health Canada asserted that seeking consent from the EMA to release this information would not have been appropriate under the circumstances, given that a confidentiality agreement was in place.

[16]Some of the information obtained by Health Canada from the EMA’s PRAC meetings is publicly available, as the EMA publishes the minutes of the PRAC meetings. Health Canada conceded that certain information has been made public, and indicated that it is willing to exercise its discretion to release the information the EMA has made public.

[17]I conclude that the circumstances set out in paragraph 13(2)(b) existed when Health Canada responded to the access request. Health Canada was required to reasonably exercise its discretion to decide whether to disclose the information. In doing so, Health Canada had to consider all the relevant factors for and against disclosure.

[18]I conclude that Health Canada did not consider all relevant factors when it decided not to disclose the publicly available information. The exercise of discretion by Health Canada was not reasonable.

Subsection 19(1): personal information

[19]Subsection 19(1) requires institutions to refuse to disclose personal information.

[20]To claim this exemption, institutions must show the following:

  • The information is about an individual—that is, a human being, not a corporation.
  • There is a serious possibility that disclosing the information would identify that individual.
  • The information does not fall under one of the exceptions to the definition of “personal information” set out in paragraphs 3(j) to 3(m) of the Privacy Act (for example, business contact information for public servants).

[21]When these requirements are met, institutions must then consider whether the following circumstances (listed in subsection 19(2)) exist:

  • The person to whom the information relates consents to its disclosure.
  • The information is publicly available.
  • Disclosure of the information would be consistent with section 8 of the Privacy Act.

[22]When one or more of these circumstances exist, subsection 19(2) of the Access to Information Act requires institutions to reasonably exercise their discretion to decide whether to disclose the information.

Does the information meet the requirements of the exemption?

[23]Health Canada applied subsection 19(1) to information that it felt, if disclosed, would create a serious risk of identifying the individuals to whom it relates. Such information includes, for example, the age and location of individuals whose symptoms or outcome are described.

[24]I accept that this information is the personal information of individuals, and that there is a serious risk that these individuals could be identified based on the withheld information. I note that Health Canada released similar information where the risk of identification was lower, based on the amount of identifying information.

[25]I conclude that the information at issue meets the requirements of subsection 19(1).

Did the institution reasonably exercise its discretion to decide whether to disclose the information?

[26]Since the information meets the requirements of subsection 19(1), Health Canada was required to reasonably exercise its discretion under subsection 19(2) to decide whether to disclose the information when one or more of the circumstances described in subsection 19(2) existed when it responded to the access request.

[27]Health Canada provided detailed representations supporting that:

  • It would not have been reasonable to seek consent from the individuals in this case, based on the number of individuals and the difficulty in contacting them;
  • It searched for publicly available information and did not find the withheld information to be public;
  • It considered whether any public interest in disclosure would clearly outweigh the invasion of privacy of the individuals and found it did not.

[28]I conclude that the circumstances set out in subsection 19(2) did not exist when Health Canada responded to the access request. There is no need to examine the issue of discretion.

Paragraph 20(1)(b): confidential third-party financial, commercial, scientific or technical information

[29]Paragraph 20(1)(b) requires institutions to refuse to disclose confidential financial, commercial, scientific or technical information provided to a government institution by a third party (that is, a private company or individual, but not the person who made the access request).

[30]To claim this exemption, institutions must show the following:

  • The information is financial, commercial, scientific or technical.
  • The information is confidential.
  • The third party supplied the information to a government institution.
  • The third party has consistently treated the information as confidential.

Does the information meet the requirements of the exemption?

[31]Health Canada applied paragraph 20(1)(b) to withhold information related to Pfizer throughout the records, concurrently with paragraph 20(1)(c).

[32]Although I was willing to accept that some of the requirements of paragraph 20(1)(b) are met, I sought representations from the parties as to how all of the requirements of the exemption are met. Neither Health Canada nor Pfizer maintained that the exemption applies and provided no representations supporting that all of the requirements of the exemption are met.

[33]I conclude that the information does not meet the requirements of paragraph 20(1)(b).

Paragraph 20(1)(c): financial impact on a third party

[34]Paragraph 20(1)(c) requires institutions to refuse to disclose information that, if disclosed, could reasonably be expected to have a material financial impact on a third party (that is, a private company or individual, but not the person who made the access request) or harm its competitive position.

[35]To claim this exemption with regard to financial impact on a third party, institutions must show the following:

  • Disclosing the information could result in material financial loss or gain to the third party.
  • There is a reasonable expectation that this harm could occur—that is, the expectation is well beyond a mere possibility.

[36]To claim this exemption with regard to competitive position, institutions must show the following:

  • Disclosing the information could injure the competitive position of the third party.
  • There is a reasonable expectation that this prejudice could occur—that is, the expectation is well beyond a mere possibility.

Does the information meet the requirements of the exemption?

[37]Health Canada applied paragraph 20(1)(c) concurrently with paragraph 20(1)(b).

[38]Paragraph 20(1)(c) requires evidence showing the financial impact disclosing the information could have on a third party or the harm that disclosure could cause to its competitive position, and how likely that impact would be. The parties must demonstrate a clear and direct connection between the disclosure of specific information and a risk of harm well beyond the merely possible (see: Merck Frosst, paras 197, 206).

[39]Neither Health Canada nor Pfizer maintained that paragraph 20(1)(c) applies and provided no representations supporting that the requirements of the exemption are met.

[40]I conclude that the information does not meet the requirements of paragraph 20(1)(c).

Outcome

[41]The complaint is well founded.

Orders and recommendations

I order the Minister of Health to do the following:

  1. Disclose the information in full, apart where the information is withheld under subsection 13(1) or subsection 19(1); and
  2. Determine to what extent the information withheld under subsection 13(1) has been made public by the EMA and re-exercise her discretion under paragraph 13(2)(b) with consideration to the publicly available information.

Initial report and notice from institution

On February 23, 2026, I issued my initial report to the Minister of Health setting out my orders.

On March 25, 2026, the Executive Director, Access to Information and Privacy Services gave me notice that Health Canada would be implementing the orders.

Review by Federal Court

When an allegation in a complaint falls under paragraph 30(1)(a), (b), (c), (d), (d.1) or (e) of the Act, the complainant has the right to apply to the Federal Court for a review. When the Information Commissioner makes an order(s), the institution also has the right to apply for a review. The complainant and/or institution must apply for a review within 35 business days after the date of this report. When they do not, third parties may apply for a review within the next 10 business days. Whoever applies for a review must serve a copy of the application for review to the relevant parties, as per section 43. If no one applies for a review by these deadlines, the order(s) takes effect on the 46th business day after the date of this report.

Other recipients of final report

As required by subsection 37(2), this report was provided to Pfizer.

Date modified:
Submit a complaint