Privy Council Office (Re), 2026 OIC 28

Date: 2026-03-02
OIC file number: 5824-01081
Access request number: A-2023-00788

Summary

The complainant alleged that the Privy Council Office (PCO) had improperly withheld information under subsection 16(2) (facilitating the commission of an offence) and subsection 19(1) (personal information) of the Access to Information Act. This was in response to an access request for “all records concerning Clerk John Hannaford's meeting with the official languages commissioner …”.

PCO did not demonstrate that the information exempt under subsection 19(1), that is, one signature and two initials, met the requirements of the exemption - in particular why the information would not be excluded from the definition of personal information by virtue of paragraph 3(j) of the Privacy Act. The Office of the Information Commissioner (OIC) consulted with the Office of the Privacy Commissioner (OPC), who concurred that the exemption had not been properly applied. The OIC informed PCO of the results of the OPC consultation, asking PCO officials if they wished to release the information, rather than proceeding with an order. PCO did not respond. The Information Commissioner ordered PCO to disclose the information. PCO gave notice to the Commissioner that it maintained its disagreement with the Commissioner’s position but would release the information because it had received the consent of the two individuals.

Complaint

[1]The complainant alleged that the Privy Council Office (PCO) had improperly withheld information under subsection 16(2) (facilitating the commission of an offence) and subsection 19(1) (personal information) of the Access to Information Act in response to an access request. The request was for “all records concerning Clerk John Hannaford's meeting with the official languages commissioner …”. The allegation falls under paragraph 30(1)(a) of the Act.

Investigation

[2]When an institution withholds information under an exemption, it bears the burden of showing that refusing to grant access is justified.

[3]An analysis of the exemptions applied follows.

Subsection 16(2): facilitating the commission of an offence

[4]Subsection 16(2) allows institutions to refuse to disclose information that, if disclosed, could reasonably be expected to facilitate the commission of an offence.

[5]To claim this exemption, institutions must show the following:

• Disclosing the information (for example, information on criminal methods or techniques, or technical details of weapons, as set out in paragraphs 16(2)(a) to (c)) could facilitate the commission of an offence.
• There is a reasonable expectation that this harm could occur—that is, the expectation is well beyond a mere possibility.

[6]When these requirements are met, institutions must then reasonably exercise their discretion to decide whether to disclose the information.

Does the information meet the requirements of the exemption?

[7]PCO maintains the application of subsection 16(2) to a phone number on page 26 of the responsive records.

[8]The complainant argued that public servant phone numbers are a public good and are available online, so this phone number should be released in the relevant records.

[9]During the investigation, PCO was of the position that the disclosure of the phone number would facilitate the commission of an offence. In support of its position, PCO represented that, given the number of cyber incidents that have risen significantly over the last two decades, the potential to disrupt an organization’s business is high; that the interest to exploit such vulnerabilities is very real, and the realization of such exploitation is an equally real possibility that has become increasingly evident; and that a government issued cell phone contains government information on the device and could be at risk of cyber-attack thus giving valid reason to protecting the number under subsection 16(2).

[10]To further support their position, PCO provided my office with information regarding how with nothing more than the phone number itself cell phones may be easily accessible to and spied upon by hackers.

[11]The OIC understands that, due to the sensitive subject matter that some public servants work on, sometimes their phone numbers are not publicly available. This is the case with this specific individual’s phone number, which is not located within the Government of Canada’s Directory online.

[12]In light of the above, I conclude that the information meets the requirements of subsection 16(2).

Did the institution reasonably exercise its discretion to decide whether to disclose the information?

[13]Since the withheld information regarding meets the requirements of subsection 16(2), PCO was required to reasonably exercise its discretion to decide whether to disclose the information. In doing so, PCO had to consider all the relevant factors for and against disclosure.

[14]PCO provided representations regarding the factors considered during the exercise of discretion, including the sensitivity of the information and how it could be reasonably expected that harm could occur should the information be shared. Ultimately, they determined that disclosure of the information would be more harmful than the benefit of its release.

[15]In light of the above, I conclude that PCO considered all relevant factors when it decided not to disclose the information. The exercise of discretion by PCO was reasonable.

Subsection 19(1): personal information

[16]Subsection 19(1) requires institutions to refuse to disclose personal information.

[17]To claim this exemption, institutions must show the following:

• The information is about an individual—that is, a human being, not a corporation.
• There is a serious possibility that disclosing the information would identify that individual.
• The information does not fall under one of the exceptions to the definition of “personal information” set out in paragraphs 3(j) to 3(m) of the Privacy Act (for example, business contact information for public servants).

[18]When these requirements are met, institutions must then consider whether the following circumstances (listed in subsection 19(2)) exist:

• The person to whom the information relates consents to its disclosure.
• The information is publicly available.
• Disclosure of the information would be consistent with section 8 of the Privacy Act.

[19]When one or more of these circumstances exist, subsection 19(2) of the Access to Information Act requires institutions to reasonably exercise their discretion to decide whether to disclose the information.

Does the information meet the requirements of the exemption?

[20]PCO maintains the application of subsection 19(1) to one signature on page 10 of the working copy of the relevant records, and to two initials on page 28 of the working copy of the relevant records.

[21]At the outset of the investigation, my office was of the preliminary view that the signature of an officer or employee is excluded from the definition of personal information by virtue of paragraph 3(j) of the Privacy Act if, for example, the signature of the officer or employee was required to demonstrate the validity of the document or to attest the approval of an expenditure. In such instances, the inclusion of a signature reflects a high degree of accountability and transparency.

[22]In the present case, the redacted signature on page 10 was used to sign off on a briefing note, while the two initials on page 28 were used on a transmittal slip—both of which are documents that serve to demonstrate official action and responsibility. These are clear indicators of work-related functions being exercised, possibly under a delegation of authority.

[23]PCO noted that public servants’ signatures accompanied by signature blocks would typically constitute personal information under section 3 of the Privacy Act and should not generally be disclosed under subsection 19(1). However, my office emphasized that section 3 of the Privacy Act is subject to exceptions, notably paragraph 3(j), and in particular, subparagraph 3(j)(iv). This provision states that information about a public servant that relates to their position or functions is not considered personal information. This exception must be evaluated on a case-by-case basis. In the present instance, the signature and the two initials were clearly made in the course of official duties and serve a work-related, not personal, function.

[24]PCO asserted that the signatures of government employees, when not publicly available, should remain redacted under subsection 19(1). PCO further contended that while the context of the records is considered, the protection of personal information under subsection 19(1) is a mandatory exemption, limiting the scope for case-by-case discretion.

[25]My office was not persuaded that PCO fully considered the purpose of the signature and the two initials on the documents. The information was recorded as part of the performance of official duties, to validate the records and reflect accountability. It is my view that the more critical the function, the stronger the rationale for transparency and disclosure.

[26]Further, my office was not convinced that PCO had appropriately assessed the reasonable expectation of privacy in this context. Public servants regularly sign documents as part of their official duties, including documents addressed to external parties, such as members of the public. It is generally understood that in doing so, there is a diminished expectation of privacy over the signature or initial. A publicly accessible search reveals that the individuals in question hold senior public roles at PCO - information that has also been disclosed as part of PCO’s response to this request.

[27]Based on the representations provided, my office was of the preliminary view that PCO had not sufficiently justified the application of subsection 19(1). Specifically, PCO had not demonstrated how disclosure of the signature and the two initials—used in the execution of official duties—would amount to an unjustified invasion of privacy, in light of the exception in paragraph 3(j) of the Privacy Act. As a result, the OIC consulted with the Office of the Privacy Commissioner (OPC), who concurred with the OIC’s position.

[28]The OIC informed PCO of the results of the OPC consultation, asking PCO if they wished to release the signature and two initials in order to resolve this allegation informally, rather than proceeding with an intended order as set out in an initial report. PCO did not respond.

[29]Based on the evidence before me, I conclude that the information does not meet the requirements of subsection 19(1).

Outcome

[30]The complaint is well founded because the information PCO withheld under subsection 19(1) does not meet the requirements of the exemption.

Orders and recommendations

I order the Clerk of the Privy Council to:

1. Disclose the information exempt under subsection 19(1) in its entirety; and
2. Provide the supplementary release to the complainant no later than 36 business days following the date of the final report.

Initial report and notice from institution

On January 21, 2026, I issued my initial report to the Clerk of the Privy Council setting out my orders.

On February 27, 2026, PCO gave me notice that it “maintains its stance that signatures and signed initials are personal information that must be redacted”. Nonetheless, PCO informed me that the two individuals who signature and signed initials are redacted gave PCO consent to release the information. PCO indicated that it would send the complainant a supplementary response.

Review by Federal Court

When an allegation in a complaint falls under paragraph 30(1)(a), (b), (c), (d), (d.1) or (e) of the Act, the complainant has the right to apply to the Federal Court for a review. When the Information Commissioner makes an order(s), the institution also has the right to apply for a review.

Whoever applies for a review must do so within 35 business days after the date of this report and serve a copy of the application for review to the relevant parties, as per section 43. If no one applies for a review by this deadline, the order(s) takes effect on the 36th business day after the date of this report.