Shared Services Canada (Re), 2026 OIC 21
Date: 2026-02-23
OIC file number: 5823-01403
Access request number: A-2022-00274/ EB
Summary
The complainant alleged that Shared Services Canada (SSC) had improperly withheld information under subsection 19(1) (personal information), paragraph 20(1)(b) (confidential third-party financial, commercial, scientific or technical information), paragraph 20(1)(c) (financial impact on a third party) and paragraph 20(1)(d) (negotiations by a third party) of the Access to Information Act in response to an access request. The request was for the full report relating to cloud economics provided by Gartner, Inc. between July and October 2022. The allegation falls under paragraph 30(1)(a) of the Act.
Although the parties demonstrated that some of the information met the requirements of paragraph 20(1)(b), they did not establish that the remaining information met the requirements of any exemption or that no reasonable severance was possible in accordance with section 25. The Information Commissioner ordered that SSC to re-exercise discretion and to disclose specific information. SSC gave notice to the Commissioner that it would comply with the order. The complaint is well founded.
Complaint
[1]The complainant alleged that Shared Services Canada (SSC) had improperly withheld information under subsection 19(1) (personal information), paragraph 20(1)(b) (confidential third-party financial, commercial, scientific or technical information), paragraph 20(1)(c) (financial impact on a third party) and paragraph 20(1)(d) (negotiations by a third party) of the Access to Information Act in response to an access request. The request was for the full report relating to cloud economics provided by Gartner, Inc. (Gartner) between July and October 2022. The allegation falls under paragraph 30(1)(a) of the Act.
[2]During the investigation, the complainant decided it was no longer necessary for the Office of the Information Commissioner (OIC) to investigate the withholding of information under subsection 19(1).
Investigation
[3]When an institution withholds information that includes information related to a third party, the third party and/or the institution bears the burden of showing that refusing to grant access is justified.
[4]During the investigation, SSC decided to no longer rely on paragraph 20(1)(d) to withhold information, however, SSC decided also to rely on subsection 16(2) to withhold some information.
[5]The OIC sought representations from Gartner pursuant to paragraph 35(2)(c). Gartner made representations asserting that the records qualify for exemption/exclusion under paragraphs 20(1)(a), 20(1)(b), 20(1)(c) and 68(a).
[6]I considered the representations received from Gartner, SSC and the complainant in coming to my conclusions.
Subsection 16(2): facilitating the commission of an offence
[7]Subsection 16(2) allows institutions to refuse to disclose information that, if disclosed, could reasonably be expected to facilitate the commission of an offence.
[8]To claim this exemption, institutions must show the following:
- Disclosing the information (for example, information on criminal methods or techniques, or technical details of weapons, as set out in paragraphs 16(2)(a) to (c)) could facilitate the commission of an offence.
- There is a reasonable expectation that this harm could occur—that is, the expectation is well beyond a mere possibility.
[9]When these requirements are met, institutions must then reasonably exercise their discretion to decide whether to disclose the information.
Does the information meet the requirements of the exemption?
[10]During the investigation, SSC invoked subsection 16(2) to protect security measures withheld on page 134 of the records.
[11]I accept that disclosure of the detailed security measures withheld on page 134 could be used to help circumvent these security measures, which could facilitate the commission of an offence.
[12]I conclude that the security measures on page 134 meet the requirements of subsection 16(2).
Did the institution reasonably exercise its discretion to decide whether to disclose the information?
[13]Since the information meets the requirements of subsection 16(2), SSC was required to reasonably exercise its discretion to decide whether to disclose the information. In doing so, SSC had to consider all the relevant factors for and against disclosure.
[14]An institution’s decision not to disclose information must be transparent, intelligible and justified. An institution’s explanation is sufficient when the institution provides details of how it made the decision and when the documents related to the decision-making process shed light on why the institution proceeded as it did.
[15]SSC did not provide any information indicating that it had considered its obligation to exercise its discretion to decide whether to disclose the information. I must conclude that SSC did not show that it had reasonably exercised its discretion.
Paragraph 20(1)(a): third-party trade secrets
[16]Paragraph 20(1)(a) requires institutions to refuse to disclose trade secrets that belong to a third party (that is, a private company or individual, but not the person who made the access request).
[17]To claim this exemption, institutions must show that the information is a trade secret—that is, a plan or process, tool, mechanism or compound that possesses all four of the following characteristics:
- The information is secret—that is, only one or a relatively small number of people know it.
- The third party intended to treat the information as secret.
- The information has industrial or commercial application.
- The third party has an interest worthy of legal protection (that is, an economic interest).
Does the information meet the requirements of the exemption?
[18]SSC did not apply paragraph 20(1)(a) to the information at issue, however, Gartner asserted that this exemption applies to its confidential outputs. SSC indicated that it would not provide any representations in support of paragraph 20(1)(a).
[19]For reference, in its representations, Gartner identified some of the withheld information as falling within the scope of three terms it defined as follows:
- Confidential Outputs: certain graphics and diagrams on pages 26-27, 32, 44, 61-66 and 102-121;
- Research Data: certain graphics, text and bullets on pages 18, 46, 48-53, 68-69, 98, 100 and 141; and
- Template Output: links to files on page 83.
[20]I will use these terms in some cases to refer to these sections of the records.
[21]The Supreme Court in Merck Frosst Canada Ltd. v. Canada (Health), 2012 SCC 3 (Merck Frosst), at para 109, defined a trade secret as a plan or process, tool, mechanism or compound that possesses all four of the following characteristics:
- the information must be secret in an absolute or relative sense (i.e. known only by one or a relatively small number of persons);
- the possessor of the information must demonstrate that he has acted with the intention to treat the information as secret;
- the information must be capable of industrial or commercial application;
- the possessor must have an interest (e.g. an economic interest) worthy of legal protection
[22]The first requirement is that the information is “a plan or process, tool, mechanism or compound.” Gartner argued that disclosing Confidential Outputs could reveal the algorithm Gartner uses to provide consulting services: “a competitor with reasonable industry knowledge and technical sophistication could utilize the Confidential Outputs to reverse-engineer and identify the Algorithm and develop a competing Internal Application.” Gartner also argued that its algorithm and internal application solve problems, perform tasks, analyze data and generate insights, for example.
[23]I accept that the algorithm and internal application are tools. That said, Gartner did not establish how disclosure of the Confidential Outputs could reveal the algorithm used, or how a competitor could exploit the Confidential Outputs to reverse-engineer the algorithm and internal application. Moreover, Gartner has not demonstrated how the Confidential Outputs themselves are a plan or process, tool, mechanism or compound.
[24]The second requirement of the exemption is that the information is secret, that is, only one or a relatively small number of people know it. Gartner argued that its algorithm and internal application are secret in a relative sense, because they are known by a relatively small number of employees of Gartner on a strictly need-to-know basis. Gartner further argues that the Confidential Outputs, which are necessarily delivered to its clients, are shared with clients who agreed to receive them in confidence.
[25]I am not convinced that the Confidential Outputs are secret. First, the fact that Confidential Outputs are shared with Gartner’s clients seems to contradict the claim that they are secret, even though clients agree to receive them in confidence. Second, as I have already stated, no evidence nor representations were provided as to how disclosure of the Confidential Outputs could reveal the algorithm and internal application. I find that the information at issue is not secret.
[26]The third requirement is that the third party intended to treat the information as secret. I am not convinced that Gartner treated its Confidential Outputs as secret. Again, the fact that Gartner shares its Confidential Outputs with clients seem to contradict the claim that they are treated as secret.
[27]Since it has not been established that the first three requirements of paragraph 20(1)(a) are met, there is no need to examine the other requirements of the exemption.
[28]I conclude that the information does not meet the requirements of paragraph 20(1)(a).
Paragraph 20(1)(b): confidential third-party financial, commercial, scientific or technical information
[29]Paragraph 20(1)(b) requires institutions to refuse to disclose confidential financial, commercial, scientific or technical information provided to a government institution by a third party (that is, a private company or individual, but not the person who made the access request).
[30]To claim this exemption, institutions must show the following:
- The information is financial, commercial, scientific or technical.
- The information is confidential.
- The third party supplied the information to a government institution.
- The third party has consistently treated the information as confidential.
Does the information meet the requirements of the exemption?
[31]Gartner argued that the reports should be withheld in their entirety pursuant to paragraph 20(1)(b). SSC made representations as to how specific portions of the report meet the requirements of this exemption.
[32]The first requirement of paragraph 20(1)(b) is that the information is financial, commercial, scientific or technical. Gartner argued that the information contained in the three reports is financial, commercial, scientific or technical because the records “relate to the benchmarking, evaluation, costing, and recommendations of products or services.”
[33]I accept this explanation for the most part. In Merck Frosst, the Supreme Court of Canada agreed with the well-established jurisprudence of the Federal Court that the terms “financial, commercial, scientific or technical” should be given their ordinary dictionary meanings. According to its ordinary meaning, the term commercial refers to the buying and selling of goods and services (see here and here). I find that most of the content of the reports is commercial, financial and/or technical information, as the reports pertain to the benchmarking, evaluation, costing and recommendation of different IT products or services based on expert knowledge, and also include much financial information.
[34]That said, in Merck Frosst, the Supreme Court of Canada also concluded “that administrative details such as page and volume numbering, dates and location of information within the records are not scientific, technical, financial or commercial information” (para 141). Consequently, I do not accept that these types of administrative details found throughout the reports meet this first requirement.
[35]Moreover, I find that the Template Output (page 83), which contains the name and icon tied to two internal files, also falls within the administrative details and does not consist of commercial or technical information. SSC asserted that the Template Outputs are “part of Gartner’s research and analysis process. This template is commercial information belonging to Gartner that showcases an aspect of their analysis business”. I remain unconvinced that the file names are commercial information on this basis.
[36]I find that the parties have not shown that the following information meets the first requirement of paragraph 20(1)(b):
- Administrative details found throughout the records, including page numbering, title pages, logos, and generic headings that do not reveal commercial or technical information;
- Introductory slides (pages 1, 21, 138);
- Engagement objectives (top of pages 2, 24, 37);
- Section title slides (pages 3, 7, 12, 23, 35, 39, 43, 56, 58, 67, 70, 77, 80, 84, 89, 94, 96, 101);
- Table of contents (page 22);
- Government information (pages 27, 30-31, 36, 38, 60, 62-66, 78-79, 122-136);
- File names and icons (page 83).
[37]I note that none of this information overlaps with the Confidential Outputs or Research Data identified by Gartner in its representations.
[38]The second requirement of the exemption is that the information is objectively confidential. In the decision Merck Frosst, the Supreme Court of Canada held that the test provided in the decision Air Atonabee Limited v. Canada (Minister of Transport), (1989) 1989 CanLII 10334 (FC) is appropriate for determining whether information is confidential within the meaning of paragraph 20(1)(b). In Air Atonabee, the Federal Court identified three indicators of confidentiality:
- the information contained in the record is not available from other sources in the public domain or obtainable by observation or independent study by a member of the public acting on his or her own;
- the circumstances in which the information originates and is communicated give rise to a reasonable expectation that it will not be disclosed; and
- the information, whether provided by law or supplied voluntarily, is communicated to the government within a relationship that is either fiduciary or not contrary to the public interest and that will be fostered for the public benefit by confidential communication.
[39]I accept that the information is not available from other sources in the public domain. Where it may be available via subscription, it is only available to Gartner’s clients, which I do not find to render the information publicly available for the purpose of confidentiality.
[40]Turing to the second requirement for objective confidentiality, Gartner emphasized that the cover pages of the records contain a disclaimer that the information, including supporting materials, is proprietary to Gartner and provided for the sole internal use of the intended recipient. The disclaimer also expressly provides that the records may contain confidential, proprietary, or otherwise legally protected information, and it may not be further copied, distributed, or publicly displayed without the express written permission of Gartner. Each subsequent page of the Records contains the notation “restricted”.
[41]Gartner also argued that a similar case was examined by the Information and Privacy Commissioner of Ontario (IPC) in Ontario (Treasury Board Secretariat) (Re), 2016 CanLII 76837, and the IPC concluded that “the report, including the information at issue, was supplied to the Treasury Board in confidence” (para 39). Gartner suggested that I adopt the same rationale in respect of the circumstances before me and that this IPC decision supports the findings that there was a reasonable expectation of confidentiality in this case.
[42]For the reasons that follow, I am not convinced that second requirement for objective confidentiality is met for certain information. The fact that a record is designated or labelled as confidential does not in itself demonstrate that there is a reasonable expectation that the information will not be disclosed. Neither Gartner nor SSC provided evidence, such as in the form of a relevant contract or agreement, supporting that Gartner had a reasonable expectation of confidentiality.
[43]Moreover, the IPC case is not relevant to my determination of the third party’s reasonable expectation of confidentiality. The IPC decision is based on findings of facts by the IPC adjudicator that are not before me in this complaint. It is unclear how the information in the IPC decision compares to the information at issue in the present case; in fact, it appears to be information of a different nature. Gartner has failed to point out any legal principles that were applied by the IPC adjudicator that I could consider applying in this instance.
[44]It was put to the parties that the fact that Gartner was engaged by SSC to provide the reports suggests that there is not a reasonable expectation that the reports as a whole would not be disclosed. Neither of the parties addressed this in their representations and they have not established how there could have been a reasonable expectation that the Confidential Outputs would be entirely shielded from disclosure, when this information seems to be Gartner’s recommendations and insights into specific government projects for which public funds were paid.
[45]I find that information revealing only project-specific advice paid for by the government does not meet the requirements for this exemption. Such information appears on pages 15-17, 30-31, 78-79, 102-121, 144 and 149 of the response.
[46]The third requirement of objective confidentiality is that the relationship between Gartner and SSC is fostered for the public benefit by confidential communication. Gartner explained that the relationship between Gartner and SSC benefits the public insofar as Gartner supplies federal government institutions with actionable and objective insights, guidance, and tools to enhance governmental services and processes, and that this relationship may be damaged if the information were to be disclosed. Gartner further mentioned that it has and adheres to a strict policy of not selling its consulting services to competitors, in part because Gartner believes there is a risk that competitors could use its confidential outputs to reverse-engineer its algorithm and internal application. I am willing to accept that confidential communication of information meeting all other requirements of the exemption fosters the relationship between Gartner and SSC for the public benefit.
[47]As for the third requirement of the exemption (i.e. that the third party supplied the information to a government institution), Gartner claimed that the records “either constitute information supplied by Gartner, refer to or reveal the supplied information, or can readily be used to determine the type of information supplied.”
[48]The complainant, on the other hand, asserts that this requirement cannot be met for information purchased by the government from a third party. With respect, I find no basis on which to conclude that the wording “supplied to a government institution by a third party” should be interpreted as excluding information purchased by the government.
[49]I accept that most of the information was provided by Gartner. That said, Gartner and SSC have not established how the following information, which appears to be supplied by federal institutions, refers to or reveals the information supplied by Gartner or can be used to determine the type of information Gartner supplied:
- Federal institutions’ names;
- Information about SSC and its mandate;
- Information about the engagement objectives;
- Information about federal institutions’ applications in a given sample; and
- Application names and descriptions.
[50]I conclude that the third requirement of paragraph 20(1)(b) is not met for the above information, which appears on pages 16-17, 27, 30-31, 62-66, 76, 78-79, 103, 105, 107, 109, 111, 113, 115, 118-119, 121-136.
[51]The last requirement of paragraph 20(1)(b) is that the third party has consistently treated the information as confidential. Gartner explained that it implemented a series of measures that demonstrate it consistently treated the information as confidential, such as the disclaimer and “restricted” notation mentioned above, a secured database, internal policies (a Code of Conduct, a Usage Policy, a Content Compliance Policy and Terms of Use) and a confidentiality agreement for its employees. I accept that the last requirement of the exemption is met.
[52]I conclude that the following information does not meet the requirements of paragraph 20(1)(b):
- Administrative details found throughout the records, including page numbering, title pages, logos, and generic headings that do not reveal commercial or technical information;
- Introductory slides (pages 1, 21, 138);
- Engagement objectives (top of pages 2, 24, 37, 38);
- Section title slides (pages 3, 7, 12, 23, 35, 39, 43, 56, 58, 67, 70, 77, 80, 84, 89, 94, 96, 101);
- Table of contents (page 22);
- Government information, including federal institution’s names, information about Federal institutions’ applications in the sample and information about SSC and its mandate (pages 27, 30-31, 36, 38, 60, 62-66, 78-79, 122-136);
- File names (page 83);
- Information revealing only project-specific information paid for by the government (pages 15-17, 30-31, 78-79, 102-121, 144 and 149); and
- Application names and descriptions (pages 16-17, 27, 30-31, 62-66, 76, 78-79, 103, 105, 107, 109, 111, 113, 115, 118-119, 121-136).
[53]Since the balance of the information meets the requirements of paragraph 20(1)(b), I did not examine the other exemptions SSC applied or Gartner asserted applied to the same information.
Paragraph 20(1)(c): financial impact on a third party
[54]Paragraph 20(1)(c) requires institutions to refuse to disclose information that, if disclosed, could reasonably be expected to have a material financial impact on a third party (that is, a private company or individual, but not the person who made the access request) or harm its competitive position.
[55]To claim this exemption with regard to financial impact on a third party, institutions must show the following:
- Disclosing the information could result in material financial loss or gain to the third party.
- There is a reasonable expectation that this harm could occur—that is, the expectation is well beyond a mere possibility.
[56]To claim this exemption with regard to competitive position, institutions must show the following:
- Disclosing the information could injure the competitive position of the third party.
- There is a reasonable expectation that this prejudice could occur—that is, the expectation is well beyond a mere possibility.
Does the information meet the requirements of the exemption?
[57]Gartner asserted that the Confidential Outputs, Research Data and Template Output should be withheld under paragraph 20(1)(c). SSC withheld most of the information under paragraph 20(1)(c). Since certain information meets the requirements of paragraph 20(1)(b), no examination of whether paragraph 20(1)(c) also applies to the same information was necessary.
[58]Paragraph 20(1)(c) requires evidence showing the impact that disclosing the information could have on the third parties and how likely that impact would be. SSC and Gartner must demonstrate a clear and direct connection between the disclosure of specific information and a risk of harm well beyond the merely possible (Merck Frosst, paras. 197, 206).
[59]The case law under the Act makes clear that a party resisting disclosure based on paragraph 20(1)(c) bears the onus of establishing, in more than just a general way, that there is a reasonable expectation of a probable harm described in paragraph 20(1)(c) occurring if the information is disclosed (see: Les Viandes du Breton Inc. c. Canada (Department of Agriculture), 2000 CanLII 16764 (FC), at para 12). This requires that a party opposing disclosure demonstrates that the harm is reasonably probable and must be assessed based on facts and on the specific records at issue in an access request (see: Samsung Electronics Canada Inc. v. Canada (Health), 2020 FC 1103, at para 113).
[60]Gartner claimed that disclosing the Confidential Outputs and Template Output could cause three types of harm: it could cause a financial loss, injure its competitive position and cause reputational damage. First, Gartner explained that it earns revenue by selling consulting services through which sophisticated advice and recommendations are provided (in this case the Confidential Outputs). Gartner asserted that it could lose this economic value if the information was made available through an access request. Second, Gartner claimed that disclosing certain information would give competitors an unfair advantage, as the information may be used for commercial benefit or replicating specific elements of Gartner’s unique and proprietary approach, thereby diminishing Gartner’s competitive edge in bidding on and securing future projects. Finally, Gartner claimed that the information may be misused, misconstrued and misrepresented in press reports, which may cause reputational damage and operational risks.
[61]Gartner also made representations as to how information on pages 4, 6, 13, 14 and 16-17 is proprietary and confidential research data that should be withheld under paragraph 20(1)(c). Since I have accepted the information on pages 4, 6, 13 and 14 meets the requirements of paragraph 20(1)(b), it is unnecessary to examine whether it is also exempt under paragraph 20(1)(c). With respect to pages 16-17, however, for the reasons that follow, I am not convinced the withheld information meets the requirements of paragraph 20(1)(c).
[62]Gartner argued that the information on pages 16-17 reflects information from service providers it works with, and that harm of the following types could result from disclosure:
- service providers might be less likely to share information with Gartner in future, impairing its ability to provide a quality service;
- service providers could “use the detailed findings, methodologies, and critiques contained in Gartner's reports to tailor their public responses, marketing strategies, or otherwise modify their practices to appear more favorable in future assessments”, which could “undermine the objectivity and value of Gartner's assessments, reducing the reliability and credibility of Gartner's services as viewed by clients”; and
- the value of Gartner’s research could be diminished, as “Gartner derives revenue from subscription fees, licensing agreements, and consulting services, as its datasets and analyses are not otherwise accessible to the public”.
[63]Since the information on pages 16-17 is broken down by government departments, I am not convinced that its disclosure would reveal information that could cause these harms described by Gartner. It has not been established how the information broken down by department could be used to derive information that could harm Gartner in these ways.
[64]Moreover, I find the parties have not established there is a reasonable expectation that disclosing the Confidential Outputs or Template Output could cause the financial loss identified by Gartner. Given that Confidential Outputs are largely specific to each client, Gartner and SSC failed to substantiate that disclosing the Confidential Outputs that were provided to SSC and tailored to SSC’s specific needs could cause Gartner to lose other clients interested in its consulting services. The Template Output (page 83) consists of icons and names for two Excel files. The parties have not established how disclosing this information would cause a financial loss, given that neither the files nor the links to the files are included in the response.
[65]I am also not convinced that there is a reasonable expectation that disclosing the Confidential Outputs and Template Output could injure Gartner’s competitive position. Gartner has not identified which specific elements of its unique and proprietary approach would be revealed through disclosure of this information. Gartner has also not convincingly explained why a competitor might want to replicate these elements or which commercial benefit a competitor might obtain from the information.
[66]As mentioned previously, the Template Output (page 83) consists of the names and icons of two Excel files (the files and the links to them are not included). The parties did not establish how disclosing this information could injure Gartner’s competitive position.
[67]As for the reputational damage, the Supreme Court has held that decision makers should be sceptical about claims that the public misunderstanding of disclosed information will inflict harm on third parties, and that refusing to disclose information for this reason would undermine the purpose of access to information legislation (see: Merck Frosst at para. 224). In Les Viandes du Breton Inc. c. Canada (Department of Agriculture), 2000 CanLII 16764 (FC), the court also found that media coverage cannot be presumed to be unfair or negative and that a third party has other legal remedies if it is the victim of unfair or unfounded coverage (para 23). I find that Gartner and SSC have not established how disclosure could reasonably be expected to cause reputational damage resulting in financial loss or harm to Gartner’s competitive position.
[68]I conclude that the information does not meet the requirements of paragraph 20(1)(c).
Section 25: severance
[69]Section 25 applies notwithstanding any other provision in the Act. It requires institutions to disclose any part of a record that does not contain exempt information under the Act, and which can reasonably be severed from exempt information on the record. This is an extension of the principle that necessary exceptions to access should be limited and specific.
[70]SSC argued that severance of administrative details such as page numbers, logos and clip art “would not have been in the requester’s best interest or the spirit of the Act as the requester would have received repetitive meaningless information that does not provide any value”. SSC provided details as to the cost-benefit analysis it carried out in coming to such a conclusion.
[71]SSC did not address, however, the information which it concedes originated from the government and therefore should be released.
[72]Given my findings, it is clear that more than simple administrative details must be released to the complainant. As such, I conclude that SSC failed to adhere to section 25 in withholding most pages in full in response to the request.
Outcome
[73]The complaint is well founded.
Orders
I order the President of SSC to do the following:
- Re-exercise his discretion to decide whether to disclose the information to which SSC applied subsection 16(2) on page 134, taking into account all relevant factors for and against disclosure; and
- Disclose the administrative details throughout the records: page numbering, title pages, logos, and generic headings that do not reveal commercial or technical information;
- Disclose project-specific advice paid for by the government on pages 15-17, 30-31, 78-79, 102-121, 144 and 149; and
- Disclose the information supplied by government on pages 16-17, 27, 30-31, 62-66, 76, 78-79, 103, 105, 107, 109, 111, 113, 115, 118-119, 121-136.
Initial report and notice from institution
On January 20, 2026, I issued my initial report to the President setting out my orders.
On February 18, 2026, the President gave me notice that SSC would be implementing the orders.
Review by Federal Court
When an allegation in a complaint falls under paragraph 30(1)(a), (b), (c), (d), (d.1) or (e) of the Act, the complainant has the right to apply to the Federal Court for a review. When the Information Commissioner makes an order(s), the institution also has the right to apply for a review. The complainant and/or institution must apply for a review within 35 business days after the date of this report. When they do not, third parties may apply for a review within the next 10 business days. Whoever applies for a review must serve a copy of the application for review to the relevant parties, as per section 43. If no one applies for a review by these deadlines, the order(s) takes effect on the 46th business day after the date of this report.
Other recipients of final report
As required by subsection 37(2), this report was provided to Gartner.