Decisions

The complainant alleged that the Canada Border Services Agency (CBSA) had improperly withheld information under subsection 16(2) (facilitating the commission of an offence) and paragraph 20(1)(d) (negotiations by a third party) of the Access to Information Act in response to an access request. The request was for assessments of cybersecurity and data breach risks associated with the ArriveCAN application. The allegation falls under paragraph 30(1)(a) of the Act.

During the investigation, CBSA disclosed portions of the assessments it had withheld under subsection 16(2) and paragraph 20(1)(d). CBSA continued to withhold other information under subsection 16(2) and also decided to exempt information under subsection 19(1) (personal information).

The Information Commissioner concluded that some of the information CBSA continued to withhold did not meet the requirements of subsection 16(2). She also concluded that CBSA did not determine, as is required when information meets the requirements of subsection 19(1), whether circumstances existed that would mean it would have to exercise its discretion to decide whether to disclose this information.

The complaint is well founded.

The Commissioner issued an initial report with her intended orders. In response, CBSA provided additional representations in support of its application of subsection 16(2) and disclosed more records. The complainant indicated they were satisfied with the information. Therefore, no order was necessary.

The Commissioner reminded CBSA that receiving an initial report is not an opportunity to present new information or new representations on the outcome of the complaint. Institutions are required to give their best and full representations during the investigation. When the initial report is issued, the investigation is complete and the Commissioner has made her decision on the outcome of the complaint.

The complainant alleged that the Canadian Broadcasting Corporation (CBC) had improperly withheld information under section 17 (safety of individuals) and subsection 19(1) (personal information) of the Access to Information Act in response to an access request. The request was for all communications between specific CBC and Twitter employees since January 1, 2018, which was prior to Twitter becoming X. The allegation falls under paragraph 30(1)(a) of the Act. During the investigation, the CBC disclosed some of the information it had withheld under subsection 19(1) and section 17 but also applied subsection 16(2) (facilitating the commission of an offence) to some of the remaining information withheld under section 17. The Commissioner concluded that this information did not meet the requirements of either subsection 16(2) or section 17. The CBC argued that disclosing the name and contact information of a member of its information security team would facilitate the commission of an offence by making it possible for hackers to access CBC computer systems. However, the CBC did not show how disclosing the information would reasonably be expected to lead to this result. In addition, the employee’s name and contact information were already available on LinkedIn and elsewhere online. The CBC also withheld the names and Twitter handles of several CBC journalists who were the subject of online posts the CBC had identified as instances of harassment and requested to be taken down, although it disclosed the content of the posts themselves during the investigation. The CBC argued that also disclosing the identifying information of journalists who were calling out online harassment could lead to these individuals’ being subject to retaliatory online attacks, resulting in psychological harm. The Commissioner found that the threats to individuals’ safety envisioned under section 17 could include psychological harm. Nonetheless, she concluded that, in this case, the CBC neither showed that the harm went beyond distress nor addressed the reasonable expectation of the harm occurring if the information were disclosed. The Commissioner ordered the CBC to disclose the information withheld under subsection 16(2) and section 17. The CBC gave notice to the Commissioner that it would implement the order. The complaint is well founded.