The complainant alleged that the Canada Border Services Agency (CBSA) had improperly withheld information under subsection 16(2) (facilitating the commission of an offence) and paragraph 20(1)(d) (negotiations by a third party) of the Access to Information Act in response to an access request. The request was for assessments of cybersecurity and data breach risks associated with the ArriveCAN application. The allegation falls under paragraph 30(1)(a) of the Act.

During the investigation, CBSA disclosed portions of the assessments it had withheld under subsection 16(2) and paragraph 20(1)(d). CBSA continued to withhold other information under subsection 16(2) and also decided to exempt information under subsection 19(1) (personal information).

The Information Commissioner concluded that some of the information CBSA continued to withhold did not meet the requirements of subsection 16(2). She also concluded that CBSA did not determine, as is required when information meets the requirements of subsection 19(1), whether circumstances existed that would mean it would have to exercise its discretion to decide whether to disclose this information.

The complaint is well founded.

The Commissioner issued an initial report with her intended orders. In response, CBSA provided additional representations in support of its application of subsection 16(2) and disclosed more records. The complainant indicated they were satisfied with the information. Therefore, no order was necessary.

The Commissioner reminded CBSA that receiving an initial report is not an opportunity to present new information or new representations on the outcome of the complaint. Institutions are required to give their best and full representations during the investigation. When the initial report is issued, the investigation is complete and the Commissioner has made her decision on the outcome of the complaint.