Decisions

In February 2024, the Information Commissioner initiated a systemic investigation into the Canada Border Services Agency’s (CBSA) handling of access to information requests related to ArriveCAN. The investigation examined the completeness of responses provided to ArriveCAN-related access requests and whether the CBSA provided timely access to ArriveCAN information.

Publicly reported allegations suggested that a CBSA senior official permanently destroyed e-mails and other records that may have been relevant to access requests. The investigation found no evidence to substantiate these allegations.

The investigation did determine however that the ArriveCAN project team used the communication and collaboration platform Slack between 2020 and 2023 to communicate about the development, testing and maintenance of the ArriveCAN application. The Slack workspace was permanently deleted in May 2023 without consultation with the CBSA’s Access to Information and Privacy (ATIP) unit and without a documented review of its contents.

The complaint is well founded because the Commissioner found that the CBSA failed to conduct reasonable searches in response to six ArriveCAN-related access requests because Slack was not searched, despite the likelihood that it contained responsive records. The investigation also identified weaknesses in information management practices, including the use of non-government email accounts, reliance on informal storage practices and insufficient governance over third-party collaboration tools.

With respect to timeliness, the investigation confirmed that the CBSA failed to respond to a number of ArriveCAN-related requests within the legislated timelines. That said, the investigation did not identify any unique concerns related to the timeliness of the CBSA’s responses to access requests related to the ArriveCAN initiative.

The Commissioner made several recommendations which were all accepted by the CBSA who committed to implementing corrective measures, including new governance policies, enhanced training and improved information management controls.

In June 2026, the Commissioner tabled her Annual Report to Parliament which includes a special report on the investigation.

The Information Commissioner received a complaint under the Access to Information Act alleging that the titles of certain briefing notes published on the Open Canada website have been improperly withheld.

Section 30 of the Act authorizes the Commissioner to receive and investigate complaints containing allegations that fall under paragraphs 30(1)(a) to (d.1) when the complainant is the person or corporation who made the access request. The Commissioner may also investigate allegations falling under paragraph 30(1)(e) or any other matters relating to requesting or obtaining access to records under Part 1 of the Act (paragraph 30(1)(f)), regardless of whether the complainant made an access request.

The Commissioner cannot receive or investigate complaints concerning Part 2 of the Act, which sets out obligations related to the proactive publication of specific information and documents.

Subsection 91(1) of the Act specifically states that the Commissioner “may not exercise any powers in relation to the proactive publication of information under this Part, including any powers — such as receiving complaints and investigating them — that are conferred on her under Part 1.”

The complaint was found inadmissible since it did not fall under subsection 30(1). This is because it does not relate to an access request (paragraph 30(1)(a) to (d.1)), a matter referenced in paragraph 30(1)(e) or any other matter relating to requesting or obtaining access to records under Part 1 the Act (paragraph 30(1)(f)).

Accordingly, the Information Commissioner did not accept the complaint, since she has no authority to investigate it.

The complainant alleged that the Department of Justice Canada had improperly withheld information under section 14 (federal-provincial affairs) and paragraph 21(1)(a) (advice or recommendations) of the Access to Information Act in response to an access request. The request was for a copy of the "Final report: Mandatory Minimum Penalties. Recommendations to the Minister of Justice and Attorney General of Canada. Expert Panel on Sentencing Reform." The allegation falls under paragraph 30(1)(a) of the Act.

Department of Justice Canada did not show that it met all the requirements of these exemptions, in particular how disclosure of the information could reasonably be expected to harm the conduct of federal-provincial affairs as well how the report did not consist of a report prepared by consultants or advisers who were not directors, officers or employees of an institution or members of a minister’s staff.

The Information Commissioner ordered Justice to disclose the records in their entirety.

Department of Justice Canada gave notice to the Commissioner that it would comply with the order.

The complaint is well founded.

The complainant alleged that Business Development Bank of Canada (BDC) refused to process an access request under the Access to Information Act. The request was for various types of records relating to three companies from January 1, 2023, to June 30, 2025. The allegation falls under paragraph 30(1)(a) of the Act.  

BDC refused to process the request claiming that the requester did not confirm their right of access. The investigation found that the request met the requirements of section 6 of the Act and that the right of access has been met. BDC conceded that the request meets the requirements of section 6. The Information Commissioner ordered BDC to accept the access request and to give the notice required by section 7; if access was to be refused, it must state in the notice the specific provision on which the refusal is based, as required by section 10. BDC gave notice to the Commissioner that it would be implementing the orders. The complaint is well founded.