Archived - Privacy and Data Protection Guidelines - Exemptions

An individual's right of access to their personal information as contained in the Privacy Act is limited by a number of exceptions specified in sections 18 through 28 of the legislation. These exceptions to the right of access are known as exemptions. Each exemption is intended to protect information relating to a particular public or private interest. These exemptions, when combined with the categories of excluded records outlined in sections 69 and 70 of the Act, form the only basis for refusing an individual access to their personal information.

The exemptions contained in the Privacy Act can be classified in two ways B according to whether the exemption is subject to an injury test or a class test, and according to whether the exemption is discretionary or mandatory.

Section 18 of the Privacy Act provides for banks of personal information which are completely exempt from access. Exempt banks are discussed in detail in section 5.

Exclusion from the coverage of the Act or exemption from disclosure by a specific section form the only basis for refusing an individual access to their personal information. Therefore, access must be given to all personal information requested by an individual under the Privacy Act except that which is either specifically exempted or excluded under a provision of the Act.

It is possible that a particular record or portion of a record may qualify for more than one exemption. In such cases, institutions should cite all applicable exemptions and should be prepared to defend the use of all exemptions cited. The manner of citing exemption provisions is discussed in section 6 of Chapter 2-6 regarding notices.

Subsection 18(1) of the Privacy Act provides that the Governor-in-Council may, by order, designate as exempt certain personal information banks that contain files, all of which consist predominantly of personal information described in sections 21 or 22 of the Act (international affairs and defence or law enforcement and investigation).

In order to qualify for designation as an exempt bank, the personal information bank must contain files, regardless of their physical form, each of which consist predominantly of information which could be exempted under sections 21 or 22 of the Act. "Predominantly" means that a preponderance, or more than half, of the information in each of the files must qualify for exemption. Clearly, the greater the proportion of exemptible information in a given file, the greater the likelihood it will qualify for inclusion in an exempt bank. The result is that very few banks may be designated as exempt banks, and that every file must be reviewed before it can be placed in an exempt bank. (This principle was articulated in / Ternette v. Solicitor General of Canada, [1984] 2 F.C. 486, 10 D.L.R. (4th) 587, 32 Alta. L.R. (2d) 310.)

Subsection 18(2) of the Privacy Act provides that a government institution may refuse to disclose any personal information that is contained in a personal information bank designated as an exempt bank under subsection 18(1). This is a discretionary exemption based on the class test of whether particular information forms part of an exempt bank. Usually information which is part of an exempt bank will be exempted from access. However, if the head of the institution is satisfied that no harm will result from the disclosure, there is discretion to disclose.

The exempt bank provision cannot be applied to information or a copy of information transferred from an exempt bank to another institution. The receiving institution must determine whether or not to apply an exemption to requested information.

Contents of an Exemption Order

Subsection 18(3) of the Privacy Act provides that an order made by the Governor-in-Council under subsection 18(1) to designate exempt banks shall specify:

1. the section on the basis of which the order is made; and
2. where the bank contains files which consist predominantly of personal information described in subparagraph 22(1)(a)(ii), the law concerned.

The policy requires that government institutions consult with Treasury Board on any proposal for the establishment or revocation of an exempt bank.

The policy also requires that government institutions submit to the Designated Minister any requests to designate exempt personal information banks, and that requests for exempt banks submitted to the Designated Minister include:

1. a description of the information to be included in the exempt bank;
2. the specific exemption provision under which the information requires protection. For exemption provision 22(1)(a)(ii), this includes the law concerned (e.g. the Income Tax Act). For any injury test exemption, a statement of the expected detrimental effect must be included;
3. an explanation, including cost implications, of why the information should be placed in an exempt bank rather than being subject to review on a case-by-case basis;
4. certification that all the files in the bank consist predominantly of personal information of the type described in sections 21 or 22 of the Privacy Act and that procedures are in place to ensure that files are reviewed on an ongoing basis;
5. a draft Order in Council; and
6. a draft Regulatory Impact Analysis Statement.

Review of Exempt Banks

Section 36 of the Privacy Act empowers the Privacy Commissioner to review files contained in an exempt bank and to recommend to the head of the institution the removal of any file which, in his opinion, does not meet the section 18 criteria. If the institution refuses to remove the file, the Privacy Commissioner can apply to the Federal Court for a review of the matter. The Federal Court may order the removal of the file from the exempt bank.

Section 19 of the Privacy Act provides that a government institution shall refuse to disclose any personal information that was obtained "in confidence" from:

1. the government of a foreign state or institution thereof;
2. an international organization of states or an institution thereof;
3. the government of a province or an institution thereof; or
4. a municipal or regional government established by, or pursuant to, an Act of the legislature of a province or an institution of such a government.

This is a mandatory class exemption. The term "in confidence" means that the supplier does not wish the information to be disseminated beyond the institution to which it has been supplied. This exemption protects personal information provided in confidence by officials of other governments or international organizations and their institutions. The best means of supporting the application of this exemption is to have written notification from the supplier of the information that it is being provided in confidence. Wherever feasible, it is advisable that government institutions enter into agreements with those other governments, international organizations or their institutions with which they will be exchanging information, stipulating the information which is being exchanged in confidence.

Where the status of personal information provided to a government institution prior to the proclamation of the Act is in doubt, consultation should take place. The institution which originally obtained the information should consult the other government or international organization which provided the information to determine whether the information was provided in confidence and whether such confidential treatment is still required.

Copies of information received in confidence by one government institution may be found in the files of one or more other government institutions. Since this is a mandatory exemption, all copies of the information supplied in confidence must be protected from disclosure. To ensure such protection, government institutions receiving personal information in confidence shall ensure that the information is marked as to its status and source before copies are provided to other institutions. Government institutions which have received information marked as having been received in confidence by another institution should not disclose the information without first consulting the other institution as to whether the information is still considered to be confidential.

Permissible disclosure

Subsection 19(2) of the Privacy Act provides that the head of a government institution may disclose personal information obtained in confidence from another government or an international organization if the government or organization from which the information was obtained:

1. consents to the disclosure; or
2. makes the information public.

This subsection permits some limited discretion in dealing with information received in confidence. When there is any doubt as to the continuing confidentiality of the information, the institution may contact the other government or organization in order to seek consent to release the information. When dealing with foreign governments or international organizations, such consultation should be co-ordinated through the Privacy Co-ordinator at the Department of External Affairs. Where the information has been used for an administrative purpose and it is not exempt under any other provision of the Act, government institutions should make an effort to obtain the consent of the government or organization from which the information was obtained to disclose it. If the government or organization which originally provided the information makes such information public, the government institution should consider releasing the information as well.

Section 20 of the Privacy Act provides that a government institution may refuse to disclose any personal information the disclosure of which could reasonably be expected to be injurious to the conduct by the Government of Canada of federal-provincial affairs.

This is a discretionary exemption based on an injury test. It is specifically aimed at protecting the federal government in its conduct of federal-provincial affairs. To invoke this exemption, a government institution should be convinced that the disclosure of specific personal information could reasonably be expected to be injurious to its conduct of, or its role in, federal-provincial affairs.

It is rare that personal information will be related to federal-provincial affairs. However, any injury in regard to federal-provincial affairs is most likely where the federal government is either about to commence or is in the midst of conducting specific negotiations, deliberations or consultations. There may, however, be some types of personal information which continue to be sensitive. The release of such information could jeopardize the position of the federal government in conducting federal-provincial affairs in the future, or seriously affect its relations with one or more provincial governments. Personal information which continues to be sensitive should be protected until there is no likely possibility of injury.

Institutions should consult with the Federal-Provincial Relations Office through the PCO/FPRO Privacy Co-ordinator before disclosing personal information relating to federal-provincial affairs. Only senior officials should have delegated authority to exempt or disclose records under this section.

Section 21 of the Privacy Act provides that a government institution may refuse to disclose any personal information the disclosure of which could reasonably be expected to be injurious to the conduct of international affairs, the defence of Canada or any state allied or associated with Canada, or the detection, prevention or suppression of subversive or hostile activities.

This is a discretionary exemption based on an injury test as applied to three general public interest areas. Access to personal information may be denied if disclosure could reasonably be expected to be injurious to:

1. "The conduct of international affairs": This includes not only state-to-state affairs, but also commercial, cultural or scientific links established by citizens with counterparts in other countries.
2. "The defence of Canada or any state allied or associated with Canada": An "allied state" is one with which Canada has concluded formal alliances or treaties. An "associated state" is another state with which Canada may be linked for trade or other purposes outside the scope of a formal alliance.
3. "The detection, prevention or suppression of subversive or hostile activities": This exemption protects specific types of personal information relating to the security of Canada.

Section 21 of the Act defines the terms "defence of Canada or any state allied or associated with Canada" and "subversive or hostile activities" as they are defined in subsection 15(2) of the Access to Information Act. These definitions are as follows:

"Defence of Canada or any state allied or associated with Canada" includes the efforts of Canada and of foreign states to detect, prevent or suppress the activities of any foreign state directed toward actual or potential attack or other acts of aggression against Canada or any state allied or associated with Canada.

"Subversive or hostile activities" means:

1. espionage against Canada or any state allied with or associated with Canada;
2. sabotage;
3. activities directed toward the commission of terrorist acts, including hijacking, in or against Canada or foreign states;
4. activities directed toward accomplishing government change within Canada or foreign states by the use of or encouragement of the use of force, violence or any criminal means;
5. activities directed toward gathering information used for intelligence purposes that relates to Canada or any state allied with or associated with Canada; and
6. activities directed toward threatening the safety of Canadians, employees of the Government of Canada or property of the Government of Canada outside Canada.

It is important to note that "defence of Canada" is defined inclusively. It is defined in general terms, and the definition does not limit the type of information relating to defence which may qualify for the exemption. On the other hand, "subversive or hostile activities" are defined restrictively. This means that the definition is specific and comprehensive. The exemption may only be invoked for those activities listed in the definition. Personal information relating to other security or intelligence activities such as security screening, immigration and citizenship vetting, domestic vital points and security inspections may only be exempted under this provision where it relates to one of the activities outlined in paragraphs 15(2)(a) to (f) of the Access to Information Act.

Types of Information

Section 21 refers to paragraphs (a) through (i) of subsection 15(1) of the Access to Information Act for illustration of the specific types of personal information which are likely to be covered by the exemption. It is essential to remember that the types of information listed in these paragraphs cannot be exempted as a class, and that this is only an illustrative list, not an exhaustive list. Section 21 is an injury test exemption. For the exemption to be applied, the head of the government institution must be able to demonstrate that disclosure of the personal information requested could reasonably be expected to result in injury to one of the interests specified (i.e. "detection, prevention or suppression of subversive or hostile activities").

Most of the examples set out in paragraphs 15(1)(a) to (i) do not apply to personal information (e.g. information on the quantity, characteristics, capabilities or deployment of weapons, paragraph 15(1)(b)). A few paragraphs, however, relate directly to individuals [see paragraph 15(1)(c)]. Those which are most likely to be applicable under section 21 are:

1. Paragraph 15(1)(c), any such personal information relating to the characteristics, capabilities, performance, potential, deployment, functions or role of any defence establishment, of any military force, unit or personnel or of any organization or person responsible for the detection, prevention or suppression of subversive or hostile activities. This provision deals with defence establishments and military and national security personnel; and
2. Paragraph 15(1)(d), any such personal information obtained or prepared for the purpose of intelligence relating to:
   • the defence of Canada or any state allied or associated with Canada; or
   • the detection, prevention or suppression of subversive or hostile activities.

This paragraph deals with intelligence concerning defence and national security. Information "obtained or prepared for the purpose of intelligence" encompasses both the raw data collected ("obtained") as well as the refined product or analysis ("prepared").

Consultation

The Policy on Privacy and Data Protection requires that government institutions consult with:

• External Affairs Canada before determining to exempt or disclose any personal information that could reasonably be expected to be injurious to the conduct of international affairs;
• National Defence before determining to exempt or disclose any personal information that could reasonably be expected to be injurious to the defence of Canada or any state allied or associated with Canada; and/or
• the government institution having the primary interest (i.e. the Department of the Solicitor General, the R.C.M.P., the Canadian Security Intelligence Service, National Defence or External Affairs) before determining to exempt or disclose any personal information that could reasonably be expected to be injurious to the detection, prevention, or suppression of subversive or hostile activities.

Section 22 of the Privacy Act is intended to protect:

1. effective law enforcement, including criminal law enforcement;
2. the integrity and effectiveness of other types of investigative activities (e.g. investigations in regulatory areas and air accident investigations); and
3. the security of penal institutions.

Section 23 of the Privacy Act provides that a government institution may refuse to disclose any personal information that was obtained or prepared by an investigative body specified in the regulations for the purpose of determining whether to grant security clearances:

1. required by the Government of Canada or a government institution in respect of:
   • individuals employed by the government or an institution;
   • individuals performing services for the government or an institution;
   • individuals employed by or performing services for a person or body performing services for the government or an institution; or
   • individuals seeking to be so employed or seeking to perform such services, or;
2. required by the government or a province or a foreign state or an institution thereof;

if disclosure of the information could reasonably be expected to reveal the identity of the individual who furnished the information to the investigative body.

This is a discretionary exemption designed to protect sources of information within the security clearance process of the Government of Canada. Information may be exempted under this provision if it was obtained or prepared by an investigative body specified in the Regulations (Schedule IV) and its disclosure could reasonably be expected to reveal the identity of the individual who supplied the information. This section does not protect all personal information collected or obtained in the security screening process (e.g. the report sent to government institutions). It is intended to protect sources of information, particularly when the information they have provided relates to subversive or hostile activities or organized crime. When considering whether or not to exercise the discretion provided by this section, the head of the institution should consider whether the information would allow identification of the source and if that identification would likely cause injury to the source.

The reference to the granting of security clearances implies that this section may only apply to investigations undertaken to issue, reissue or upgrade a clearance. It does not refer to an investigation undertaken to review or update an existing clearance. By virtue of paragraph 22(3)(c) such investigations are listed in Schedule V of the Regulations and are covered by paragraph 22(1)(b).

Consultation

The policy requires that government institutions consult with the investigative body that provided the information before determining to exempt or disclose personal information regarding a security clearance.

Section 24 of the Privacy Act provides that a government institution may refuse to disclose any personal information that was collected or obtained by the Canadian Penitentiary Service, the National Parole Service or the National Parole Board while the individual was under sentence for an offence against any Act of Parliament if disclosure could reasonably be expected to:

1. lead to a serious disruption of the individual's institutional, parole or mandatory supervision program; or
2. reveal information about the individual originally obtained on a promise of confidentiality, express or implied.

This discretionary exemption pertains to personal information collected or obtained while the individual was under sentence and it continues to apply after the sentence has been completed. It can be based on either an injury test (i.e. lead to a serious disruption of...) or a class test (i.e. reveal information given in confidence). Before releasing personal information collected or obtained by the Canadian Penitentiary Service, the National Parole Service or the National Parole Board, government institutions should consult the appropriate institution to determine whether or not this exemption should be applied.

Section 25 of the Privacy Act provides that a government institution may refuse to disclose any personal information the disclosure of which could reasonably be expected to threaten the safety of individuals.

This is a discretionary exemption. It permits a government institution to refuse access to personal information if it has reasonable grounds to expect that disclosure of the information could threaten the safety of an individual. This exemption will normally apply to information by or about informants. This includes individuals who provide information concerning criminal, subversive or hostile activities, but is not limited to that.

The policy requires that government institutions consult with the supplying institution before determining to exempt or disclose personal information when the disclosure could affect the safety of individuals.

Section 26 of the Privacy Act provides that a government institution may refuse to disclose any personal information about an individual other than the requestor. It also provides that a government institution shall refuse to disclose such information where the disclosure is prohibited under section 8 of the Act.

This provision embodies the principle under the Privacy Act that an individual has a right of access only to information about himself or herself. This exemption is clearly applicable where personal information about one individual is entwined inseparably with information about another individual (eg. information about a husband and wife in an immigration file). When this occurs, such information must not be disclosed unless some discretion is given the institution under section 8 of the Act. Discretion to disclose may be exercised if:

1. the disclosure is authorized under subsection 8(2) of the Privacy Act;
2. the other individual gives his or her consent to the disclosure; or
3. the information is publicly available.

The discretion to disclose provided in this section is very limited. It is included so that a maximum amount of information may be made available to an applicant. This prevents nonsensical situations where an institution is exempting information already well known to an applicant. An example of this could be when non-sensitive, factual information about another individual has either been supplied by the applicant or is obviously well known to him or her (e.g. family members' addresses on a security clearance form). All such disclosures should, however, be made cautiously. The relationship between the individuals should be obvious and there should be no possibility of an unwarranted invasion of privacy. Where the possibility of an invasion of privacy exists, institutions must either sever the information about the other individual from the record or, where this is not possible, exempt the information.

For practical and administrative purposes, therefore, information about more than one individual should be separated within the personal information bank whenever possible.

This exemption does not cover the name of a source of information about an individual (e.g. the source of an opinion or critique of an individual's work), except in some specific cases. As provided in paragraphs 3(e) and (h) of the definition of personal information, the exemption covers the name of a referee or judge for a grant, award or prize for those institutions named in the Regulations (Schedule I). Except as provided in paragraphs 3(e) and (h) of the Act, the name of the source and the information or opinion about the individual cannot be exempted. Any other personal information about the source, (e.g. address, title, nationality, etc.), must be severed before the record is disclosed. The name of a source and his or her opinions may, of course, be withheld if they qualify for exemption on other grounds.

Section 27 of the Privacy Act provides that a government institution may refuse to disclose any personal information that is subject to solicitor-client privilege.

This is a discretionary exemption which allows the government institution to claim the same protection for communications with its solicitors as is allowed in the private sector. The privilege also extends to cover materials prepared by or for the solicitor expressly for the purpose of providing advice or presenting a case in court.

The decision to invoke solicitor-client privilege is the responsibility of the client institution, however institutions should consult their legal advisor prior to invoking solicitor-client privilege in order to determine if the information is in fact privileged. They should also consult their legal advisor prior to disclosing such information for advice as to whether the disclosure could injure the government's legal position, and advice as to whether waiving privilege for part of the information may result in an unintended waiver of privilege for all of the information. This exemption should be used when the disclosure of information could:

1. circumvent the normal process of discovery in cases presently before the courts;
2. prejudice the government's legal position in present or future litigation or negotiation; or
3. impede the ability of government institutions to communicate fully and frankly with their legal advisors.

Section 28 of the Privacy Act provides that a government institution may refuse to disclose any personal information that relates to the physical or mental health of the individual requesting the information where the examination of the information would be contrary to the best interests of the individual.

This is a discretionary exemption. It is not intended to apply to all medical records. It is intended to apply only to that sensitive medical or mental health information the disclosure of which could be considered to be contrary to the best interests (in terms of personal health) of the individual. The decision on "best interests" must be made by a qualified medical practitioner or psychologist on the basis of knowledge about a particular disease, disorder, syndrome or condition and about the actual case involved. Sub-section 13(1) of the Regulations (see Chapter 4-2) permits, but does not require, an institution to obtain this decision from a medical practitioner or psychologist of the applicant's own choosing (with the applicant's consent). The institution will normally allow the individual to have the information examined by a medical practitioner or psychologist of his or her own choice, where the institution is satisfied that the person chosen is qualified to determine whether or not disclosure would be contrary to the applicant's best interests.

Sub-section 13(2) of the Regulations (Chapter 4-2) contains special provisions regarding the provision of medical information to medical practitioners and psychologists for additional opinions.

Section 14 of the Regulations provides that an individual who is given access to personal information relating to his physical or mental health may be required to examine the information in person and in the presence of a duly qualified medical practitioner or psychologist who may explain or clarify the information to the individual.