Canada Revenue Agency and the Canadian Broadcasting Corporation (CBC)

Complaint under the Privacy Act (the Act)

Introduction

1. This Report of Findings relates to complaints against the Canadian Broadcasting Corporation (CBC) in relation to a privacy breach at the Canada Revenue Agency (CRA) wherein the personal information of taxpayers' was inadvertently mailed to a CBC journalist.
2. As a result of the CRA breach, the CBC subsequently published an article on November 25, 2014 wherein it provided details of the breach, identified several of the individuals affected by the breach, and also published the portraits of six of the affected individuals.
3. The complainants allege that the CBC is in contravention of the Privacy Act for disclosing details of the breach and identifying some of the affected individuals in the media.

Background

4. On November 25, 2014, the CBC published an article entitled, "Canada Revenue Agency privacy breach leaks prominent Canadians' tax details: Business leaders, art collectors, authors and politicians among more than 200 on agency's list of donors".
5. The CBC reported that the highly confidential details, including home addresses of taxpayers and the value of tax credits they were granted, were contained in a copy of a CRA spreadsheet covering the years 2008 to 2013.
6. The CBC states that the unredacted list, delivered to CBC in digital format, was an erroneous response to a request for unrelated records under the Access to Information Act.
7. The CBC goes on to note that the list included information on donations made by Canadian luminaries, identifying several of the individuals in the article, and including portraits of six of the affected individuals. The CBC states that it is withholding most details from the list, apart from the names of some of the people cited, out of respect for privacy.
8. 8. Between November 26, 2014 and the date of this Report, nine individuals filed complaints with the Privacy Commissioner in relation to the CBC's role in the incident.

Summary of Investigation

9. On November 25, 2014, the Office of the Privacy Commissioner of Canada (OPC) was verbally advised by the CRA of a privacy breach. Formal written notification was subsequently received from the CRA on November 26, 2014.
10. Our investigation confirmed that, in preparing a package to respond to an Access to Information and Privacy (ATIP) request, and simultaneously preparing a consultation review package for a government institution, the consultation package was provided to the ATIP requester, confirmed to be a CBC journalist.
11. The information mailed in error to the CBC journalist included the name, address, a description of the donation(s), the donation's proposed fair market value, and the donation's fair market value as determined by the Canadian Cultural Property Export Review Board, of the affected individuals.
12. As a result of the incident, the CBC published an article on November 25, 2014, wherein it reported details of the breach, including the names and photographs of some of the individuals affected by the breach.
13. According to representations received from the CBC, it was approached on two occasions by the CRA and requested to return the information mailed in error.
14. On November 25, 2014, the CBC's ATIP Director was asked to retrieve the package addressed to the journalist from the CBC's mailroom. According to the CBC, it considered this demand to be highly inappropriate.
15. The second request for the return of the information was also made on November 25, 2014, in a letter from the Commissioner of the CRA to CBC's Chief Executive Officer (CEO). This request was also declined in the CBC's reply to the CRA on November 26, 2014.
16. According to the CBC, the information mailed to the CBC journalist was obtained legally. The journalist is not bound to the obligations of the CRA to protect from unauthorized disclosure the personal information under its control which was transmitted in error. The CBC cites Globe and Mail v. Canada (AG), 2010 SCC 41, in which the Supreme Court held that it may be acceptable for a journalist to publish information even when the source that provided it violated a confidentiality obligation in doing so.
17. In representations to our Office, the CBC further submits that the Privacy Act does not apply in the present situation since this is clearly covered by the exclusion provision under 69.1 of the Act.

Application

18. In making our determination, we considered sections 3, 4, 7, 8 and 69.1 of the Privacy Act.
19. Section 3 of the Act defines personal information as information about an identifiable individual that is recorded in any form including, without restricting the generality of the foregoing: information relating to race, national or ethnic origin, colour, religion, age, marital status, education, medical, criminal or employment history, financial transactions, identifying numbers, fingerprints, blood type, personal opinions, etc.
20. Under section 4 of the Act, no personal information shall be collected by a government institution unless it relates directly to an operating program or activity of the institution.
21. Paragraph 7(a) of the Act states that personal information shall not, without the consent of the individual to whom it relates, be used by the institution except for the purpose for which the information was obtained or compiled by the institution or for a use consistent with that purpose.
22. the Act states that personal information can only be disclosed with an individual's consent - subsection 8(1) - or in accordance with one of the categories of permitted disclosures outlined in subsection 8(2) of the Act.
23. According to section 69.1 of the Act, the Act does not apply to personal information that the CBC collects, uses or discloses for journalistic, artistic or literary purposes and does not collect, use or disclose for any other purpose.

Analysis

24. Our investigation confirmed that on November 25, 2014, the personal information of taxpayers' was inadvertently mailed by the CRA to a CBC journalist.
25. Specifically, in preparing a response to an ATIP request, and simultaneously preparing a consultation review package for a government institution, the CRA provided the consultation package to the ATIP requester, confirmed to be a CBC journalist.
26. The information mailed in error to the CBC journalist - including the name, address, description of donation(s), the donation's proposed fair market value, and the donation's fair market value as determined by the Canadian Cultural Property Export Review Board of the affected individuals - is clearly personal information as defined under section 3 of the Act.
27. While the Act governs the personal information handling practices of federal government institutions, including the CBC, it does not apply to personal information that the CBC collects, uses or discloses for journalistic, artistic or literary purposes.
28. Following our review of the circumstances of the incident and the representations submitted by the CBC, we are of the view that the purpose of the collection by the CBC, and the purpose behind the CBC's subsequent disclosure of some of the personal information in an article on November 25, 2014, was purely journalistic.
29. Consequently, we are of the view that the personal information in question is covered by the exclusion provision under section 69.1 of the Act, and is therefore excluded from the application of the Act.

Findings

30. Given that the information in question is excluded from the Act, this Office does not have authority over the CBC's handling of the personal information in this case.
31. Accordingly, we have concluded that the matter is not well-founded.