Investigation into the denial of access to a child’s personal information by Immigration, Refugees and Citizenship Canada

Complaint under the Privacy Act (the Act)

June 26, 2024

---

Description

The complainant submitted an Access to Information and Privacy (ATIP) request to Immigration, Refugees and Citizenship Canada (IRCC) to obtain his minor child’s passport application, that was submitted by his former spouse. In support of his request, he provided a court order that allowed him to receive his children’s information from third parties. IRCC refused to provide the information without the child’s consent. We found that the complainant did not have a right of access to his child’s personal information under the Act as the ATIP request was not made on behalf of the child, a condition set out in the Regulations.

Takeaways

• Paragraph 10(a) of the Privacy Regulations does not automatically grant a parent the right to access their child’s personal information.
• This right is subjected to three conditions set out in the Regulations, one of which is that the request should benefit the child, further their own goals or objectives and be in their best interests.
• Requesting consent from a minor, in accordance with their age and maturity, is a way to prevent the unauthorized disclosure of their personal information.

Report of findings

Overview

Through a court issued order made in 2019, and in the context of a separation and custody dispute, the complainant received authorization to obtain information concerning his children directly from third parties including, but not limited to, teachers, counsellors, medical professionals, and third-party caregivers. A subsequent court order made in 2021 granted the children legal representation so that they could be heard, and their opinions be considered in the matters opposing their parents. This did not alter the right of the complainant to obtain information from third parties.

With the 2019 court order in hand, on August 19, 2021, the complainant submitted an Access to Information and Privacy (“ATIP”) request to Immigration, Refugees and Citizenship Canada^{Footnote 1} (“IRCC”) to obtain a copy of one of his children’s passport application, namely to obtain evidence that he had not signed his child’s passport application, claiming that both parents should have signed it. IRCC denied his request.

While IRCC initially responded to the complainant that information about minors can be released with the support of a valid court order indicating that the requestor is authorized to receive it (or alternatively with the consent of both parents), in its subsequent response to the complainant on November 8, 2022, IRCC explained that it generally requires the consent of the individual to release their information, which in this case was deemed required based on the age of the child. IRCC noted that the child could also submit their own ATIP request or provide a signed consent form to authorize the complainant to receive their information.

The complainant alleges that IRCC improperly denied him access to the requested information, even though a provincial Supreme Court order granted him a right of access to all records pertaining to his child.

At issue, therefore, is whether the complainant had a right of access to his child’s personal information under section 10 of the Privacy Regulations (the “Regulations”). This section provides three avenues to access another individual’s personal information. More specifically, paragraph 10(a) permits the exercise of the rights under the Act and its Regulations on behalf of a minor or an incompetent person, including the right of access under subsection 12(1) of the Act^{Footnote 2}.

After considering the facts and the submissions of both parties, we determined that the complainant did not have the right to access his child’s personal information since the third requirement of paragraph 10(a) of the Regulations, that the request should be made on the child’s behalf, was not met. Accordingly, we find that the complaint is not well-founded.

Analysis

1. The complainant argues that he was entitled to receive the information because the provincial Supreme Court order granted him access to his child’s personal information, without requiring the child’s consent.
2. In its submissions to the OPC, IRCC argued that the complainant did not demonstrate that he had a right of access to the requested information and noted that releasing the record, without the child’s consent, would contravene section 8 of the Act. In IRCC’s view, while the initial court order did provide the complainant access to his children’s information generally, the court order did not supersede the requirements set out in the Act. It also explained that a more recent court order gave the complainant’s child legal representation to have their opinion included in the context of the parents’ legal proceedings.
3. In order to determine if the complainant had a right of access to his child’s personal information under the Act, we examined the requirements of paragraph 10(a) of the Regulations and the decision-making capacity of the child.

Requirements of paragraph 10(a) of the Regulations

4. Although the provincial Supreme Court established that the complainant had the right to obtain information about his child from third parties, we note that the requirements of the Act must be met to have a right of access to the records under the control of IRCC. Paragraph 10(a) of the Regulations has been described by the Federal Court^{Footnote 3} as granting access without consent “to another individual’s personal information for [a] limited purpose”. More specifically, it permits the exercise of the right of access on their behalf if three conditions are met.
5. First, the request should relate to a “minor or an incompetent person”. In this case, we are satisfied that the complainant’s child was a minor^{Footnote 4} when he submitted the ATIP request to IRCC, and that this requirement was met.
6. Second, the individual making the request should have the legal authorization to administer their affairs. The complainant did demonstrate that he had the legal authorization to administer the child’s affairs on the basis of a court order issued by a provincial Supreme Court.
7. Finally, the individual making the request should exercise the right of access on the minor’s behalf. The expression “on behalf of a minor” is not defined by the Regulations nor the Act. Therefore, to determine how to apply this requirement, we reviewed decisions rendered under different legal frameworks but in similar contexts. For instance, the Office of the Information and Privacy Commissioner of British Columbia has interpreted the meaning of acting “for” or “on behalf of” as “acting to benefit the child, to further the child’s own goals or objectives and in the child’s best interests”^{Footnote 5}.
8. In his submissions to the OPC and exchanges with IRCC, the complainant admitted that the information he requested was for his own interests, namely to initiate an investigation into what he characterized as a “fraudulent passport application” submitted by his former spouse, to which he alleged not consenting to. As such, he did not make any representation to IRCC nor to the OPC to substantiate that he was making the request on behalf of his child.
9. Considering the foregoing, we find that the third requirement was not met. Therefore, we find that the complainant did not have a right of access to his child’s personal information under paragraph 10(a) of the Regulations.

Decision-making capacity of the child

10. In its submissions to the OPC, IRCC noted that it asked the complainant to provide the child’s written consent to release the child’s personal information, and explained to the complainant that releasing the requested information without the child’s consent would contravene section 8 of the Act. To support this position, IRCC noted that the child had decision-making capacity to provide consent in the context of this ATIP request, not only because they were over the age of 16 at the time of the request but also because they had requested their own legal representations in the proceedings between their parents. We considered the above as well in the context of our own analysis.
11. While the wording of section 10 of the Regulations implies a connection between minors and the lack of competence, there is a growing recognition in Canadian law of minors’ ability to make decisions where they have the requisite capacity, intelligence, and maturity.
12. For example, to describe the “mature minor” common law doctrine in the medical context, the Supreme Court has stated that:
    

    The common law has more recently abandoned the assumption that all minors lack decisional capacity and replaced it with a general recognition that children are entitled to a degree of decision-making autonomy that is reflective of their evolving intelligence and understanding […]^{Footnote 6}

13. It should be noted that Canadian law acknowledges the ability of mature minors to make decisions about critical matters such as their own medical treatment. Therefore, it is our view that minors who have the ability and desire to do so should be involved in the decision making about accessing their personal information as well.
14. In addition, IRCC pointed out that the provincial Supreme Court cited article 12 of the United Nations Convention on the Rights of the Child^{Footnote 7} (“CRC”) when it ordered independent legal counsel for the complainant’s child in the context of the parents’ legal proceedings.
15. Children’s evolving decision-making capacity is widely recognized in the CRC, which, even though not directly binding in Canada^{Footnote 8}, has been cited frequently by the Supreme Court as a guide to the interpretation of various domestic laws affecting children.
16. We note that the Privacy Act and its Regulations should be interpreted in a manner that is consistent with the CRC to provide the opportunity for a child to be heard in judicial or administrative matters that affect them, and more specifically that their views should be given due weight in accordance with the child’s age and maturity.
17. In light of the above, we accept IRCC’s arguments and conclude that, based on the likelihood that the child had the capacity to give consent given their age and desire to be legally represented in the matters opposing their parents, the complainant’s child’s consent was required for IRCC to share their personal information with their father.

Conclusion

18. Paragraph 10(a) of the Regulations should not be read as automatically granting a parent a right of access to their child’s personal information. It is a limited mechanism to exercise the right of access to another individual’s personal information under specific circumstances.
19. Following the analysis of the facts and representations made by both parties, we were able to determine that the request was not being made on the child’s behalf in this case. We therefore conclude that it was reasonable for IRCC to require the child’s consent to process the ATIP request and, accordingly, to deny access to the information without it. More specifically, since the conditions of section 10 of the Regulations were not met nor any exceptions of subsection 8(2) of the Act, the only alternative available to IRCC was to require the child’s consent.
20. Since IRCC did not receive confirmation of the child’s consent to the release of their personal information, and because we determined that the third requirement set in paragraph 10(a) of the Regulations was not met, we conclude that the complainant did not have a right of access to his child’s personal information. Moreover, we note that IRCC’s decision to deny the complainant access to their child’s personal information was privacy-protective and was consistent with the objectives of the Act. Accordingly, we find the complaint to be not well-founded.
21. We note that the complainant’s child had reached the age of majority at the time of writing this report. Therefore, while we examined the denial issue based on the facts at the time the complainant filed his ATIP request, the current analysis would no longer be applicable since the first requirement set in paragraph 10(a) of the Regulations can no longer be met after that the child has reached the age of majority.