Investigation into the Canada Revenue Agency’s application of paragraph 22(1)(b) to refuse access to personal information

Complaint under the Privacy Act (the Act)

February 26, 2025

---

Summary

The complainant alleged that the Canada Revenue Agency (the CRA) improperly denied them access, under the Privacy Act (the Act), to personal information related to five grievances. The CRA relied on exceptions in subsection 12(1), paragraph 22(1)(b), and section 26 of the Act to withhold portions of the requested information.

After review, we found that the CRA had conducted reasonable searches to identify responsive records but failed to substantiate its use of some exemptions. Notably, the CRA relied on paragraph 22(1)(b) to withhold information across dozens of pages, including factual details and internal correspondence related to the complainant’s grievances. Much of this information was transactional in nature, involved input from others, and documented the progression of the grievances. The CRA did not demonstrate a clear and direct connection between disclosure and a risk of harm in each instance, instead relying on general assertions of harm. Therefore, we concluded that the complainant did not receive all the personal information they were entitled to and found the complaint well‑founded.

In light of our findings, we recommended that the CRA reassess its reliance on paragraph 22(1)(b) of the Act and disclose as much information as possible.

The CRA agreed to release some information, but it maintained its use of paragraph 22(1)(b) on the remainder of the information it withheld under that provision, arguing that its initial assessment was correct. Therefore, we consider the complaint unresolved.

Takeaways regarding paragraph 22(1)(b)

• Threshold for Harm – To justify withholding information under paragraph 22(1)(b) of the Act, a government institution must establish a clear and direct connection between disclosure and a risk of harm beyond mere possibility or speculation. General assertions are insufficient.
• Ongoing Investigations Are Not Enough – The mere fact that an investigation is ongoing does not automatically meet the threshold for harm. The institution must demonstrate how disclosure would cause actual harm.
• Burden of Proof on Institution – The institution invoking paragraph 22(1)(b) must provide evidence that disclosure would be injurious to the enforcement of any law of Canada or to the conduct of lawful investigations. Simply stating that harm could occur is not enough.
• Potential for Strategic Advantage is Insufficient – The argument that disclosure could allow a complainant to adjust their strategy before a grievance board does not in itself meet the threshold for harm under paragraph 22(1)(b) of the Act. The exemption is meant to protect the integrity and effectiveness of law enforcement and investigations, not shield institutions from potential disadvantages in legal proceedings.
• Professional Expertise Must Be Substantiated – While the opinions of subject-matter experts (e.g., labour relations officials) can help support an exemption claim, their expertise alone may not be enough. The institution must clearly explain how the disclosure would be injurious to the enforcement of any law of Canada or to the conduct of lawful investigations.
• Case-by-Case Assessment Required – The application of paragraph 22(1)(b) must be evaluated on a case-by-case basis. Blanket application without specific justification is not valid under the Act.