Language selection

OPC Logo Office of the Privacy Commissioner of Canada

Search

Immigration, Refugees and Citizenship Canada systematically withholds access to certain personal information in its Global Case Management System

Complaint under the Privacy Act (the “Act”)

March 26, 2026

Description

The OPC found that IRCC was systematically retrieving and processing only a subset of records contained in a short form in response to requests for immigration files. These requests related to things like visa applications. The institution proceeded in this manner even when individuals requested their entire file or specific content contained in the long form.

The content outside the short form can and does sometimes contain personal information individuals have a right to access, and therefore IRCC is not meeting its obligations under section 12 of the Privacy Act, which requires that government institutions provide individuals with access to their personal information under the government’s control, subject to certain exceptions.

While IRCC ultimately processed and provided the complainant with the entire long form in this case, it did not agree to implement the OPC’s recommendation to address the broader issue by updating its procedures to retrieve and process the long form in response to requests from individuals seeking access to their entire file.

As this is not the only complaint of this nature, the OPC continues to call on IRCC to implement the recommendation in order to bring itself into compliance with the Act.

Takeaways

  • Institutions’ procedures for responding to personal information requests must include reasonable steps to ensure that individuals receive all information they request that they have a right to access.

Report of findings

Overview

  1. The complainant’s representative (the complainant) alleged that Immigration, Refugees and Citizenship Canada (IRCC) improperly denied him access to his personal information under the Privacy Act (the Act) by failing to disclose the information he sought to obtain in response to P-2024-63516. Specifically, the complainant, familiar with the structure of IRCC and CBSA’s shared Global Case Management System (GCMS),Footnote 1 made a request for only the content of the “History Section” of his GCMS file.
  2. In response to the request, IRCC’s access to information and privacy office (ATIP office) did not retrieve or process the History Section of his GCMS file. By “process” we mean the activity of reviewing retrieved material to consider whether it contains the requester’s personal information and whether any exceptions to the right of access apply.
  3. Instead, IRCC retrieved and processed information from a subset of other sections of the complainant’s GCMS file. During the OPC’s investigation, IRCC indicated that to foster efficient and timely responses to requestors, its current policy is to retrieve and process only certain sections of individuals’ GCMS files in response to a request – what IRCC refers to as the “Short Form” GCMS Report. It indicated that it does this even when individuals request their whole file or request specific content – like the History Section – which can only be found in what IRCC refers to as the “Long Form” GCMS Report.
  4. IRCC argued that sections of individuals’ GCMS files outside the Short Form, including the History Section, either do not include personal information, or include only information that would always be redacted under exceptions to the right of access. It contends that retrieving and processing these records is therefore unnecessary.
  5. After investigating, the OPC does not accept the IRCC’s current practice as being compliant with its obligations to provide individuals with access to their personal information under Section 12 of the Act. First, our review of the History Section of the complainant’s GCMS file found that it did contain the complainant’s personal information. Second, while IRCC did not provide representations to the OPC about the applicability of exemptions in the specific case of the complainant, we found multiple instances over the last five years where IRCC released History Sections in their entirety to requesters under the Access to Information Act (which has very similar exceptions to the right of access). This demonstrates that History Sections are reasonably retrievable and can and do contain releasable personal information in at least some cases.
  6. In our view IRCC has an obligation to retrieve and process these records in order to meet its access obligations under Section 12 of the Act and we therefore find that it contravened the Act. To correct the matter, we recommended that IRCC (a) retrieve and process the History Section of the complainant’s GCMS file in response to P-2024-63516 (re: PA-069183) as the individual had requested and (b) immediately update its practices to retrieve and process all parts of individuals’ GCMS files that are responsive to individuals’ Privacy Act requests. With respect to recommendation a, the complainant informed the OPC that they received a copy of the Long Form including the history section on March 24, 2026. However, IRCC did not agree to implement recommendation (b) and we therefore consider this matter well-founded and not resolved.

Analysis

  1. As a preliminary matter, we note that the full text of the complainant’s access request included that “This request is ONLY for the “History Section” of the GCMS report. This section is crucial for fully grasping the decision-making process. If any part of the History Section is redacted, please provide a detailed explanation for each redaction, specifying the relevant provision of the Privacy Act and demonstrating how disclosure would genuinely cause harm or undue hardship.” The IRCC indicated that it interpreted this as a request for information about the decision-making process broadly, and that because its initial response included information about decision-making contained in other sections of the complainant’s GCMS file, it fulfilled the scope of the request despite not retrieving the History Section. We disagree. In our view it is evident on plain reading that the request was for the content of the History Section.
  2. Accordingly, we requested the full Long Form GCMS report to establish whether the History Section included the complainant’s personal information. Our review found that the History Section does contain the complainant’s personal information. Further, some of the personal information contained in the Long Form does not appear in the short form.
  3. The IRCC subsequently explained to the OPC that it has been its historical practice to retrieve and process only the Short Form GCMS Report in response to personal information requests. It noted that due to what it described as a technical glitch in 2019, this format of report was replaced with a longer output from the GCMS (the Long Form GCMS Report). For the next several years, IRCC’s ATIP Office retrieved and processed the Long Form GCMS Report in response to requests. In 2023, IRCC resumed retrieving and processing only the Short Form GCMS Report in response to requests.
  4. It clarified that even where requesters requested a specific section outside the short form, or requested the Long Form GCMS Report by name, it will no longer retrieve and process it. It indicated that retrieving and processing the Long Form Report would lengthen the processing times significantly and provided OPC with a copy of a Special Report (the GCMS document) that explained its approach to the GCMS reports.
  5. IRCC asserted that whether it processed the Short Form or the Long Form GCMS Report makes no difference to what requesters are ultimately provided. It said that the additional information in the Long Form Reports would be routinely withheld as (a) disclosure would undermine the integrity of IRCC’s systems and processes, and (b) not all of the information contained in the Long Form is necessarily generated by IRCC, but rather, may come from other security, intelligence and investigative partners and therefore would be exempt from disclosure.
  6. However, we found evidence that in numerous cases, both historically and currently, IRCC has released content in the Long Form that is not in the Short Form. This demonstrates that in at least some cases these sections of individuals’ GCMS Reports contain releasable information.
  7. Specifically:
    1. In 2022, the Office of the Information Commissioner of Canada published a report with respect to access requests (under the Access to Information Act) for content in the History Sections of 64 individuals’ GCMS Reports. It reported that during the OIC investigation, after numerous attempts to justify withholding the content from requesters, IRCC ultimately released all of the 64 history sections in their entirety.
    2. More recently, the complainant provided the OPC with copies of two other Long Form GCMS Reports generated and released by IRCC in June and October 2025.Footnote 2
  8. In our view it is therefore inaccurate to say that content outside the Short Form is always withheld from requesters and that therefore retrieving and reviewing it for releasable personal information serves no purpose. We appreciate IRCC’s goal of streamlining processes for responding to requests under the Act to gain efficiency, but in this context, we are of the view that this approach means that IRCC is failing to fulfil its obligations under the Act to ensure it provides requesters all personal information they are entitled to receive.
  9. Therefore, as communicated during the course of the investigation, we issued a preliminary report of findings to IRCC recommending that IRCC:
    1. Retrieve and process the history section of the Long Form in response to P-2024-63516 (re: PA-069183) as the individual had requested; and
    2. Commit to updating its procedures and immediately begin retrieving and processing the Long Form in response to all requests it receives where it previously only produced a short form.
  10. With respect to recommendation (a) the complainant advised the OPC that they had received the requested information.
  11. However, with respect to recommendation (b) the OPC did not receive a response by IRCC to the recommendation despite follow-ups and a courtesy extension of the deadline to respond. We therefore find that this matter is well-founded and not resolved. We continue to call on the IRCC to implement the outstanding recommendation promptly to bring IRCC into compliance with the requirements of Section 12 of the Act.
Date modified: