Canada Border Services Agency (Re), 2024 OIC 09
Date: 2024-03-25
OIC file number: 5822-05417
Institution file number: A-2022-15630
Summary
The complainant alleges that the Canada Border Services Agency (CBSA) did not conduct a reasonable search in response to an access request under the Access to Information Act. This was in response to a request for any assessments of cybersecurity and data breach risks associated with the ArriveCan application.
The complainant questioned the fact that they have received no information regarding specific named companies and/or expenses which they felt should have been found in the documents received, given the subject of their access request.
The OIC sought information from CBSA related to the program areas tasked to search for records and the parameters of the search. The OPI most likely to have records relevant to the access request under their control, searched for records in the appropriate repositories and provided these records to the Access to Information and Privacy unit for processing. As a result, the Information Commissioner concluded that CBSA conducted a reasonable search for records.
The complaint is not well founded.
Complaint
[1] The complainant alleges that the Canada Border Services Agency (CBSA) did not conduct a reasonable search in response to an access request under the Access to Information Act. This was in response to a request for any assessments of cybersecurity and data breach risks associated with the ArriveCan application. The complaint falls within paragraph 30(1)(a) of the Act.
[2] The Office of the Information Commissioner (OIC) is separately investigating the complainant’s allegation that CBSA improperly applied exemptions to withhold information in response to the same request (OIC 5822-05416).
Investigation
Reasonable Search
[3] CBSA was required to conduct a reasonable search for records that fall within the scope of the access request—that is, one or more experienced employees, knowledgeable in the subject matter of the request, must have made reasonable efforts to identify and locate all records reasonably related to the request.
[4] A reasonable search involves a level of effort that would be expected of any fair, sensible person tasked with searching for responsive records where they are likely to be stored.
[5] This search does not have to be perfect. An institution is therefore not required to prove with absolute certainty that further records do not exist. Institutions must, however, be able to show that they took reasonable steps to identify and locate responsive records.
Did the institution conduct a reasonable search for records?
[6] The complainant questioned the fact that they have received no information regarding specific named companies and/or expenses which they felt should have been found in the documents received, given the subject of their access request.
[7] During the course of the investigation, the OIC requested all the documentation related to CBSA’s search for responsive records.
[8] I examined the responses of the Office of Primary Interest (OPI) to determine whether they had fulfilled their obligations under the Act to identify records relevant to the access request, under their control. More precisely, I note that it is the Information, Science and Technology Branch that was tasked with retrieving documents responsive to the request. A total of 896 pages of documents were provided and processed. Out of the 896 pages, 70 were partially released, the remainder were fully withheld under subsection 16(2) and paragraph 20(1)(d). As mentioned above, the application of these exemptions to withhold information are the subject of another investigation.
[9] Having reviewed the 896 pages of documents in full and the submissions provided by CBSA, I am satisfied that CBSA has conducted a reasonable search in this particular case. Specifically, I am satisfied that the OPI most likely to have records relevant to the access request under their control, namely the Information, Science and Technology Branch, has searched for records in the appropriate repositories. I note that the OPI provided these records to the Access to Information and Privacy unit for processing. The records responsive to the request have been provided to the complainant.
[10] As a result, I conclude that CBSA conducted a reasonable search for records.
Outcome
[11] The complaint is not well founded.
Review by Federal Court
When an allegation in a complaint falls under paragraph 30(1)(a), (b), (c), (d), (d.1) or (e) of the Act, the complainant has the right to apply to the Federal Court for a review. The complainant must apply for this review within 35 business days after the date of this report and must serve a copy of the application for review to the relevant parties, as per section 43.