Communications Security Establishment Canada (Re), 2024 OIC 18
Date: 2024-04-23
OIC file number: 5823-01652
Institution file number: A-2023-00014 (EA_2023_023211)
Summary
The complainant alleged that Communications Security Establishment Canada (CSE) did not respond to an access request submitted under the Access to Information Act within the 30-day period, as required by section 7. The request was for records related to a previous access request to CSE (A-2021-000036) expanding the time of search to the date the request was received. The allegation falls under paragraph 30(1)(a) of the Act.
The investigation determined CSE did not respond by the required date and is deemed to have refused access to the requested records under subsection 10(3). The delay was caused by a lack of responsiveness from two offices of primary interest.
The Information Commissioner ordered that CSE provide a response to the access request no later than the 36th business day following the date of the final report.
CSE gave notice to the Commissioner that it would be implementing the order.
The complaint is well founded.
Complaint
[1] The complainant alleged that Communications Security Establishment Canada (CSE) did not respond to an access request within the 30‑day period set out in section 7 of the Access to Information Act. The request was for records related to a previous access request to CSE (A-2021-000036) expanding the time of search to the date the request was received.
[2] The allegation falls under paragraph 30(1)(a) of the Act.
Investigation
Time limits for responding to access requests
[3] Section 7 requires institutions to respond to access requests within 30 days unless they have transferred a request to another institution or validly extended the 30-day period for responding by meeting the requirements of section 9. When an institution does not respond to a request within the 30-day or extended period, it is deemed to have refused access to the requested records under subsection 10(3).
[4] Nevertheless, the institution is still required to provide a response to the access request.
What is a response?
[5] The response must be in writing and indicate whether the institution is giving access to any or part of the requested records.
[6] When the response indicates that the institution has given access to the records or part of them, the institution must provide access to those records.
[7] When the response indicates that the institution has denied access to the records or part of them, the institution must explain that the records do not exist or that the institution has exempted them, or part of them, under a specific provision, which the institution must name.
[8] In specific circumstances, the institution may refuse to confirm or deny in its response whether records exist under subsection 10(2).
Did the institution respond within the time limits?
[9] CSE received the request on June 19, 2023, and neither extended the period within which it had to respond to the request under subsection 9(1) nor transferred the request. This means that the 30-day period to respond under section 7 still applied, making the due date July 20, 2023.
[10] CSE did not respond to the access request by that date. I conclude, therefore, that CSE is deemed to have refused access to the requested records under subsection 10(3).
[11] According to representations provided by CSE over the course of the investigation, three (3) Offices of Primary Interest (OPIs) were tasked to retrieve responsive records. So far, only one OPI (CSE Access to Information and Privacy) has returned records and begun processing. However, there is no confirmation that CSE Signals Intelligence or Legal Disclosures have responded to the retrieval tasking made on January 9, 2024. As such, CSE has only reviewed 50 pages of records with an unknown number still to be provided at an unconfirmed future date. CSE advised the Office of the Information Commissioner that a potential partial release of records may occur on or around February 9, 2024; however, CSE has not confirmed whether this occurred.
[12] I find the delay taken by the OPIs to retrieve all relevant records unacceptable. The lack of responsiveness from the OPIs has affected CSE’s ability to meet its obligation to ensure that this access request was responded to in accordance with the requirements of the Act. The Minister should remind his public officials of their responsibility in providing timely access to information to Canadians. The ATIP unit is not the only one responsible in ensuring that the Act is respected; it is a departmental and collective responsibility. It is up to the head of the institution, here the Minister of National Defence, to ensure that this is understood and respected within the institution.
[13] Considering the length of time that the response to the access request has been outstanding and CSE’s responsibility to provide the complainant with a timely response, I find that CSE must respond to the request without undue delay.
Outcome
[14] The complaint is well founded.
Order
I order the Minister of National Defence to provide a complete response to the access request no later than 36 business days after the date of the final report.
Initial report and notice from institution
On March 8, 2024, I issued my initial report to the Minister of National Defence setting out my order.
On April 11, 2024, the CSE Director, Transparency and Information Sharing, gave me notice that CSE would be implementing my order. In particular, CSE would provide a final release by no later than June 3, 2024.
Review by Federal Court
When an allegation in a complaint falls under paragraph 30(1)(a), (b), (c), (d), (d.1) or (e) of the Act, the complainant has the right to apply to the Federal Court for a review. When the Information Commissioner makes an order(s), the institution also has the right to apply for a review. Whoever applies for a review must do so within 35 business days after the date of this report and serve a copy of the application for review to the relevant parties, as per section 43. If no one applies for a review by this deadline, this order takes effect on the 36th business day after the date of this report.