Privy Council Office (Re), 2024 OIC 17
Date: 2024-04-23
OIC file number: 5823-02861
Institution file number: A-2023-00293
Summary
The complainant alleged that the Privy Council Office (PCO) did not conduct a reasonable search in response to an access request under the Access to Information Act for all emails sent to or from PCO related to the "[Canadian Security Intelligence Service] CSIS Issues Management Brief" with subject "Defensive briefings to two Members of Parliament regarding PRC foreign interference activity," which was sent by CSIS to PCO on 2021-05-31. The allegation falls within paragraph 30(1)(a) of the Act.
The investigation determined that the Security and Intelligence Unit did not retrieve all relevant records when they were tasked with the retrieval of responsive records. PCO was unable to show that it conducted a reasonable search for records responsive to the access request. The Office of the Information Commissioner asked PCO to conduct a second search for all relevant records. As a result, 11 pages of additional records were found within the Security and Intelligence Unit.
The Information Commissioner ordered that PCO provide a new response to the access request on the 36th business day following the date of the final report.
PCO gave notice to the Commissioner that it would be implementing the order.
The complaint is well founded.
Complaint
[1] The complainant alleged that the Privy Council Office (PCO) did not conduct a reasonable search in response to an access request under the Access to Information Act for all emails sent to or from PCO related to the "[Canadian Security Intelligence Service] CSIS Issues Management Brief" with subject "Defensive briefings to two Members of Parliament regarding PRC foreign interference activity," which was sent by CSIS to PCO on 2021-05-31. Timeframe: from 2021-05-14 to 2021-08-31. Search words: defensive briefing, defensive briefings, Michael Chong, Kenny Chiu, MSS, foreign interference threat actors, CSIS Issues Management Brief, CSIS IMB, Defensive briefings to two Members of Parliament regarding PRC foreign interference activity.” The allegation falls within paragraph 30(1)(a) of the Act.
Investigation
[2] PCO was required to conduct a reasonable search for records that fall within the scope of the access request—that is, one or more experienced employees, knowledgeable in the subject matter of the request, must have made reasonable efforts to identify and locate all records reasonably related to the request.
[3] A reasonable search involves a level of effort that would be expected of any fair, sensible person tasked with searching for responsive records where they are likely to be stored.
[4] This search does not have to be perfect. An institution is therefore not required to prove with absolute certainty that further records do not exist. Institutions must however be able to show that they took reasonable steps to identify and locate responsive records.
Did the institution conduct a reasonable search for records?
[5] PCO provided the Office of the Information Commissioner (OIC) with detailed representations regarding which Secretariats were tasked and why, dates of searches conducted, which information management systems were searched, the date ranges that were searched, and what keywords were used to conduct the search.
[6] PCO’s Access to Information and Privacy (ATIP) Office tasked the following Offices of Primary Interest (OPIs):
- IM Operations;
- Security and Intelligence;
- Emergency Preparedness;
- The Office of the National Security and Intelligence Advisor to the Prime Minister;
- Foreign Defence Policy.
[7] PCO stated that no further OPIs were flagged as potential record holders. PCO further advised that the ATIP liaison contact for each OPI ensured that the appropriate subject matter experts in each OPI were aware of the request.
[8] PCO confirmed that the databases searched included inboxes on all available networks, internal drives, GCDocs, and SharePoint. PCO further confirmed that the timeframe used in the search for records was May 14, 2021 to August 31, 2021, as outlined in the access request text, and that all of the keywords outlined in the access request text were used in the searches.
[9] At the time of the initial tasking, all OPIs provided a NIL response, with the exception of Foreign Defence Policy, who provided records relevant to internal Crisis Management Cell Notifications and media requests. These records were deemed not relevant to the access request.
[10] The OIC sought representations from the complainant to understand which records they believed to be missing from the response, and why. The complainant was of the view, based on the response to a separate access request with CSIS, that PCO should have retrieved emails relevant to the request, at a minimum. The complainant provided evidence that indicated that PCO may hold relevant records.
[11] As a result, PCO completed a second search for records. During this second search for records, the Security and Intelligence Unit found 11 pages of relevant records. Of these pages, PCO indicated that two pages were duplicates, two pages had already been processed and provided to the complainant through an access request with CSIS, and two pages were identical to those released by CSIS with a minor difference. The remaining five pages of records would require consultation with CSIS. PCO contacted CSIS when determining a time frame for the consultation.
[12] PCO said that it would provide additional records in response to the access request by no later than April 12, 2024.
[13] In light of the above, I conclude that a reasonable search was not conducted when PCO initially processed the access request.
Outcome
[14] The complaint is well founded.
Orders and recommendations
I order the Clerk of the Privy Council to:
- Provide a new response to the access request on the 36th business day following the date of the final report.
- Give access to additional responsive records identified during the second search for records, unless access to them, or to part of them, may be refused under a specific provision(s) of Part 1 of the Act. When this is the case, PCO must name the provision(s) of the Act.
Initial report and notice from institution
On March 7, 2024, I issued my initial report to the Clerk of the Privy Council setting out my orders.
On April 15, 2024, the Assistant Secretary to the Cabinet, Ministerial Services and Corporate Affairs, gave me notice that PCO would be implementing the order. He stated that nine pages of additional records had been located and consultations had been completed with CSIS. The Assistant Secretary to the Cabinet, Ministerial Services and Corporate Affairs further stated that PCO will now proceed by expediting the review and seeking delegated authority approval from PCO’s Security and Intelligence Secretariat in order to provide a new response to the request.
Review by Federal Court
When an allegation in a complaint falls under paragraph 30(1)(a), (b), (c), (d), (d.1) or (e) of the Act, the complainant has the right to apply to the Federal Court for a review. When the Information Commissioner makes an order(s), the institution also has the right to apply for a review. Whoever applies for a review must do so within 35 business days after the date of this report and serve a copy of the application for review to the relevant parties, as per section 43. If no one applies for a review by this deadline, the order(s) takes effect on the 36th business day after the date of this report.