Shared Services Canada was ordered to disclose portions of Gartner cloud-economics reports after the federal information commissioner rejected efforts to withhold most pages in full.
The February 23, 2026 report, Shared Services Canada (Re), 2026 OIC 21, did not require release of all the consultancy material. The Information Commissioner of Canada accepted protection for some confidential commercial information and directed a fresh discretionary decision on security measures that qualified for a separate exemption.
The result draws a line between particular information that meets a statutory exemption and broader claims that a commercially prepared report should remain confidential in its entirety.
The dispute concerned reports purchased by government
The access request sought a full cloud-economics report Gartner provided between July and October 2022. The reasons examine the material across three reports, including project-specific advice, government information, administrative details and research content.
The requester stopped challenging personal-information redactions. Shared Services Canada stopped relying on an exemption for third-party negotiations but invoked an offence-prevention exemption for particular security information. Gartner also advanced trade-secret, commercial-confidentiality and financial-harm arguments.
Gartner said some graphics and diagrams reflected confidential outputs from its consulting tools. It argued that a technically sophisticated competitor could reverse-engineer its algorithm or internal application from the outputs.
The commissioner accepted that the algorithm and application were tools, but found Gartner had not explained how the disclosed outputs would reveal them or allow the proposed reverse-engineering. The trade-secret claim therefore failed on the evidence presented, without a finding that Gartner had no proprietary technology.
Some commercial information remained protected
A different exemption protects qualifying confidential financial, commercial, scientific or technical information supplied by a third party and consistently treated as confidential. The commissioner accepted that much of the report material was commercial, financial or technical and that some of it met the full test.
Administrative details, generic headings, certain introductory material and file names did not qualify simply because they appeared in commercial reports. Information originating with federal institutions also required separate analysis rather than being treated automatically as Gartner-supplied information.
The commissioner rejected the requester’s suggestion that information bought by government could never count as information supplied by a third party. Purchase alone did not remove the possibility of protection.
But confidentiality labels and proprietary disclaimers were not sufficient by themselves to establish the expected confidentiality of every part of the reports. For certain project-specific recommendations paid for by government, the parties had not explained why the material should be wholly shielded from access.
Gartner’s consistent confidentiality practices were accepted, and the remaining information meeting all requirements stayed protected. Because that exemption applied to the protected balance, the commissioner did not need to decide every overlapping exemption asserted for the same material.
Claims of competitive and reputational harm needed evidence
For material not otherwise protected, Gartner argued that disclosure could undermine consulting revenue, help competitors replicate its approach or produce misleading coverage damaging its reputation. It also raised concerns about the value of research drawn from service providers.
The commissioner required a clear connection between specific information and reasonably probable harm. Gartner had not established how advice tailored to Shared Services Canada would cost it other clients, which proprietary elements competitors could replicate, or how government-department breakdowns would cause the asserted service-provider harms.
The report also rejected an assumption that news coverage would be unfair or damaging. The possibility that released information might be misunderstood did not itself establish the financial or competitive harm required by the exemption.
Shared Services Canada argued that separating minor administrative details would give the requester repetitive, low-value information. The commissioner found that the releasable material went beyond page numbers and logos and included substantive government information and project-specific advice. Withholding most pages in full did not satisfy the statutory duty to sever and disclose non-exempt information.
Security discretion and disclosure orders were distinct
The commissioner accepted that detailed security measures on one page could facilitate an offence if disclosed. However, Shared Services Canada had not shown that it considered the relevant factors when deciding to withhold them. The order required it to exercise that discretion again; it was not an unconditional direction to publish those measures.
The other orders required disclosure of specified administrative details, government-funded project-specific advice and government-supplied information. They did not authorize release of every part of the reports or eliminate the accepted commercial-confidentiality protection.
After the January 20 initial report, Shared Services Canada said on February 18 that it would implement the orders. The final report provided 35 business days for the requester or institution to seek Federal Court review, followed by a further 10 business days for third parties if neither did. The orders would take effect on the 46th business day if no review application was made.
The report does not establish whether the ordered disclosures later occurred. Its significance is the required information-by-information assessment: commercial origin, a confidentiality label or a general harm claim does not replace proof that a particular statutory exemption applies.
