PCO ordered to release more historic intelligence records after harm claims fail

The Privy Council Office was ordered to disclose more information from intelligence minutes dating to 1984 and 1985 after the Information Commissioner found that secrecy claims were not supported by evidence of likely harm.

In Privy Council Office (Re), 2026 OIC 52, dated March 12, the commissioner also refused to consider new withholding arguments presented after the investigation had concluded and an initial report had been issued.

The request sought Joint Intelligence Committee minutes for the two-year period. PCO had already released additional information in August 2024 but maintained several exemptions. The final outcome did not require every remaining redaction to be removed: statutory protection for certain CSIS employee identities was upheld, and some personal information was outside the complaint’s scope.

Past disclosures undermined harm claims

The commissioner rejected PCO’s claim that foreign liaison officers’ titles had been obtained in confidence. Comparable titles had been disclosed by Canada and allied countries. PCO had not supplied specific evidence establishing confidentiality in the records at issue.

Information about visits by foreign intelligence-community members similarly lacked demonstrated foreign provenance or an expectation of confidentiality. The visits appeared to have been organized by Canada, and examples of comparable visits had already been released elsewhere.

National-security and international-relations arguments also failed for the disputed material. PCO suggested that attendance information could reveal which topics Canada was willing to discuss with particular allies, potentially damaging intelligence-sharing relationships. The commissioner found that argument speculative in light of existing public information and previous disclosures without apparent harm.

Similar problems affected claims about distribution markings, historical CSE employee names, report titles and intelligence relationships. Past disclosure was relevant, and PCO did not adequately connect the particular information to probable injury. For report titles, the records did not disclose the reports’ contents, and no ongoing operational relevance was established.

The commissioner distinguished the decades-old personnel information from current or recent CSE identities, for which risks could be easier to establish. The conclusion was specific to the historical records and the evidence provided.

PCO’s law-enforcement exemption also failed. It did not establish a clear connection between release of the old information and harm to current or future investigations, or sufficiently explain how disclosure would create the alleged vulnerabilities.

Some identity protections survived

The commissioner treated the personal-information issues separately. Information about an employee’s actions in an official role fell within the relevant Privacy Act exception and was ordered disclosed. On another page, the information qualified as personal information, but PCO had to reconsider its disclosure discretion after failing to account for all relevant circumstances.

The commissioner consulted the Privacy Commissioner on those two issues, and the offices agreed on the assessments.

A different statutory rule protected CSIS identities. The commissioner confirmed that the names withheld under subsection 24(1) were those of employees who had been, were or were likely to become involved in covert operational activities. That withholding was upheld.

Initial report was not another submissions round

The commissioner issued her initial report on Jan. 16. Instead of providing the required implementation notice, PCO officials advanced a further confidentiality argument on Feb. 27 for information previously defended on national-security grounds.

The commissioner said PCO had already received its opportunity to make representations during the investigation. The initial report required a response explaining implementation or reasons for not acting; it did not reopen the merits for new exemptions or arguments. PCO had not explained why its submissions were not made earlier.

The final order required specified disclosure, reconsideration of discretion over one personal-information redaction and a new response within 36 business days. The commissioner directed PCO to seek Federal Court review if it did not intend to comply fully. The report does not establish whether disclosure followed or whether a review was sought.