CRA releases employee phone list after security-risk argument fails

The Canada Revenue Agency released employee work telephone numbers after the federal information commissioner rejected its argument that disclosure could facilitate hacking, fraud and other offences.

In Canada Revenue Agency (Re), 2026 OIC 48, dated March 31, 2026, the Information Commissioner of Canada found the access complaint well founded. CRA had already disclosed the disputed numbers during the investigation, making a final disclosure order unnecessary.

The decision did not find that cellphone attacks are impossible. It found that CRA had not connected the general risks it described to a sufficiently likely harm from releasing this particular list.

The dispute concerned one withheld column

The requester sought a telephone list for CRA’s headquarters International and Large Business Directorate, including employee names, titles, classifications, telephone numbers and reporting relationships. CRA released a table containing names, divisions, job titles, work email addresses and supervisor information, but withheld the phone-number column.

A separate allegation that CRA had not conducted a reasonable search was withdrawn from the investigation at the requester’s initiative. The final report therefore addressed the refusal to disclose the phone numbers, not whether additional records existed.

CRA relied on paragraph 16(2)(c) of the Access to Information Act. The relevant exemption permits withholding information whose disclosure could reasonably be expected to facilitate an offence. The institution must establish more than a merely possible harm; if the exemption applies, it must also reasonably decide whether to exercise its discretion to withhold.

General risks did not prove the required likelihood

CRA said circumstances had changed since earlier investigations in which it released similar information. Government employees now used cellphones instead of landlines, and disclosure could enable interception, phishing, identity theft, fraud or harassment. It supported its position with material about vulnerabilities in the Signalling System No.7 telecommunications network.

The commissioner accepted that the submissions described ways cellphone numbers might be used in offences, but found no clear and convincing evidence that the asserted harm was likely to occur from this disclosure.

Several features of the evidence mattered. The reported demonstration involved an unsecured phone rather than a Government of Canada device. CRA confirmed that it used encryption technologies and educated employees about mobile-device security. The commissioner also referred to federal device-protection requirements and security guidance.

The report further reasoned that the described attack depended on access to the telecommunications network, not simply possession of a particular number. The withheld list did not identify which numbers belonged to cellphones rather than landlines.

The commissioner also noted that some numbers were already publicly available in the federal directory. CRA said only a small proportion were public, but did not explain the inconsistency in treating comparable numbers differently. No harm from the publicly available information had been shown.

Disclosure occurred before the final report

Taken together, the evidence did not establish probable harm directly resulting from disclosure beyond the speculative or merely possible. The commissioner concluded that the statutory exemption was not made out.

An initial report issued on February 24 set out the proposed disclosure requirement. CRA subsequently released the numbers on March 11, according to the final report’s summary. The final report therefore recorded the disclosure rather than imposing a further order to produce the same information.

The report identified the requester’s right to seek Federal Court review within 35 business days. It did not direct public posting of a government-wide directory or create an automatic entitlement to every employee’s telephone number.

Its practical lesson is evidentiary: an institution invoking a security-related access exemption must explain why harm is reasonably expected from the specific information at issue. General cybersecurity concerns, without that connection, were insufficient here.