The Business Development Bank of Canada was ordered to process an access request after wrongly treating company authorizations as a prerequisite to accepting it. In Business Development Bank of Canada (Re), 2026 OIC 38, dated April 9, 2026, the Information Commissioner of Canada found that confidentiality concerns about the eventual response did not justify refusing to process a request that met the statutory requirements.
The requester sought various records concerning three companies, covering January 1, 2023 through June 30, 2025. BDC asked for proof of identification and board resolutions from each company authorizing disclosure, rather than providing the response required by the Access to Information Act.
The ruling does not order the release of unredacted client files. It requires the bank to accept the request, process it and give a proper written response identifying any statutory basis for refusing access.
Eligibility was already established
Section 6 requires a request to be in writing, directed to the institution controlling the records, and detailed enough for experienced employees to identify responsive records with reasonable effort. If detail is insufficient, an institution must make reasonable efforts to obtain clarification. BDC accepted that this request met all three requirements.
The bank nevertheless maintained that the requester had not confirmed a right of access. The commissioner considered section 4 and the Access to Information Extension Order, No. 1, which extends the statutory right to any person or corporation present in Canada.
The requester had supplied contact information demonstrating that the request came from a corporation located in Canada. The commissioner found that sufficient to establish the right of access in this case. The decision did not dispense with the eligibility requirements; it found that the information already supplied satisfied them.
Confidentiality belongs in the response analysis
BDC argued that the request sought client-specific information and that consent had not been obtained under section 37 of the Business Development Bank of Canada Act. It expected responsive records would ultimately be withheld under its statutory confidentiality obligations and said its efforts should instead go toward requests whose applicants were entitled to the information.
The commissioner rejected that conflation. Whether someone is eligible to make a valid access request is distinct from whether particular records must be released without redactions. Consent may matter when assessing disclosure, but it was not an additional condition for accepting this request.
BDC also relied on Export Development Canada v. Canada (Information Commissioner), 2025 FCA 50. As the commissioner explained, that case involved an institution that had gathered and processed responsive records, disclosed some information and identified the provisions supporting its redactions. It did not support refusing to process a request at the outset.
Once the requirements of sections 4 and 6 were met, the commissioner found, BDC had to process the request without imposing board authorizations as a preliminary hurdle. Its letter asking for identification and company resolutions was not the statutory response that sections 7 and 10 required.
Processing order leaves lawful exemptions available
The complaint was well founded. The commissioner ordered BDC’s president to accept the request and give the required notice no later than the 36th business day after the final report. If access were refused, the notice had to identify the specific provision supporting that refusal.
After receiving an initial report on March 17, BDC’s president notified the commissioner on March 26 that the bank would implement the orders. The final report records that undertaking, not proof of what the bank subsequently disclosed or withheld.
The report allowed 35 business days to apply for Federal Court review and stated that the orders would take effect on the 36th business day if no application were filed. This report does not independently confirm whether review was sought or whether the requester later received a completed response.
The decision preserves the distinction between access to a statutory decision-making process and entitlement to particular information. An institution cannot avoid processing a valid request merely because it expects confidentiality provisions to protect the records; it must apply those provisions through the response process the Act requires.
