When a Privacy Request Triggers Surveillance: My Formal Complaint Against ISED

Introduction

On March 25, 2025, I filed a routine request under Canada’s Privacy Act—Section 12(1)(b), to be precise. I asked Innovation, Science and Economic Development Canada (ISED) for my personal information. That’s it. A lawful request under a statute designed to protect Canadians.

What followed was anything but lawful.

Shortly after my request was filed, my LinkedIn Premium account revealed that two ISED employees—Mr. Nidal Islam (Deputy Director, AI Compute) and Ms. Linda Liberatore (Manager)—viewed my profile. I have never interacted with either individual. There is no legitimate reason for them to be reviewing my online presence—except that they had internal access to the Privacy Act request I filed.

Later, when ISED was compelled to release internal correspondence under that very same Act, I found this gem of a quote in one of their internal emails:

“I just creeped a guy on LinkedIn with the same name and he’s ATIPing everyone.”

That “guy” was me. That comment was from a government official. And that access to my personal data was only possible because I filed a legal request for transparency. In short, the department took identifying information from my request, then used it for informal surveillance and internal mockery.

This is not how a constitutional democracy works.

Today, I filed a formal complaint with the Office of the Privacy Commissioner of Canada (OPC) under Section 29 of the Privacy Act. Below is the full text of the complaint, published in the interest of public accountability.

Privacy Complaint Submitted to the Office of the Privacy Commissioner of Canada

Complainant: Kevin J.S. Duska Jr.
Respondent Institution: Innovation, Science and Economic Development Canada (ISED)
Date: May 14, 2025

1. Overview

This complaint concerns the unauthorized internal use and informal disclosure of my personal information by public officials at Innovation, Science and Economic Development Canada (ISED), in direct connection with a lawful Privacy Act request I submitted on March 25, 2025.

This misconduct includes:

• Informal surveillance of my LinkedIn profile;
• Internal commentary referencing my identity;
• The misuse of personal data for a purpose entirely unrelated to the administration of the Act.

I contend that ISED violated Section 7 (unauthorized use) and Section 8 (unauthorized disclosure) of the Privacy Act.

2. Background Facts

• On March 25, 2025, I submitted a request under Section 12(1)(b) of the Privacy Act to ISED.
• Within days, I received metadata logs from LinkedIn indicating that two ISED officials had accessed my profile.
• I later obtained internal communications via a separate Privacy Act request, one of which included the quote:

“I just creeped a guy on LinkedIn with the same name and he’s ATIPing everyone.”

• The officials involved had no connection to me and no justifiable reason to access or comment on my identity.

This conduct constitutes an unauthorized secondary use of my personal information and internal profiling outside the boundaries of statutory authority.

3. Legal Basis for Complaint

ISED’s conduct violates the following provisions of the Privacy Act:

• Section 7: Personal information must not be used for purposes other than those for which it was obtained, except with the consent of the individual or as authorized by law.
• Section 8: Personal information must not be disclosed without the individual’s consent unless a specific statutory exemption applies—which it does not in this case.

This was not “fulfilling a request.” This was metadata surveillance by civil servants using internal access privileges to casually investigate a citizen.

An ordinary citizen – with a dog named Wilco – who likes to watch dogs play as therapy.

4. Impact on Health and Human Dignity

I suffer from a clinically diagnosed anxiety and panic disorder. I have for 22 years – I am stable and do not believe that mental health should be stigmatized. Some of this is related to biology, and some to work-related trauma.

The revelation that federal employees had tracked my identity and informally surveilled my online presence triggered serious episodes of distress, including panic attacks, sleep disturbance, and sustained psychological unease.

These impacts were foreseeable. The conduct was discretionary. And the misuse of state power was disproportionately targeted at a citizen engaging in lawful transparency activity.

5. Attempts to Resolve the Matter

Before turning to the OPC, I made every reasonable effort to address the issue through institutional channels:

• I brought the incident to the attention of ISED’s Access to Information and Privacy (ATIP) team;
• I requested relevant documents from the Communications Division;
• I contacted ISED’s General Counsel;
• I published an article on the broader implications for access-to-information and retaliatory profiling;
• I submitted follow-up ATIP requests, which ISED has missed its own internal deadline in fulfilling;
• I have also now detected automated scraping of my website by ISED infrastructure—an entirely separate incident which will be the subject of a second complaint.

The misconduct here is not hypothetical. It is documented, discovered, and ongoing.

6. Request for Accommodation

I am amblyopic and require all communications and documents to be provided in OCR-enabled PDF format compatible with screen readers and accessible tools.

I also suffer from an anxiety and panic disorder, and I request that this file be handled with trauma-informed discretion, in accordance with the principles of the Accessible Canada Act and OPC’s public service obligations. I ask that all procedural correspondence respect my mental health condition and minimize unnecessary procedural burden or escalation.

7. Remedies Sought

I request that the Office of the Privacy Commissioner:

1. Launch a full investigation into the unauthorized use and disclosure of my personal information by ISED;
2. Issue formal findings on whether Sections 7 and 8 of the Privacy Act were breached;
3. Recommend the following corrective actions:
   • A written apology from ISED acknowledging the misuse;
   • A prohibition on informal surveillance, commentary, or metadata tracking of requesters by ISED staff;
   • The implementation of trauma-informed, disability-aware handling procedures;
4. Recognize the psychological harm caused and recommend appropriate restorative measures, consistent with Treasury Board Secretariat guidance;
5. Assess the broader institutional pattern of surveillance or retaliatory profiling at ISED, especially given their scraping of my website.

Conclusion

The public has a right to know what happens when citizens exercise their right to information. In this case, a routine request under the Privacy Act led to informal surveillance, internal jokes, and real psychological harm—all carried out by public servants using access privileges for personal curiosity.

I will continue to pursue this matter through all available legal, administrative, and public channels.

The metadata always tells a story.
This time, it tells mine.

Unfortunately, I will be telling my story about a dozen other times, which we will publicize here at Prime Rogue Inc and via our Echo (12)(b) program as we have discovered that, first, lots of departments do this, and second, when you complain about a federal institution like ISED, you will be surveilled even further.

In fact, we have discovered that illicit digital surveillance by the institutions of the Government of Canada is ubiquitous. It’s time to educate the public, and to fight back.

—Kevin J.S. Duska Jr.
Prime Rogue Inc.
May 14, 2025