To make Privacy Act or Access To Information requests, you need to supply the consent form: http://www.cic.gc.ca/english/department/atip/form-imm5744.asp .
This form authorizes CIC to release personal information about a person to another person. So, if your sponsor was applying for GCMS notes, your sponsor needs you to fill out and sign section A of that consent. Your sponsor would then fill out and sign section C.
Without submitting that, ATIP is obligated to redact that information from the notes to be sent. That said, Section 22 of the Privacy Act is:
"
Law enforcement and investigation
22 (1) The head of a government institution may refuse to disclose any personal information requested under subsection 12(1)
(a) that was obtained or prepared by any government institution, or part of any government institution, that is an investigative body specified in the regulations in the course of lawful investigations pertaining to
(i) the detection, prevention or suppression of crime,
(ii) the enforcement of any law of Canada or a province, or
(iii) activities suspected of constituting threats to the security of Canada within the meaning of the Canadian Security Intelligence Service Act, if the information came into existence less than twenty years prior to the request;
(b) the disclosure of which could reasonably be expected to be injurious to the enforcement of any law of Canada or a province or the conduct of lawful investigations, including, without restricting the generality of the foregoing, any such information
(i) relating to the existence or nature of a particular investigation,
(ii) that would reveal the identity of a confidential source of information, or
(iii) that was obtained or prepared in the course of an investigation; or
(c) the disclosure of which could reasonably be expected to be injurious to the security of penal institutions.
"
http://laws-lois.justice.gc.ca/eng/acts/p-21/page-4.html#h-15
