2022-2023 Report on the Administration of the Privacy Act

• Message from the Chair
• Introduction
• About the Veterans Review and Appeal Board
• Organizational Structure
• Delegation Order
• Performance for 2022-2023
  • Formal Privacy Requests
  • Informal Privacy Request
• Deemed Refusal
• Extensions
• Exemptions
• Exclusions
• Complaints and audits
• Monitoring and Compliance
• Privacy Impact Assessments
• Material Privacy Breaches
• Policies, Guidelines, Procedures, and Initiatives
• Training and Awareness
• Privacy and operational costs
• Annex A: 2022-Delegation Order – Access to Information Act and Privacy Act
• Annex B: Statistical report on the Privacy Act
• Annex C: Supplemental statistical report on the Access to information Act and privacy Act

On behalf of the Veterans Review and Appeal Board (VRAB or the Board), I am pleased to present the 2022-23 annual report to Parliament on the administration Privacy Act.

This legislation gives Canadian citizens the right to access information in records held by the Government of Canada. It exists to protect the rights of individuals and to promote accountability and dialogue between citizens and their government.

In 2022-23, the Board’s Access to Information and Privacy (ATIP) Unit saw a substantial increase in the complexity of requests received as well as the volume of information retrieved.

Additionally, the Board’s ATIP unit continued it’s dedicated work updating and standardizing it’s processes and finding new work efficiencies. This work included participation in Treasury Board of Canada Secretariat activities as well as in-depth analysis of our processes and how they align with the Board’s own values.

During the past year, the Board relocated to a new office space which follows the Government of Canada’s Workplace Modernization Model and adopted the government-wide approach to Hybrid Work in 2022-23. This offers flexibility to staff while ensuring the needs of our clients continue to be met.

The principles of transparency, openness and accessibility continue to guide the Board’s ATIP Unit. We remain committed to protecting individual rights and developing our capacity in matters of access to information and privacy.

Sincerely,

Christopher J. McNeil

The Privacy Act protects the privacy of individuals with respect to personal information held by a government institution and provides individuals with a right of access to that information.

This Act also protects against unauthorized disclosure of that personal information. In addition, it strictly controls how the government will collect, use, disclose, and dispose of any personal information.

Section 72 of the Privacy Act requires that the Head of every government institution prepare an Annual Report on the Administration of the Privacy Act for submission to Parliament during each fiscal year.

The Veterans Review and Appeal Board has full and exclusive jurisdiction to hear, determine and deal with all applications for review and appeal that may be made to the Board under the Pension Act, the Veterans Well-being Act - Part 3, the War Veterans Allowance Act and other Acts of Parliament. The Veterans Review and Appeal Board Act authorizes all matters related to appeals under this legislation.

This Board also adjudicates duty-related pension applications under the authority of the Royal Canadian Mounted Police Pension Continuation Act and the Royal Canadian Mounted Police Superannuation Act.

All of the Board's published decisions are available on the Canadian Legal Information Institute (CanLII) website. CanLII is a well-known legal resource that organizes decisions by year and is searchable by key word. The most important of these are also available on our website.

To balance openness in decision-making with applicants' privacy, the Board has chosen to remove personal information that is not relevant to the reasons for the decision.

The Board’s Access to Information and Privacy (ATIP) positions include a Deputy Coordinator, a Coordinator, and Senior ATIP Analyst, and an ATIP Analyst. The Board has full responsibility for the administration of the Access to Information Act and the Privacy Act. The ATIP unit is under the Director, Strategic and Corporate Services, who acts on behalf of the Chairperson of the Board to oversee the administration of the Access to Information Act and the Privacy Act.

Duties of the ATIP unit include:

• Process requests for information submitted under the Privacy Act in accordance with the legislation, regulations, and Treasury Board of Canada Secretariat (TBS) policies, guidelines, and directives.
• Provide VRAB managers and staff with advice and guidance regarding the interpretation and application of the Privacy Act and related TBS policies, guidelines, and directives.
• Develop policies, procedures, and guidelines for the administration of the Acts and related TBS policies, guidelines, and directives.
• Coordinate the resolution of any complaints against the VRAB made to Privacy Commissioner under the Privacy Act.
• Respond to consultations from other government institutions on access to information requests
• Promote awareness to ensure employees understand their roles and responsibilities and the Board fulfills its obligations under the Acts.
• Respond to Parliamentary written questions on access to information and privacy breaches.
• Support the VRAB’s commitment to openness and transparency through proactive disclosures, informal releases of information and publishing the summaries of completed access to information requests to the Open Government portal.
• Review contracts with third parties using TBS guidance documents.
• Update the VRAB’s Information about Programs and Information Holdings (formerly known as Info Source) chapter on the VRAB website in accordance with the TBS directive.
• Monitor and reporting on the Board’s proactive disclosures.
• Prepare the Annual report to Parliament and the Annual Statistical Report on the
  Administration of the Privacy Act.

In September 2022, the Chair of the Veterans Review and Appeal Board delegated his authority for the purposes of the Act. Annex A is a copy of the signed delegation instrument that took effect September 1, 2022.

Formal privacy requests

The VRAB ATIP unit (“the unit”) had the full ability to receive formal privacy requests through the online portal, by email, by facsimile, or by mail. The unit received five requests through the ATIP online portal.

The Board responded 42 of 43 (98%) of formal privacy requests within legislated timelines as the key measure of the Boards performance.

Table 1. The number of completed requests broken down by completion times

39 of 43 (90.70%) of requests were completed within 1 to 15 days. 3 of 43 (7%) of requests were completed within 16 to 30 days. 1 of 43 (2%) was completed in 61-120 days.

The following figure demonstrated an upward trend in the number of formal privacy requests completed.

Table 2. The number of formal privacy requests completed by fiscal year

It is clear that the number of formal privacy requests is rising quickly with a 60% increase form 2021-22 to 2022-23.

The following figure represents the number of pages processed and disclosed related to these request.

Figure 1. The number of pages processed and pages disclosed by fiscal year

The number of pages processed was up by 51% in 2022-23 while the number of pages disclosed increased by 62%.

There was one active requests as of the last day of the reporting period, carried over from 2021-2022 still within legislated timelines. No extension was taken on this request.

The most frequently used channel for requesting personal information is email at 82% followed by the ATIP Online Management Tool at 16%.

41 of 44 (93%) of formal privacy requests were completed with 1 to 15 days. 3 of 44 requests

Figure 2. Formal Privacy Request Channels 2022-23

 

Audio recording of Board hearings are also available. In 2022-23, we received a total of 2 formal privacy requests for hearing recordings of which a total of 61 minutes were processed and 61 minutes were disclosed.

Informal Privacy Request

An informal privacy request is a request for records which does not invoke the right of access provided by the Privacy Act. There is no statutory deadline within which ATIP must respond to the request. There is no right of complaint. ATIP can withhold information without explanation.

VRAB’s ATIP unit began recording Informal Privacy requests in 2021-22. The number of requests completed went up from 26 to 44 in 2022-23. This represents a 60% in the number of informal privacy requests received. 4 requests carried over into the following fiscal year.

The level of service we provide to our clients is important to us. We do our best to respond to informal requests in a timely fashion. 41 of 44 request were completed within 1 to 15 days.

Table 3. Completion times of informal privacy requests 2022-23

 Below is a visual representation of the increase number of informal privacy requests. The number of requests has increased from 26 to 44. This represents an increase in 59%.

Figure 3. Number of informal privacy requests completed by Fiscal year

Although number of request has gone up, the total number of pages processed vs the number of pages disclosed for informal requests by fiscal year has gone down.

Figure 4. Informal privacy request - pages processed vs released by fiscal year

66% percent fewer pages were processed and 69% fewer pages were released in 2022-23 from 2021-22

Deemed refusal is when a government institution fails to give access to any personal information requested within the time limits set out in the Acts. During the reporting period, VRAB closed 42 requests within the legislated timeline. One request was closed past the legislated timeline for the principle reason of interference with operations/workload.

Section 15 extension of time limits under the Privacy Act institution may extend the time limit by an additional 30 days where meeting the original 30 time limit would unreasonably interfere with the operations or the institution.

Extension was taken for one request. The reason for extension was 15(a)(i) interference with operation for a large number of pages.

An exemption is a provision under the Privacy Act that authorizes the Head of the institution or delegate to refuse to disclose records in response to a privacy request.

• Subjection 26, information about another individual, was applied in two requests.
• Subjection 27 , privilege and professional Secrecy, was applied to two requests

Pursuant to sections 69 and 70 of the Privacy Act, the Act does not apply to:

• library or museum material preserved solely for public reference;
• material placed in the Library and Archives of Canada;
• personal information that is publicly available; or
• confidences of the Queen’s Privy Council.

No exclusions were cited during the 2022-23 reporting period.

An individual has the right to make a complaint to the Information Commissioner on grounds set out in the section 30 of the Access to information Act which reads:

“Receipt and investigation of complaints

1. Subject to this Part, the Information Commissioner shall receive and investigate complaints
   1. from persons who have been refused access to a record requested under this Part or a part thereof
   2. from persons who have been required to pay an amount under section 11 that they consider unreasonable.
   3. from persons who have requested access to records in respect of which time limits have been extended pursuant to section 9 where they consider the extension unreasonable.
   4. from persons who have not been given access to a record or a part thereof in the official language requested by the person under subsection 12(2) or have not been given access in that language within a period that they consider appropriate.
      1. from persons who have not been given access to a record or a part thereof in an alternative format pursuant to a request made under subsection 12(3) or have not been given such access within a period that they consider appropriate.
   5. in respect of any publication or bulletin referred to in section 5; or
   6. in respect of any publication or bulletin referred to in section 5; or

During the reporting period 2022-2023, VRAB ATIP receive one complaints. Early investigations with the Office of the Privacy Commissioner of Canada resulted in the information Commissioner providing VRAB with some valuable feedback on clarifying wording on VRAB’s website. The issue was resolved with the complainant during the early mediation process.

The VRAB ATIP unit monitors all requests for information in Access Pro Case Management (APCM) which is an automated case tracking reporting system. The Senior ATIP Officer monitors all requests received in the ATIP unit. They provide the coordinator a bi-weekly status on:

• the number of requests received;
• the number of pages processed;
• the number of files closed;
• and if any requests require consultation.

The first report is workload related to ATIP requests. The second report provides trends by Fiscal Year over a period of five years.

This information is rolled up to provide a monthly snapshot for senior managers and the Chair’s Office. Additional feedback is provided when trends present information to be addressed. In 2022-23, the ATIP office was able to demonstrate the need for additional resources to meet the demand on incoming request in order to meet legislated time lines.

Focus was placed on privacy breaches. New privacy breach reporting form and reports were created to monitor for any trends relating to privacy breaches. This included reporting on the types of breaches in order to target areas of concern and provide additional support through training.

Institutions conduct a privacy impact assessment (PIA) before implementing a new program, policy, or service. An evaluation is completed to reduce the risk of a privacy breach by analyzing how personal information will be collected, stored, shared, retained, and disposed. A PIA helps us protect the privacy of individuals, and promote transparency and accountability.

The Board did not conduct any new PIAs in 2022-23.

A material privacy breach occurs when personal information under the control of an institution is lost, divulged error or accessed without authorization. The level of risk to the affected individual(s) is expected to cause serious injury or harm:

• physical or mental;
• socially;
• loss of reputation; or
• financially

The Board has one material breaches to report for 2022-23. The material breach was reported to Office of Privacy Commissioner and to the Treasury Board Secretariat (TBS). The Privacy Breach occurred when a VRAB Decision was published to CanLII containing personal information that could result in identify theft. Following TBS guidelines for privacy breaches, the error was quickly detected by AI and notified VRAB. The breached information was removed from the CanLII website within hours of the incident.

Collaborated with the Office of the Privacy Commissioner of Canada and the ATIP community to review policy instruments and tools for opportunities to strengthen the prevention, identification, management and reporting of privacy breaches.

In 2022-23, VRAB ATIP worked with keys areas at the Board to strengthen training for all employees in the areas of:

• Protecting and managing personal information
• Identifying and managing privacy incidents and privacy breaches
• Ongoing training of using the new
• Developed and implemented a new ATIP training program for the onboarding of new staff at VRAB

The cost for resources related to the Privacy Act include salaries, goods and services, software for tracking and reporting on requests, and training for ATIP staff. The cost for resources related to the Privacy Act includes salaries, goods and services, software for tracking and reporting on requests, and training for ATIP staff. The total cost of operating the program for 2022-23 was $39,333.

2021 Delegation Order – Access to Information Act and Privacy Act

The Chairperson, Veterans Review and Appeal Board, pursuant to Section 73 of the Access to Information Act and section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Chairperson as the head of the Veterans Review and Appeal Board, under the provisions of the Act and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.

Dated, at the City of Charlottetown, this first day of September, 2022.

Christopher J. McNeil

Chairperson, Veterans Review and Appeal Board

TBS/SCT 350-63

Name of institution:
Veterans Review and Appeal Board

Reporting period
From: April 1, 2022

To: March 31, 2023

Name of institution:
Veterans Review and Appeal Board

Reporting period
From: April 1, 2022

To: March 31, 2023