2023-2024 Report on the Administration of the Privacy Act

• Message from the Chair
• Introduction
• About the Veterans Review and Appeal Board
• Organizational Structure
• Delegation Order
• Performance for 2023-2024
  • Formal Privacy Requests
  • Informal Privacy Request
  • Complaints
  • Extensions
• Consultations
• Training and Awareness
  • Onboarding of new staff
  • The impact of records and information management on access and privacy
  • Privacy breach management and prevention
• Policies, guidelines, and procedures
• Initiatives and projects to improve privacy
  • Digitization of hearing recordings
  • Service Health Record Search Tool (SHRST)
  • ATIPXpress
• Summary of key issues and actions taken on complaints
• Material privacy breaches
• Privacy Impact Assessments
• Public interest discloures
• Privacy operating costs
• Monitoring compliance
• Annex A: 2023 Delegation Order Access to Information Act and Privacy Acts
• Annex B: Statistical report on the Privacy Act
• Annex C: Supplemental statistical report on the Access to information Act and Privacy Act

On behalf of the Veterans Review and Appeal Board (VRAB or the Board), I am pleased to present the 2023-24 annual report to Parliament on the administration of the Privacy Act.

This legislation enhances government transparency by allowing Canadian citizens to access information held by the Government of Canada. It promotes openness, accountability, and dialogue between citizens and their government.

As per of our dedication to uphold transparency and accountability, the Board's ATIP unit collaborated with our offices of primary interest to put in place new processes to ensure we are compliant with the requirements for proactive disclosure.

In the fiscal year 2023-24, VRAB ATIP handled 67,459 pages in response to Access to Information and Privacy requests, representing a 42% workload increase compared to the previous year. We met our legislated timelines 100% of the time.

VRAB is focused on digital innovation and laying the ground work for developing a solid foundation for an effective information management system so that Canadians can exercise their right of access and receive high quality information without delays.

Sincerely,

Christopher J. McNeil

The Privacy Act protects the privacy of individuals with respect to personal information held by a government institution and provides individuals with a right of access to that information.

This Act also protects against unauthorized disclosure of that personal information. In addition, it strictly controls how the government will collect, use, disclose, and dispose of any personal information.

Section 72 of the Privacy Act requires that the Head of every government institution prepare an Annual Report on the Administration of the Privacy Act for submission to Parliament during each fiscal year.

The Veterans Review and Appeal Board has full and exclusive jurisdiction to hear, determine and deal with all applications for review and appeal that may be made to the Board under the Pension Act, the Veterans Well-being Act - Part 3, the War Veterans Allowance Act and other Acts of Parliament. All matters related to appeals under this legislation are authorized under the Veterans Review and Appeal Board Act.

The Board also adjudicates applications for review and appeal of duty-related disability pension decisions under the authority of the Royal Canadian Mounted Police Pension Continuation Act and the Royal Canadian Mounted Police Superannuation Act.

The Board follows the open court principle. This means that our hearings and our decisions are open to the public.

All of the Board's published decisions are available on the Canadian Legal Information Institute (CanLII) website. CanLII is a well-known legal resource that organizes decisions by year and is searchable by key word.

We ensure the protection of personal information in published decisions by considering the names of the applicant or appellant and non-expert witnesses, as well as other information that could identify the individual (e.g. file numbers or home address). A published decision may contain some information that is relevant to the decision, such as:

• the relationship between the applicant/appellant and a family member or witness at the hearing;
• medical conditions;
• occupational information;
• personal characteristics that are relevant to the disability application; and
• excerpts of medical opinions and doctors' reports.

To balance openness in decision-making with applicants’ privacy, the Board removes personal information that is not relevant to the reasons for the decision.This approach is consistent with the principles found in the "Use of Personal Information in Judgments and Recommended Protocol" approved by the Canadian Judicial Council.

The Board’s Access to Information and Privacy (ATIP) positions include a Deputy Coordinator, a Coordinator, and Senior ATIP Analyst, and an ATIP Analyst. The Board has full responsibility for the administration of the Access to Information Act and the Privacy Act. The ATIP unit is under the Director, Strategic and Corporate Services, who acts on behalf of the Chairperson of the Board to oversee the administration of the Access to Information Act and the Privacy Act.

Duties of the ATIP unit include:

• Process requests for information submitted under the Access to information Act and the Privacy Act in accordance with the legislation, regulations, and Treasury Board of Canada Secretariat (TBS) policies, guidelines, and directives.
• Provide VRAB managers and staff with advice and guidance regarding the interpretation and application of the Access to information Act and the Privacy Act and related TBS policies, guidelines, and directives.
• Develop policies, procedures, and guidelines for the administration of the Act and related TBS policies, guidelines, and directives.
• Coordinate the resolution of any complaints against the VRAB made to the Office of the Privacy Commissioner under the Privacy Act.
• Respond to consultations from other government institutions on Access and Privacy requests.
• Promote awareness to ensure employees understand their roles and responsibilities and the Board fulfills its obligations under the Acts.
• Respond to Parliamentary written questions on access to information and privacy breaches.
• Support the VRAB’s commitment to openness and transparency through proactive disclosures, informal releases of information and publishing the summaries of completed access to information requests to the Open Government portal.
• Review contracts with third parties using TBS guidance documents.
• Update the VRAB’s Information about Programs and Information Holdings (formerly known as Info Source) chapter on the VRAB website in accordance with the TBS directive.
• Monitor and report on the Board’s proactive disclosures.
• Prepare the Annual reports to Parliament and the Annual Statistical Report on the Administration of the Access to Information Act and the Privacy Act.

In September 2023, the Chair of the Veterans Review and Appeal Board delegated his authority for the purposes of the Act. Annex A is a copy of the signed delegation instrument that took effect September 1, 2023.

In the fiscal year 2023-24, the administration’s performance in responding to requests for personal information under the Privacy Act has been marked by notable efficiency and transparency. The period saw a significant increase in the volume of pages processed.

Formal privacy requests

In the fiscal year 2023-24, VRAB responded to 100% of the personal information requests received within the legislated timeline as the key measure of the Board’s performance.

Table 1. The number of completed formal requests broken down by completion times

Out of a total of 35 requests, 21 were responded to within 1 to 15 days, and 12 within 16 to 30 days. Only one request took between 31 to 60 days, and another within 181 to 365 days. This distribution highlights our commitment to prompt responses.

There were 2 active requests carried over to the new fiscal year that are still within the legislative timeframe.

There were 53,750 pages process and 48,894 pages disclosed under the Privacy Act

10 requests were disclosed in full. 3 requests were disclosed in part applying section 19 of the Privacy Act. 19 requests had no existing records, 2 requests were abandoned, and the remaining 1 request we could neither confirm or deny that we had records related to the request.

Table 2. The number of completed informal requests broken down by completion times

In the fiscal year 2023-24, VRAB ATIP efficiently handled a total of informal requests for personal information. Of these, 31 requests were responded to within 1 to 15 days, 4 within 16 to 30 days, and 2 within 31 to 60 days. This distribution is reflective of our dedication to maintaining high standards of service.

 A total of 2,157 pages were processed and released informally.

Complaints

A complaint under the Privacy Act is a formal grievance lodged by an individual who believes that a federal institution has mishandled their personal information. This can include unauthorized disclosure, improper collection, or failure to provide access to personal records.

We had no active complaints as of the end of the fiscal year

Extensions

Under the Privacy Act, extensions are permissible in certain circumstances to allow institutions more time to respond to requests for personal information. These extensions ensure that institutions can provide thorough and accurate responses while maintaining operational efficiency.

In 2023-24, one extension was applied to due a large volume of documents retrieved.

Consultations can be necessary when responding to formal privacy requests under the Privacy Act to ensure that the information provided is accurate, complete, and compliant with legal and regulatory requirements. These consultations help maintain the integrity and reliability of the information provided, ensuring that the institution meets its obligations under the Privacy Act.

In 2023-24, there were no consultations sought.

In 2023-24, ATIP and the Information Management (IM) unit areas at the Board worked together to strengthen training for employees at VRAB.

Onboarding of new staff

ATIP created and implemented a new training program to onboard 47 new hires. The onboarding session provided a comprehensive overview of personal and information of business value (IBV), emphasizing the crucial role these new employees will play in managing information at the Board in compliance with the Access to Information Act, Privacy Act, and other relevant regulations. The training also covered best practices for handling IBV and strategies to prevent privacy breaches.

IM created and conducted onboarding training for the 47 new hires. The training focused on efficient and effective management of records and information to support program delivery, inform decision-making, accountability, transparency, collaboration, and compliance with relevant laws. Additionally, employees were reminded of their role in preserving and granting access to information for the benefit of current and future Canadians.

IM provided training to 16 new students working on the hearing recording digitization project. Topics covered included: proper handling of transportation of client records, the proper disposition protocols of physical media once digitized, and the handling of client information in electronic client systems.

Expanding training for staff and students can positively impact the Access to Information and Privacy regime in several ways:

Awareness of IM Practices: Employees gain a better understanding of how good Information Management (IM) practices support effective record-keeping. This awareness contributes to an efficient ATIP system.

Efficient Record Handling: Proper training ensures that employees handle client records appropriately during digitization. This includes understanding how to manage physical media once it’s digitized, ensuring consistent and accurate information management.

Enhanced Service: Well-trained employees can provide timely and consistent service to requesters. By following proper protocols, they contribute to a smoother ATIP process, benefiting both the public and government institutions.

The impact of records and information management on access and privacy

ATIP presented on the impact of records and information management on access and privacy to managers at the Board. It focused on encouraging information management best practices for the purpose of access, privacy matters, and the duty to document in support of transparency and accountability.

Effective records and information management (RIM) plays a crucial role in enhancing both access to information and privacy protection. By implementing strong RIM practices, organizations can ensure that records are accurately maintained, easily retrievable, and appropriately safeguarded. This reduces the risk of records being lost or inappropriately deleted, which in turn minimizes search times and costs associated with locating mishandled information. Moreover, well-managed records support transparency and accountability, enabling organizations to respond promptly to information requests.

Privacy breach management and prevention

The ATIP unit provided training to newly appointed team leads and managers in VRAB Operations, covering topics such as preventing privacy breaches using real work examples, managing incidents related to privacy breaches including documentation and containment, and provided instructions on how to complete the VRAB Privacy Event Form.

The Access to Information and Privacy unit maintained its focus on supporting managers by offering expert advice and guidance on existing policies, guidelines, and procedures.This approach allowed the unit to provide consistent and reliable support, helping managers effectively implement and adhere to established protocols. By doing so, the unit reinforced its commitment to fostering a compliant and informed organizational environment.

In today’s digital age, it’s important for everyone to have access to information. The Board is actively engaged in several initiatives and projects aimed at enhancing privacy.

By leveraging innovation, the Board seeks to safeguard information, promote access to justice, and foster an inclusive culture that empowers its personnel to support Veterans. Transparency remains a core value, allowing Veterans and Canadians to hold the Board accountable for its actions and decisions.

Digitization of hearing recordings

The digitization of hearing recordings allows for enhanced access to historical hearing recordings. It ensures the preservation of the information and streamlines the record retrieval process by reducing the time and effort needed to access recordings.

The digitization hearing recordings on cassette tapes began in March 2023 with 115, 744 cassettes that needed to be digitized. From April 1, 2023 to March 31, 2024 16 FSWEP students worked on the cassette digitization project. During this time, the team completed processing 19,973 cassettes.

The project is on-going and the team is making great progress.

Service Health Record Search Tool (SHRST)

The SHRST is used by the VRAB Pre-hearing team to facilitate the creation of the Statement of Case. The Statement of Case (SOC) is a compilation of relevant evidence and information from various sources, prepared by the Board for your hearing. It includes documentation from Veterans Affairs Canada, Department of National Defence, and previous hearings, and may be updated with new evidence presented during the hearing. This tool enables efficient searching through digital documents within the official client repository for relevant information, which can then be bundled to support clients’ decisions.

Client privacy protection is a top priority at the Board. The SHRST restricts access to personal information, allowing only authorized personnel with a legitimate need to access it. Additionally, the system provides comprehensive auditing capabilities to track who accesses client files within the SHRST. By enabling work completion within the system itself, the tool minimizes the risk of inadvertently sharing client information outside the secure environment, enhancing overall data security.

ATIPXpress

VRAB ATIP is dedicated to improving service to Canadians through digital innovation to bring the ATIP regime more in line with contemporary expectations by making it more responsive, accessible, and relevant.

VRAB purchased licenses of ATIPXpress to begin the work of moving away from Privasoft for processing ATIP requests which has now become outdated. ATIPXpress is a suite of modules that unites request handling, record retrieval, redaction, and compliance tasks on a single solution.

ATIPXpress streamlines and automates time-consuming and costly request management processes while ensuring compliance with government guidelines and legislated requirements.

ATIPXpress accelerates the handling of requests. This helps provide Canadians with timely access to their personal information.

VRAB ATIP expects to have the new solution implemented by the fall of 2024-25.

The Privacy Commissioner can receive and investigate complaints from individuals about:

• Their personal information being misused or wrongly shared by a government institution.
• Being denied access to their personal information.
• Not being given their rights or having their requests to correct personal information unjustly refused.
• Unreasonable delays in accessing their personal information.
• Not getting their personal information in the official language they requested.
• Not getting their personal information in an alternative format they requested.
• Being charged an inappropriate fee.
• Issues with the index of personal information.

Any other issues related to:

• How personal information is collected, kept, or disposed of by a government institution.
• How personal information is used or shared by a government institution.
• Accessing personal information.

During the 2023-2024 period, there have been no privacy complaints reported. This indicates that all privacy protocols and measures have been effectively maintained, ensuring the protection of personal information and compliance with relevant privacy regulations. This achievement reflects a strong commitment to safeguarding personal information and upholding privacy standards.

A material privacy breach happens when an institution loses or improperly shares personal information, or when unauthorized access occurs. This breach can lead to serious harm to the affected individuals, including physical or mental injury, social harm, damage to reputation, or financial loss.

The Board has one material breach to report for 2023-24. This breach was reported to the Office of the Privacy Commissioner and the Treasury Board Secretariat (TBS). The privacy breach occurred when a VRAB decision was published on CANLII, containing personal information that could lead to identity theft. The error was quickly detected and VRAB was notified. The breached information was removed from the CANLII website within hours of the incident.
 

A Privacy Impact Assessment (PIA) is a process used to identify and address privacy risks in projects or systems that handle personal data. It helps ensure that personal information is collected, stored, and used in a way that respects privacy laws and protects individuals’ privacy rights.

In 2023-24, no Privacy Impact Assessments (PIAs) were conducted.

In accordance with paragraph 8(2)(m) of the Privacy Act, which grants the head of an institution the discretion to disclose personal information if it is deemed to be in the public interest, no information was disclosed under this provision for the reporting period.

Administering the Privacy Act involves a range of operational costs that are essential to ensure compliance and protect individuals’ personal information and responding to requests within the legislated timelines. These costs encompass various activities, which includes salaries, goods and services, tracking software, reporting on requests, and training for ATIP staff.

The cost of operating the program was $143,080 for the fiscal year.

The ATIP unit prepares 2 reports to provide a monthly snapshot for senior managers and the Chair’s Office. The first report is workload related to ATIP requests. It provides information on the number of requests, the number of pages processed, and the number of pages released for the fiscal year to date. The second report provides trends by Fiscal Year over a period of five years. Additional feedback is provided when trends present situations that need addressing such workload distribution, balancing priorities, and identifying the need for additional resources.

Detailed analysis of privacy breaches is completed on a monthly basis in order to identify trends to target support and training.

The Chairperson, Veterans Review and Appeal Board, pursuant to Section 73 of the Access to Information Act and section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Chairperson as the head of the Veterans Review and Appeal Board, under the provisions of the Act and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.

Dated, at the City of Charlottetown, this first day of September, 2023.

Christopher J. McNeil

Chairperson, Veterans Review and Appeal Board

TBS/SCT 350-63

Name of institution:
Veterans Review and Appeal Board

Reporting period
From: April 1, 2023

To: March 31, 2024

Name of institution:
Veterans Review and Appeal Board

Reporting period
From: April 1, 2023

To: March 31, 2024