Privacy Impact Assessment (PIA) - Publication of Veterans Review and Appeal Board Decisions
Executive Summary
The Veterans Review and Appeal Board (VRAB, the Board) is committed to providing applicants with a fair and effective redress process for disability pensions, disability awards and War Veterans Allowance decisions. As an administrative tribunal that is guided by the open court principle, the Board recognizes the need for transparency in decision making and the need to inform the public and Veterans about its work. Every hearing before the Board is open to the public (section 36(2) of the VRAB Act), therefore the decisions resulting from these hearings are public information. However, unlike the courts, the Board is also subject to the Privacy Act and must protect the privacy of applicants and appellants in this era of online access to information.
The initiative to publish depersonalized VRAB decisions identified as “interest” or “leading and persuasive” (i.e. noteworthy decisions1) is consistent with the practices of other boards and tribunals, and is in keeping with guidance provided by the Office of the Privacy Commissioner of Canada (OPC) to administrative tribunals to protect the privacy of individuals while maintaining the transparency of administrative justice.
The publication of these decisions benefits Veterans and all Canadians by improving their awareness and understanding of the Board's decision making process with respect to types of medical conditions and service, the nature of evidence put forward, and the interpretation of the laws governing disability benefits in Canada. It also supports consistency in decision making at the Board and provides valuable insight into the Board's delivery of the review and appeal program.
This report presents the findings of the PIA on the online publication of noteworthy1 VRAB decisions which came into effect in May 2012. VRAB is committed to protecting the personal information of all applicants and appellants and takes appropriate measures to ensure that the process of publication and the resulting online decisions conform to the law and principles of the Privacy Act and Regulations, and Treasury Board Secretariat policy, directives and practices that govern the accountability for and the collection, use, disclosure, accuracy, protection, retention and disposition of personal information.
Update (January 2017)
In mid-late 2015, the Board began publishing all of its appeal decisions and most of its review decisions on the Canadian Legal Information Institute (CanLII) website. CanLII is a well-known legal resource that organizes decisions by year and is searchable by key word. The decisions are depersonalized prior to publication. Since January 2016, all review and appeal decisions are being published on CanLII.
Risk Area Identification and Categorization
The numbered risk scale is presented in an ascending order: the first level (1) represents the lowest level of potential risk for the risk area; the fourth level (4) represents the highest level.
a) Type of program or activity
Risk scale: 1
The publication of depersonalized VRAB decisions does NOT involve a decision about an identifiable individual.
b) Type of personal information involved and context
Risk scale: 1
The publication of depersonalized VRAB decisions involves no personal information that could identify an individual. Only personal information, with no contextual sensitivities, collected directly from the individual or provided with the consent of the individual for disclosure under an authorized program was used to create the original decision.
c) Program or activity partners and private sector involvement
Risk scale: 1
For the publication initiative, the Board follows standard operating procedures for the depersonalization of decisions. The business processes for depersonalizing decisions will take place only within VRAB (i.e. within one program within the same institution).
d) Duration of the program or activity
Risk scale: 3
The publication initiative will be a long-term program or activity.
e) Program population
Risk scale: 1
The program's use of personal information for internal administrative purposes affects certain employees.
f) Technology and privacy
Does the new or substantially modified program or activity involve implementation of a new electronic system or the use of a new application or software, including collaborative software (or groupware), to support the program or activity in terms of the creation, collection or handling of personal information?
No, the business processes for depersonalizing VRAB decisions will use existing systems.
Does the new or substantially modified program or activity require any modifications to information technology (IT) legacy systems?
No modifications are required.
Specific technological issues and privacy:
Does the new or substantially modified program or activity involve implementation of new technologies or one or more of the following activities: enhanced identification methods; surveillance; or automated personal information analysis, personal information matching and knowledge discovery techniques?
No new technologies are involved.
g) Personal information transmission:
Risk scale: 1
No personal information is created for this program. The personal information in the original VRAB decision is depersonalized within a closed system (i.e. no connections to the Internet, Intranet or any other system) and the circulation of hard copy documents is controlled.
h) Privacy breach:
Potential risk that in the event of a privacy breach, there will be an impact on the individual or employee.
In the event of any privacy breach, there would be some impact on the individual or employee. That impact is reduced by:
- reducing the risk of breaches within the institution;
- discovering breaches quickly;
- training staff on how to respond to breaches; and
- ensuring that the information, in the event of a breach, has a narrow distribution.
I) Privacy breach - impact on institution;
Potential risk that in the event of a privacy breach, there will be an impact on the institution.
In the event of any privacy breach, there would be some impact on the institution's credibility and on the trust in its privacy practices.
Conclusion
The majority of the privacy risk issues identified in this PIA are low risk and relate to the internal processes that will be managed in accordance with standard operating procedures. These will be monitored and refined as warranted to ensure that the protection of personal information conforms to the law and principles of the Privacy Act and related TBS policies, directives and practices.
VRAB chose to accept the medium risk associated with the long-term duration of the program or activity because the publication of depersonalized decisions will benefit Veterans and all Canadians by improving their awareness and understanding of the Board's decision making process.
Update (January 2017)
The majority of the privacy risk issues identified in this PIA have been mitigated.
The Board has chosen to accept the low risk associated with publishing depersonalized decisions without a quality review.
The Client Service Delivery Network (CSDN) and the VRAB Scheduling Application (VSA) are still unable to dispose of electronic client information at the end of its life cycle, but the Board is able to delete documents in VSA. Veterans Affairs Canada has put on hold the project it initiated to address this issue. The Board, therefore continues to accept this medium risk.
The Board will add the appropriate references into work descriptions.
Personal Information Bank:
- Reviews, Appeals and Compassionate Awards
- TBS Registration: 003480
- Bank Number: VRAB PPU 080
1Noteworthy is the collective term for interest, and leading and persuasive decisions. Please see Annex A for definitions.
Annex A - Definitions
Interest decisions are decisions which determine issues of law of general public interest or importance. Interest decisions are distinguishable from leading and persuasive decisions because they do not provide guiding or general principles on the application or interpretation of a question of law. However, they are of value because they provide a general example of the application of the legislation, regulations, and policies, or various adjudicative principles. They also tend to be representative of a broad range of medical or legal issues which are commonly encountered in cases heard before the Board.
Interest decisions are not binding on members. While it is open to VRAB panels to consider and refer to any previous VRAB decision when deciding a Review or Appeal, they are not bound by the outcome or analysis reached in the previous decision because each decision will be based on specific or unique facts and evidence that was relevant in that case.
Leading and persuasive decisions are VRAB decisions that provide significant interpretive guidance and persuasive commentary on issues of law or policy, or on important issues related to procedure. These decisions are considered leading and persuasive because they have been influential in the development of a coherent line of jurisprudence on an issue.
Leading and persuasive decisions are of value because they will typically identify a reasoned analysis, an approach, or a set of factors or principles that will tend to be applied or used by the Board when determining certain types of issues or cases. These decisions are not binding on members because the outcome of each decision will ultimately be based on the specific facts and evidence that was presented in that case. Nevertheless, these decisions are useful to the public because they will identify the issues, factors or considerations that have been considered relevant by the Board and which should, therefore, be addressed as part of presenting a Review, or an Appeal before the VRAB.
Personal Information
As per section 3 of the Privacy Act, personal information means information about an identifiable individual that is recorded in any form.
Examples of this include: name, where it appears with other personal information relating to the individual or where disclosure of the name itself would reveal information about the individual; and information relating to race, national or ethnic origin, colour, religion, age, marital status, education, medical, criminal or employment history, address, fingerprints, blood type, identifying numbers, etc.
Information which by inference might identify the client should also be considered for removal, and if it is not possible to do so without removing details which are pertinent to the decision itself, consideration should be given to posting a summarized version, or refrain from posting this decision.
Depersonalization
Depersonalization means the removal of personal information that is not necessary or critical to the Board's reasons for decision.