2021-2022 Report on the Administration of the Privacy Act

• Message from the Chair
• Introduction
• Mandate
• Organizational Structure
• Delegation Order
• Performance 2021-2022
  • Formal Privacy Requests
  • Informal Privacy Request
• Deemed Refusal
• Exemptions
• Exclusions
• Format of information releases
• Training and Awareness
• Policies, Guidelines, Procedures, and Initiatives
• Complaints, Audits, and Investigations
• Impact of COVID-19 related measures
• Monitoring Compliance
• Material Privacy Breaches
• Privacy Impact Assessments
• Public interest disclosures
• Privacy operating costs
• Annex 1 – Delegation Order
• Annex 2 – Statistical Report on the Privacy Act
  • Section 1: Requests under the Privacy Act
  • Section 2: Informal requests
  • Section 3: Requests closed during the reporting period
  • Section 4: Disclosures under subsections 8(2) and 8(5)
  • Section 5: Requests for correction of personal information and notations
  • Section 6: Extensions
  • Section 7: Consultations received from other institutions and organizations
  • Section 8: Completion time of consultations on Cabinet confidences
  • Section 9: Complaints and investigations notices received
  • Section 10: Privacy impact Assessments (PIA) and Personal Information Banks (PIB)
  • Section 11: Privacy Breaches
  • Section 12: Resources related to the Privacy Act
• Annex 3 – Supplemental Statistical Report on the Access to Information Act and the Privacy Act
  • Section 1: Capacity to Receive Requests under the Access to Information Act and the Privacy Act
  • Section 2: Capacity to Process Records under the Access to Information Act and the Privacy Act
  • Section 3: Open Requests and Complaints under the Access to Information Act
  • Section 4: Open Requests and Complaints under the Privacy Act
  • Section 5: Social Insurance Number (SIN)
• Contact Us

Note: External links are current on the date of publication.

On behalf of the Veterans Review and Appeal Board (VRAB or the Board), I am pleased to present the 2021-22 annual report to Parliament on the administration of the Privacy Act.

This legislation gives Canadian citizens the right to access information in records held by the Government of Canada. It exists to protect the rights of individuals and to promote accountability and dialogue between citizens and their government.

In 2021-22, the Board’s Access to Information and Privacy (ATIP) Unit saw a substantial increase in the complexity of requests received as well as the volume of information retrieved.

Additionally, much work was done to ensure the Board’s ATIP processes were updated and standardized, resulting in a more efficient process overall. This work included participation in Treasury Board of Canada Secretariat activities as well as in-depth analysis of our processes and how they align with the Board’s own values.

I am proud of the Board’s ATIP unit who completed this work while continuing to operate remotely due to the COVID-19 pandemic.

The principles of transparency, openness and accessibility continue to guide the Board’s ATIP Unit. We remain committed to protecting individual rights and developing our capacity in matters of access to information and privacy.

Sincerely,

Christopher J. McNeil

Chairperson

The Privacy Act protects the privacy of individuals with respect to personal information held by a government institution and provides individuals with a right of access to that information.

This Act also protects against unauthorized disclosure of that personal information. In addition, it strictly controls how the government will collect, use, disclose, and dispose of any personal information.

Section 72 of the Privacy Act requires that the Head of every government institution prepare an Annual Report on the Administration of the Privacy Act for submission to Parliament during each fiscal year.

The Veterans Review and Appeal Board has full and exclusive jurisdiction to hear, determine and deal with all applications for review and appeal that may be made to the Board under the Pension Act, the Veterans Well-being Act - Part 3, the War Veterans Allowance Act and other Acts of Parliament. The Veterans Review and Appeal Board Act authorizes all matters related to appeals under this legislation.

This Board also adjudicates duty-related pension applications under the authority of the Royal Canadian Mounted Police Pension Continuation Act and the Royal Canadian Mounted Police Superannuation Act.

The Board’s Access to Information and Privacy (ATIP) positions include a Deputy Coordinator, a Coordinator, and Senior ATIP Officer. The Board has full responsibility for the administration of the Privacy Act. The ATIP unit is under the Director, Strategic and Corporate Services, who acts on behalf of the Chairperson of the Board to oversee the administration of the Privacy Act.

Duties of the ATIP unit include:

• Process requests for information submitted under the Privacy Act in accordance with the legislation, regulations, and Treasury Board of Canada Secretariat (TBS) policies, guidelines, and directives.
• Provide VRAB managers and staff with advice and guidance regarding the interpretation and application of the Privacy Act and related TBS policies, guidelines, and directives.
• Develop policies, procedures, and guidelines for the administration of the Act and related TBS policies, guidelines, and directives.
• Coordinate the resolution of any complaints against the VRAB made to the Privacy Commissioner under the Privacy Act.
• Respond to consultations from other government institutions on access to information requests.
• Promote awareness to ensure employees understand their roles and responsibilities and the Board fulfills its obligations under the Act.
• Respond to Parliamentary written questions on access to information.
• Support the VRAB’s commitment to openness and transparency through proactive disclosures, informal releases of information and publishing the summaries of completed access to information requests to the Open Government portal.
• Review contracts with third parties using TBS guidance documents.
• Update the VRAB’s Information about Programs and Information Holdings (formerly known as Info Source) chapter on the VRAB website in accordance with the TBS directive.
• Prepare the Annual report to Parliament and the Annual Statistical Report on the Administration of the Privacy Act.

In September 2021, the Chair of the Veterans Review and Appeal Board delegated his authority for the purposes of the Act. Annex 1 is a copy of the signed delegation instrument that took effect September 1, 2021.

Formal Privacy Requests

The Statistical Report supports oversight, accountability, and transparency by providing data on the performance of the Government of Canada’s Access to Information program. The following section provides a summary of the highlights of the Statistical Report Annex 2 on the Administration of the Privacy Act for the period of April 1, 2021, to March 31, 2022.

The VRAB ATIP unit (“the unit”) had the full ability to receive Access to Information (ATI) requests through the online portal, by email, by facsimile, or by mail. The unit received 29 formal privacy requests and 25 informal privacy requests during the reporting year.

We have seen an increase of 38% in the number of formal privacy request received in 2021-22 from the previous year.

The following chart shows the trends over the past five years of the number of formal privacy requests completed by fiscal year.

During the reporting period, the ATIP unit processed a total of 2,948 pages and disclosed 2,652 pages. This represents an increase of 4% of pages processed from the previous year.

The following table provides an overview of relevant pages processed and disclosed over the last four years.

All formal requests for personal information where completed within the legislated timeline of 30 days. 15 of 29 (51%) of the request were completed in 1 to 15 days. 14 of 29 of the requests were completed in 16 to 30 days.

The following chart shows the number of completed requests broken down by completion time.

All requests received in 2021-22 were completed within the same reporting year. VRAB has no outstanding request. No requests were carried over.

The following charts are an overview of requests received, outstanding, closed and carried over for the past five fiscal years.

Informal Privacy Request

An informal privacy request is a request for records which does not invoke the right of access provided by the Privacy Act. There is no statutory deadline within which ATIP must respond to the request. There is no right of complaint. ATIP can withhold information without explanation.

The ATIP unit has started tracking informal privacy requests in 2021-22. These represent a significant number of requests received by the Board. We received 25 informal requests for personal information from our clients.

Our level of service to our clients is important to us. We do our best to respond to informal requests in a timely fashion. 24 of 25 requests (96%) had a response time between 1 to 15 days. 1 of 25 (4%) had a response time between 16 to 30 days.

The number total pages released informally in 2021-22 was 2,659. Fifteen responses to requests had less than 100 pages. 10 responses to requests had between 100 and 500 pages.

Deemed refusal is when a government institution fails to give access to any personal information requested within the time limits set out in the Act. During the reporting period, VRAB met all statutory deadlines.

An exemption is a provision under the Privacy Act that authorizes the Head of the institution or delegate to refuse to disclose records in response to a privacy request.

Subection 26, information about another individual, was applied in 6 requests

Pursuant to sections 69 and 70 of the Privacy Act, the Act does not apply to:

• library or museum material preserved solely for public reference;
• material placed in the Library and Archives of Canada;
• personal information that is publicly available; or
• confidences of the King's Privy Council for Canada.

No exclusions were cited during the 2021-22 reporting period

VRAB takes into account privacy, confidentiality and security when providing information. Responses are provided to requesters in the desired format.

• 2 responses were provided in paper format
• 22 responses were provided in PDF format on CD
• 5 audio recordings were provided on CD

There are many changes taking place in Access to Information and Privacy across the Government of Canada. There are a number of initiatives underway relating to open government, data strategies, digital standards, and new technological solutions.

In 2021-22, training and awareness activities were paused in order to conduct a fulsome review of our materials in order to update and standardize the information according to developing TBS standards and guidelines to resume training and awareness during the upcoming fiscal year.

VRAB is actively engaged in Treasury Board Secretariat ATIP community events reviewing and updating procedures of requests for personal information and privacy incidents to ensure that our processes align with evolving policies and directives from Treasury Board.

A requester can file a complaint with the Office of Privacy Commissioner for a number of reasons. These can include:

• a delay in responding to a request
• an incomplete response
• missing information
• exemptions or exclusions invoked

VRAB did not receive any complaints nor were there any audits or investigations concluded during the reporting period.

During 2021-22, the VRAB continued to equip employees and members for remote work. The Board had full capacity to receive ATI requests and retrieve relevant electronic information. Accessing the workplace by special request following strict COVID-19 protocols was possible to obtain paper documents and prepare packages for release and mailouts.

There was a brief period when working remotely caused processing delays due to the availability of high-quality internet. IT services put in place a workaround for the issue.

There were no major changes required for the continuance of ATIP services.

The VRAB ATIP unit monitors all requests for information in Access Pro Case Management (APCM) which is an automated case tracking reporting system. The Senior ATIP Officer monitors all requests received in the ATIP unit. They provide the coordinator a weekly status on:

• the number of requests received;
• the number of pages processed;
• the number of files closed;
• and if any requests require consultation.

Two new monthly reports, including new visual graphs, were prepared and are now provided to senior management at the beginning of each month. The first report is workload related to ATIP requests. The second report provides trends by Fiscal Year over a period of five years.

A material privacy breach occurs when personal information under the control of an institution is lost, divulged error or accessed without authorization. The level of risk to the affected individual(s) is expected to cause serious injury or harm:

• physical or mental;
• socially;
• loss of reputation; or
• financially

The Board has no material breaches to report for 2021-22.

Institutions conduct a privacy impact assessment (PIA) before implementing a new program, policy, or service. An evaluation is completed to reduce the risk of a privacy breach by analysing how personal information will be collected, stored, shared, retained, and disposed. A PIA helps us protect the privacy of individuals, and promote transparency and accountability.

The Board did not conduct any new PIAs in 2021-22.

A public interest closure is the act of making information readily accessible and available to all interested individuals and institutions.

Federal governments institutions are required to report when personal information is disclosed without the consent of an individual under subjection 8(2)(m) of the Privacy Act. The disclosure of personal information without consent can occur when public interest outweighs the invasion of privacy.

The Board did not release any personal information siting subjection 8(2)(m) of the Privacy Act in 2021-22.

The cost for resources related to the Privacy Act include salaries, goods and services, software for tracking and reporting on requests, and training for ATIP staff. The cost for resources related to the Privacy Act includes salaries, goods and services, software for tracking and reporting on requests, and training for ATIP staff. The total cost of operating the program for 2021-22 is $5,364.

2021 Delegation Order – Access to Information Act and Privacy Act

The Chairperson, Veterans Review and Appeal Board, pursuant to Section 73 of the Access to Information Act and section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Chairperson as the head of the Veterans Review and Appeal Board, under the provisions of the Act and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.

Dated, at the City of Charlottetown, this first day of September, 2021.

Christopher J. McNeil

Chairperson, Veterans Review and Appeal Board

TBS/SCT 350-63

Name of institution:
Veterans Review and Appeal Board

Reporting period
From: 2020-04-01 to: 2021-03-31

Name of institution:
Veterans Review and Appeal Board

Reporting period
From: 2020-04-01 to: 2021-03-31

This publication can be made available in alternate formats upon request. For further information or to obtain additional copies please contact:

VRAB ATIP Coordinator’s Unit