2024-2025 Annual Report Administration of the Privacy Act

• Message from the Chair
• Introduction
• About the Veterans Review and Appeal Board
• Organizational Structure
• Delegation order
• Performance for 2024-2025
• Formal privacy requests
• Informal privacy request
• Complaints
• Extensions
• Consultations
• Training and Awareness
  • Onboarding of new staff
  • The impact of records and information management on access and privacy
  • Privacy breach management and prevention
  • Policies, guidelines, and procedures
• Initiatives and projects to improve privacy
  • Digitization of hearing recordings
  • Service Health Record Search Tool (SHRST)
  • Modernization of hearing recording process
  • ATIPXpress
• Summary of key issues and actions taken on complaints
• Material privacy breaches
• Privacy impact assessments
• Public interest discloures
• Monitoring compliance
• Annex A: 2024 Delegation Order Access to Information Act and Privacy Act
• Annex B: Statistical reports on the Privacy Act
• Annex C: Supplemental statistical report on the Access to information Act and Privacy Act

On behalf of the Veterans Review and Appeal Board (VRAB, the Board), I am pleased to present the 2024-2025 annual report to Parliament on the administration of the Privacy Act.

This legislation enhances government transparency by allowing Canadian citizens to access information held by the Government of Canada. It promotes openness, accountability, and dialogue between citizens and their government.

The Board is focused on digital innovation and ensuring we have an effective information management system so that Canadians can exercise their right of access and receive high-quality information without delay.

During the reporting period, the Board advanced the implementation of ATIPXpress, a new system designed to modernize how access to information and privacy requests are handled. With setup, testing, and staff training nearly complete, we hope to see a significant improvement in the efficiency and accuracy of processing requests.

In the 2024-2025 fiscal year, the Board’s Access to Information and Privacy (ATIP) unit handled 120,689 pages in response to ATIP requests, a workload increase of 79%, up from 67,459 pages in 2023-2024. We met our legislated timelines 100% of the time.

I encourage you to read through and learn more.

Sincerely,

Christopher J. McNeil

The Privacy Act protects the privacy of individuals with respect to personal information held by a government institution and provides individuals with a right of access to that information.

This Act also protects against unauthorized disclosure of that personal information. In addition, it strictly controls how the government will collect, use, disclose, and dispose of any personal information.

Section 72 of the Privacy Act requires that the Head of every government institution prepare an Annual Report on the Administration of the Privacy Act for submission to Parliament during each fiscal year.

The Veterans Review and Appeal Board has full and exclusive jurisdiction to hear, determine and deal with all applications for review and appeal that may be made to the Board under the Pension Act, the Veterans Well-being Act - Part 3, the War Veterans Allowance Act and other Acts of Parliament. All matters related to appeals under this legislation are authorized under the Veterans Review and Appeal Board Act.

The Board also adjudicates applications for review and appeal of duty-related disability pension decisions under the authority of the Royal Canadian Mounted Police Pension Continuation Act and the Royal Canadian Mounted Police Superannuation Act.

The Board follows the open court principle. This means that hearings and decisions are open to the public.

All of the Board's published decisions are available on the Canadian Legal Information Institute (CanLII) website. CanLII is a well-known legal resource that organizes decisions by year and is searchable by key word.

To balance openness in decision-making with applicants’ privacy, the Board removes personal information that is not relevant to the reasons for the decision. This includes names of the applicant or appellant and non-expert witnesses, as well as other information that could identify the individual (e.g. file numbers or home address). A published decision may contain some information that is relevant to the decision, such as:

• the relationship between the applicant/appellant and a family member or witness at the hearing;
• medical conditions;
• occupational information;
• personal characteristics that are relevant to the disability application; and
• excerpts of medical opinions and doctors' reports.

This approach is consistent with the principles found in the "Use of Personal Information in Judgments and Recommended Protocol" approved by the Canadian Judicial Council.

The Board has full responsibility for the administration of the Access to Information Act and the Privacy Act. The ATIP unit is under the Director, Strategic and Corporate Services, who acts on behalf of the Chair of the Board to oversee the administration of the Access to Information Act and the Privacy Act.

Duties of the ATIP unit include:

• Process requests for information submitted under the Access to information Act and the Privacy Act in accordance with the legislation, regulations, and Treasury Board of Canada Secretariat (TBS) policies, guidelines, and directives.
• Provide VRAB managers and staff with advice and guidance regarding the interpretation and application of the Access to information Act and the Privacy Act and related TBS policies, guidelines, and directives.
• Develop policies, procedures, and guidelines for the administration of the Act and related TBS policies, guidelines, and directives.
• Coordinate the resolution of any complaints against the VRAB made to the Information Commissioner under the Access to Information Act and the Privacy Act.
• Respond to consultations from other government institutions on Access and Privacy requests.
• Promote awareness to ensure employees understand their roles and responsibilities and the Board fulfills its obligations under the Acts.
• Respond to Parliamentary written questions on access to information and privacy breaches.
• Support the VRAB’s commitment to openness and transparency through proactive disclosures, informal releases of information and publishing the summaries of completed access to information requests to the Open Government portal.
• Review contracts with third parties using TBS guidance documents.
• Update the VRAB’s Information regarding Info Source chapter, on the VRAB website, in accordance with the TBS directive.
• Monitor and report on the Board’s proactive disclosures.
• Prepare the Annual reports to Parliament and the Annual Statistical Report on the Administration of the Access to Information Act and the Privacy Act.

In September 2024, the Chair of the Veterans Review and Appeal Board delegated his authority for the purposes of the Act. Annex A is a copy of the signed delegation instrument that took effect September 1, 2024.

In the 2024-25 fiscal year, the Board’s performance in responding to requests for personal information under the Privacy Act has been marked by notable efficiency and transparency. The period saw a significant increase in the volume of pages processed.

In the 2024-25 fiscal year, VRAB responded to 100% of the personal information requests received within the legislated timeline – a key measure of the Board’s performance.

Table 1. The number of completed formal requests broken down by completion times

Out of a total of 31 requests, 26 were responded to within 1 to 15 days, and four were responded to within 16 to 30 days. Only one request took between 31 to 60 days. This distribution highlights the Board’s commitment to prompt responses.

There were two active requests carried over to the new fiscal year that are still within the legislated timeframe.

There were 88,314 pages processed and 84,056 pages disclosed under the Privacy Act.

Fifteen requests were disclosed in full. Five requests were disclosed in part by applying section 26 of the Privacy Act. For 11 requests, there were no existing records.

Table 2. The number of completed informal requests broken down by completion times

In the 2024-25 fiscal year, the Board handled a total of 18 informal privacy requests. Of these, all 18 requests were responded to within 1 to 15 days. This distribution is reflective of the Board’s dedication to maintaining high standards of service.

A total of 1,241 pages related to these informal privacy requests were processed and released.

A complaint under the Privacy Act is a formal grievance lodged by an individual who believes that a federal institution has mishandled their personal information. This can include unauthorized disclosure, improper collection, or failure to provide access to personal records.

The Board had no active complaints as of the end of the 2024-25 fiscal year.

Under the Privacy Act, extensions are permissible in certain circumstances to allow institutions more time to respond to requests for personal information. These extensions ensure that institutions can provide thorough and accurate responses while maintaining operational efficiency.

In 2024-25, one extension was applied to due a large volume of documents retrieved.

Consultations can be necessary when responding to formal privacy requests under the Privacy Act to ensure that the information provided is accurate, complete, and compliant with legal and regulatory requirements. These consultations help maintain the integrity and reliability of the information provided, ensuring that the institution meets its obligations under the Privacy Act.

In 2024-25, there were no consultations sought.

In 2024-25, ATIP and the Information Management (IM) unit at the Board worked together to strengthen ATIP training for VRAB staff and Members.

Onboarding of new staff

As part of their onboarding, 47 new VRAB hires benefited from a newly developed ATIP training session which provides a comprehensive overview of personal information and information of business value, emphasizing the crucial role that Board employees play in managing information and complying with relevant legislation. The training also covered best practices for handling information of business value and strategies to prevent privacy breaches.

Similarly, 35 new VRAB hires attended IM training focusing on the efficient and effective management of records and information to support sound program delivery, decision-making, accountability, transparency, collaboration, and compliance with relevant legislation. Additionally, employees were reminded of their role in preserving and granting access to information for the benefit of current and future Canadians.

The IM unit also provided training to 11 new students working on a hearing recording digitization project. Topics covered included: proper handling and transportation of client records, the proper disposition protocols of physical media once digitized, and the handling of client information in electronic client systems.

Expanding training for staff and students can positively impact the Access to Information and Privacy regime in several ways:

Awareness of IM Practices: Employees gain a better understanding of how good IM practices support effective record-keeping. This awareness contributes to an efficient ATIP system.

Efficient Record Handling: Proper training ensures that employees handle client records appropriately during digitization. This includes understanding how to manage physical media once it’s digitized, ensuring consistent and accurate information management.

Enhanced Service: Well-trained employees can provide timely and consistent service to requesters. By following proper protocols, they contribute to a smoother ATIP process, benefiting both the public and government institutions.

The impact of records and information management on access and privacy

In 2024-25, the Board’s ATIP unit delivered a presentation to middle managers on how records and information management practices affect access to information and privacy. The session emphasized the importance of adopting best practices in information management to support access and privacy obligations, as well as the duty to document key elements in promoting transparency and accountability.

Effective records and information management plays a crucial role in enhancing access to information and privacy protection. By implementing strong records and information management practices, organizations can ensure that records are accurately maintained, easily retrievable, and appropriately safeguarded. This reduces the risk of records being lost or inappropriately deleted, which in turn minimizes search times and costs associated with locating mishandled information. Moreover, well-managed records support transparency and accountability, enabling organizations to respond promptly to information requests.

Privacy breach management and prevention

The ATIP unit provided training to newly appointed team leads and managers in VRAB Operations, covering topics such as preventing privacy breaches using real work examples, managing incidents related to privacy breaches including documentation and containment, and provided instructions on how to complete the VRAB Privacy Event Form.

Policies, guidelines, and procedures

The Board’s ATIP unit continued to support managers by providing ongoing advice and guidance on policies, guidelines, and procedures. This consistent support helped managers implement and follow established protocols, reinforcing a culture of compliance and informed decision-making.

In today’s digital age, access to information is essential. The Board is working on key projects that use innovation to protect and manage information, improve access to justice, boost productivity, and foster an inclusive culture that empowers staff to support all Veterans.

The Board strives to be open and transparent, so that Veterans and Canadians can hold VRAB accountable for its actions and decisions.

Digitization of hearing recordings

The digitization of hearing recordings allows for enhanced access to historical hearing recordings. It ensures the preservation of the information and streamlines the record retrieval process by reducing the time and effort needed to access recordings.

The digitization hearing recordings on cassette tapes began in March 2023 with 115, 744 cassettes that needed to be digitized. From April 1, 2024, to March 31, 2025, 22 FSWEP students worked on the cassette digitization project. During this time, the team processed 47,131 cassettes.

Service Health Record Search Tool (SHRST)

The SHRST is used by the VRAB Pre-hearing team to facilitate the creation of the Statement of Case (SOC). The SOC is a compilation of relevant evidence and information from various sources, prepared by the Board for a Veteran’s hearing. It includes documentation from Veterans Affairs Canada, the Department of National Defence, and previous hearings, and may be updated with new evidence presented during the hearing. This tool enables efficient searching through digital documents for relevant information in the official client repository, which can then be bundled to support clients’ decisions.

The protection of client privacy is a top priority at the Board. The SHRST restricts access to personal information, allowing access only to authorized personnel with a legitimate need. Additionally, the system provides comprehensive auditing capabilities to track access to client files within the SHRST. By enabling work completion within the system itself, the tool minimizes the risk of inadvertently sharing client information outside the secure environment, enhancing overall data security.

Modernization of hearing recording process

The Board has begun a multi-stage modernization initiative to replace a legacy hardware-based recording process with a modern, digital-first solution. Transitioning from Philips digital handheld recorders to MS Teams for hearing recordings offers significant advantages for the Board, Members, and Veteran clients. A digital-first, cloudbased solution streamlines access to recordings, eliminating the need to transfer files via email and reducing the risk of data loss or unauthorized access. Recordings are securely stored and easily retrievable, supporting timely responses to ATIP requests and improving overall information governance. This modern approach, set for implementation in 2025-26, will enhance transparency and efficiency, in turn improving service delivery to Veterans.

ATIPXpress

During the reporting period, VRAB began implementing ATIPXpress, a modern Request Processing Software Solution designed to improve the management of access to information and privacy requests. The first phase of implementation at the Board included system setup, customization, internal testing, and hands-on training for the ATIP team. Once fully operational, ATIPXpress will streamline processes by automating many manual tasks and enhancing access to released records.

The implementation is nearly complete, with a full launch anticipated in the next reporting cycle.

The Privacy Commissioner can receive and investigate complaints from individuals regarding:

• Their personal information being misused or wrongly shared by a government institution;
• Being denied access to their personal information;
• Not being given their rights or having their requests to correct personal information unjustly refused;
• Unreasonable delays in accessing their personal information;
• Not getting their personal information in the official language they requested;
• Not getting their personal information in an alternative format they requested;
• Being charged an inappropriate fee;
• Issues with the index of personal information;

and any other issues related to:

• How personal information is collected, kept, or disposed of by a government institution;
• How personal information is used or shared by a government institution; and
• Accessing personal information.

During the 2024-2025 period, there were no privacy complaints reported to the Office of the Privacy Commissioner. This indicates that all privacy protocols and measures have been effectively maintained, ensuring the protection of personal information and compliance with relevant privacy regulations. This achievement reflects a strong commitment to safeguarding personal information and upholding privacy standards.

A material privacy breach happens when an institution loses or improperly shares personal information, or when unauthorized access occurs. A breach can lead to serious harm to the affected individual(s), including physical or mental injury, social harm, damage to reputation, and/or financial loss.

The Board had no material breaches to report in 2024-25.

A Privacy Impact Assessment (PIA) is a process used to identify and address privacy risks in projects or systems that handle personal data. It helps ensure that personal information is collected, stored, and used in a way that respects privacy laws and protects individuals’ privacy rights.

No PIAs were conducted by the Board in 2024-25.

Paragraph 8(2)(m) of the Privacy Act grants the head of an institution the discretion to disclose personal information if it is deemed to be in the public interest. No information was disclosed under this provision in 2024-25.

The Board’s ATIP unit monitors all requests for information through Access Pro Case Management (APCM). APCM is a case management system designed to handle ATIP requests. The system allows the Board to track requests, manage documents, and ensure compliance with relevant legislation.

The ATIP unit prepares two reports to provide a monthly snapshot for senior managers and the Chair’s Office. The first report is workload related to ATIP requests. It provides information on the number of requests, the number of pages processed, and the number of pages released for the fiscal year to date. The second report provides trends by fiscal year over a period of five years. Additional feedback is provided when trends present situations that need addressing such workload distribution, balancing priorities, and identifying the need for additional resources.

Detailed analysis of privacy breaches is completed on a monthly basis in order to identify trends to target support and training.

The Chair of the Veterans Review and Appeal Board, pursuant to Section 73 of the Access to Information Act and section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Chair as the head of the Veterans Review and Appeal Board, under the provisions of the Act and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.

Dated, at the City of Charlottetown, this first day of September 2024.

Christopher J. McNeil

Chair, Veterans Review and Appeal Board

TBS/SCT 350-63

Name of institution:
Veterans Review and Appeal Board

Reporting period
From: April 1, 2024

To: March 31, 2025

Name of institution:
Veterans Review and Appeal Board

Reporting period
From: April 1, 2024

To: March 31, 2025