Veterans Affairs Improperly Reveals Severity of Disability - Twice

A serving member of the Canadian Forces who was receiving a disability pension required immediate medical treatment and transportation in 2009. Responding to the crisis, an official at the Department of National Defence asked Veterans Affairs Canada for help.

Veterans Affairs is responsible for disability pension payments, while National Defence provides health benefits to Canadian Forces members.

A Veterans Affairs employee responded with an email containing medical details and also the exact percentage of the disability pension awarded the veteran.

The Forces member complained to our Office that the disability pension percentage was disclosed to National Defence without his consent and contrary to the formal arrangements for sharing personal information between the two departments.

The same individual had made a similar complaint in 2008 about the sharing of the disability pension percentage with National Defence. That complaint had been concluded as well founded.

An investigation by our Office established that an agreement between the two departments limits the sharing of personal information about disability pensions to five specific pieces of information, not including the percentage which indicates the severity of the affliction.

We also found no evidence that the disclosure of the complainant's disability pension percentage was in any way useful or necessary to facilitate his treatment.

Veterans Affairs submitted that its disclosure was made under the "public interest" provisions of the Privacy Act (subsections 8(2)(m )(i) and 8(2)(m)(ii)).

However, our investigation found no evidence that the disclosure of the complainant's disability pension percentage was done deliberately, as would have been expected to warrant claiming the "public interest" exemption.

Instead, the disclosure apparently occurred because an email chain among Veterans Affairs officials was forwarded to a Department of National Defence official without deleting sensitive personal information that National Defence had no apparent need to know.

We upheld the complaint as well founded.

We recommended that Veterans Affairs review and comply with its own existing policies and procedures concerning the sharing of personal information with the Department of National Defence. We also recommended that Veterans Affairs disseminate those policies and procedures to its employees and provide training about appropriate practices for handling information with the Department of National Defence.

Both recommendations were accepted and implemented. As well, Veterans Affairs Canada re-examined its arrangement with National Defence concerning the disclosure of personal information.

This incident occurred in 2009, prior to the launch of Veterans Affairs Canada's 10-point action plan to address privacy concerns.