Privacy breach at Veterans Affairs

[old medic]

Bureaucrats who violated veteran's privacy get ‘slap on the wrist’
Murray Brewster
Ottawa— The Canadian Press
08 March 2011
copy at: http://www.theglobeandmail.com/news/politics/bureaucrats-who-violated-veterans-privacy-get-slap-on-the-wrist/article1934385/

Veterans Affairs bureaucrats who rifled through the personal files of a department critic were handed written reprimands and three-day suspensions – penalties the victim calls a “slap on the wrist.”

An internal investigation found 54 veterans bureaucrats improperly snooped through Sean Bruyea's personal files, including medical and psychiatric reports. Some of them used the information to smear the outspoken critic.

“These employees have been disciplined and department officials consider this matter has been successfully addressed and closed,” said a Feb. 25 letter to Mr. Bruyea, obtained by The Canadian Press.

The two-month internal investigation determined that 614 employees handled his file over a number of years, but many had no need to do so.

Some of his personal information was included in briefing notes to former veterans affairs minister Greg Thompson in 2006 as the Conservative government prepared to implement the New Veterans Charter, which substantially overhauled benefits for former soldiers.

Revelations last fall of the sloppy handling of Mr. Bruyea's private information within the department stoked a political fire storm, which intensified when the federal privacy commissioner ruled bureaucrats violated privacy law in the matter. The federal government fast-tracked a $400,000, out-of-court settlement and an apology for Mr. Bruyea.

Veterans Affairs Minister Jean-Pierre Blackburn defended the punishments, saying there were a number of mitigating factors, including the amount of time that has elapsed and the fear of setting a precedent by firing offenders.

“It's unbelievable,” Mr. Bruyea said upon learning the penalties, which were not outlined his letter.

Mr. Blackburn said there was no evidence officials “intended to harm” Mr. Bruyea, whose criticism risked derailing the launch of the charter.

The department didn't emphasize privacy protection before the Mr. Bruyea scandal erupted and that was also taken into account in deciding penalties, said the minister.

“I don't want to excuse what has happened, but it was part of the reality of the department at the time,” said Mr. Blackburn. “We went as far as possible for the sanctions.”

Sources at Veterans Affairs said some of the individuals have grieved the penalties under their collective agreements and the government has faced resistance from the federal employees' union.

Mr. Blackburn said a similar fiasco wouldn't happen today because bureaucrats now understand that what they did to Mr. Bruyea was wrong.

Last fall, the minister promised tough action and said some bureaucrats “may be fired” in the wake of the scandal, which struck at the heart of one of the Harper government's core constituencies – veterans.

Mr. Bruyea was shocked.

“He made the promise he would fire people,” Mr. Bruyea said Tuesday. “Don't tell me they didn't understand what they were doing. Everyone of those briefing notes on me made reference to the Privacy Act. What are they going to do? Keep breaking the law?”

Three of the senior bureaucrats named in his lawsuit last fall have received promotions. Mr. Bruyea said the message to the public service is unambiguous.

“It doesn't even come close to making government wrongdoing accountable,” he said. “It's obvious there are rewards and the message here is that the rewards for breaking the law are much greater than the punishment.”

Part of the damage control exercise saw the department set up accountability sessions with staff to make sure they understood the limits of privacy legislation. That prompted a backlash with some federal officials at the department's headquarters in Charlottetown, who claimed they had been made scapegoats for the misdeeds of senior managers and political staff.

Leaked copies of internal department electronic messages, obtained and published by The Canadian Press last fall, show that one regional manager described the mandatory gatherings as “a farce.”

 

[GK .Dundas]

I'm waiting for one the so called civil serpents  err oops I meant servants to sue the Government for all the  anguish  and suffering they had to endure while undergoing their draconian suspensions. And for their union to mutter darkly about the chilling effect this going to have on others in their position.

 

[kstart]

"Review: 'no malice' in vets privacy scandal"
http://metronews.ca/news/canada/239526/review-no-malice-in-vets-privacy-scandal/

OTTAWA – An independent investigator who reviewed privacy violations at Veterans Affairs Canada told the Harper government in late 2010 it was appropriate to include the personal medical information of an outspoken advocate in briefing material, say internal federal documents.

The central finding of the Amprax Inc. review flies in the face of the country’s privacy watchdog, who concluded almost two years ago that two briefing notes sprinkled with the references to well-known critic Sean Bruyea’s psychiatric reports broke the law.

The report was prepared for former veterans minister Jean-Pierre Blackburn at the insistence of bureaucrats who were the target of Privacy Commissioner Jennifer Stoddart’s scathing critique of the case.

The review, which cost taxpayers $24,990, didn’t find “any malice” or “fault” in the actions of bureaucrats and senior department officials.

“The Minister had the right to obtain the information provided in the two notes,” said the review, part of a briefing package dated Dec. 21, 2010.

“The Minister also had a need for that information. The Minister had a need for that information at those very moments. It is debatable whether he needed all of it. Most people believe he did.”

The records, requested by The Canadian Press 18 months ago, were released last week under access to information laws following a complaint to the country’s information commissioner.

The internal investigation by Amprax also uncovered evidence that Bruyea’s private data had been stitched into more than just two documents.

It found that “several briefing notes contained sensitive medical information concerning a complainant. As well, the notes contained significant detail about how the complainant interacted with the department.”

It laid responsibility for the mishandling of the information at the doorstep of the deputy minister and the assistant deputy minister, but largely excused the actions as ignorance, rather than characterizing it as a deliberate smear campaign against Bruyea, who was a critic of the Conservative government’s implementation of the New Veterans Charter.

“The question of malfeasance clearly do not apply in this case,” the document said. “Everybody was trying to help the client. What can be reproached is a lack of sensitivity to privacy and a lack of adjustment of the policies and procedures.”

It was noted some of the bureaucrats involved had retired, “but even if they were still in the system, it would not be a question of discipline. It would be a question of performance. Performance pay is the tool to deal with those situations, not discipline.”

The Privacy Commissioner’s Office acknowledged it was aware of the Amprax review, but declined to comment on its contents. Instead, spokesman Scott Hutchinson noted that the commissioner is conducting a comprehensive audit of Veterans Affairs.

Bruyea was shocked at the contents of the report and said it goes part of the way towards explaining why no one was fired over his case or subsequent breaches involving other critics.

He described it as a “white wash” meant to save reputations at the expense of his own.

“It shows contractors can be hired to find any conclusion the government wants and it’s pretty clear it was a pre-ordained conclusion,” he said. “What I was afraid of was that the only thing the government would learn was to how to hide and cover its tracks and that’s exactly what happened.”

Senior officials in the current minister’s office would not speak about the contents of the report on-the-record, but claimed it played no role in the government’s actions and it was the privacy commissioner’s findings that influenced the subsequent tightening of rules.

The company that conducted the review is headed by Alain Jolicoueur, a former career civil servant who served as deputy minister of Indian and Northern Affairs and president of the Canada Border Services Agency.

The current deputy minister at veterans affairs also served in a senior position at Indian Affairs, but not at the same time as Jolicoueur.

Codi Taylor, a spokeswoman for minister Steven Blaney, said recently announced improvements “provides targeted training to employees to ensure that they are aware of their obligations to follow the law when it comes to protecting the private information of our veterans.”

She reiterated that the government believes that “any privacy violation is totally unacceptable.”

Questions about the handling private information at Veterans Affairs first arose in June 2006, according to the Amprax report.

“It should have triggered serious concerns at the department level about practises around the sharing of private information. There is no evidence that a review occurred at the level of the department to deal with those concerns.”

 

 

[Nemo888]

Holy giant balls of shamelessness.

http://www.cbc.ca/news/politics/story/2012/05/28/pol-cp-bruyea-veterans-privacy-breach-consultant.html?cmp=rss&utm_source=twitterfeed&utm_medium=twitter
Veteran's privacy not violated, internal review found
Privacy commissioner disagrees, finding references to psychiatric reports in briefing notes broke law

An independent investigator who reviewed privacy violations at Veterans Affairs Canada told the Harper government in late 2010 it was appropriate to include the personal medical information of an outspoken advocate in briefing material, say internal federal documents.

The central finding of the Amprax Inc. review flies in the face of the country's privacy watchdog, who concluded almost two years ago that two briefing notes sprinkled with the references to well-known critic Sean Bruyea's psychiatric reports broke the law.

The report was prepared for former veterans minister Jean-Pierre Blackburn at the insistence of bureaucrats who were the target of Privacy Commissioner Jennifer Stoddart's scathing critique of the case.

The review, which cost taxpayers $24,990, didn't find "any malice" or "fault" in the actions of bureaucrats and senior department officials.

"The Minister had the right to obtain the information provided in the two notes," said the review, part of a briefing package dated Dec. 21, 2010.

"The Minister also had a need for that information. The Minister had a need for that information at those very moments. It is debatable whether he needed all of it. Most people believe he did."
'Several' notes contained sensitive medical information

The records, requested by The Canadian Press 18 months ago, were released last week under access to information laws following a complaint to the country's information commissioner.

The internal investigation by Amprax also uncovered evidence that Bruyea's private data had been stitched into more than just two documents.

It found that "several briefing notes contained sensitive medical information concerning a complainant. As well, the notes contained significant detail about how the complainant interacted with the department."

It laid responsibility for the mishandling of the information at the doorstep of the deputy minister and the assistant deputy minister, but largely excused the actions as ignorance, rather than characterizing it as a deliberate smear campaign against Bruyea, who was a critic of the Conservative government's implementation of the New Veterans Charter.

"The question of malfeasance clearly do not apply in this case," the document said. "Everybody was trying to help the client. What can be reproached is a lack of sensitivity to privacy and a lack of adjustment of the policies and procedures."

It was noted some of the bureaucrats involved had retired, "but even if they were still in the system, it would not be a question of discipline. It would be a question of performance. Performance pay is the tool to deal with those situations, not discipline."

The Privacy Commissioner's Office acknowledged it was aware of the Amprax review, but declined to comment on its contents. Instead, spokesman Scott Hutchinson noted that the commissioner is conducting a comprehensive audit of Veterans Affairs.
Government 'covering its tracks': Bruyea

Bruyea was shocked at the contents of the report and said it goes part of the way towards explaining why no one was fired over his case or subsequent breaches involving other critics.

He described it as a "white wash" meant to save reputations at the expense of his own.

"It shows contractors can be hired to find any conclusion the government wants and it's pretty clear it was a pre-ordained conclusion," he said. "What I was afraid of was that the only thing the government would learn was to how to hide and cover its tracks and that's exactly what happened."

Senior officials in the current minister's office would not speak about the contents of the report on-the-record, but claimed it played no role in the government's actions and it was the privacy commissioner's findings that influenced the subsequent tightening of rules.

The company that conducted the review is headed by Alain Jolicoueur, a former career civil servant who served as deputy minister of Indian and Northern Affairs and president of the Canada Border Services Agency.

The current deputy minister at veterans affairs also served in a senior position at Indian Affairs, but not at the same time as Jolicoueur.

Codi Taylor, a spokeswoman for minister Steven Blaney, said recently announced improvements "provides targeted training to employees to ensure that they are aware of their obligations to follow the law when it comes to protecting the private information of our veterans."

She reiterated that the government believes that "any privacy violation is totally unacceptable."

Questions about the handling private information at Veterans Affairs first arose in June 2006, according to the Amprax report.

"It should have triggered serious concerns at the department level about practises around the sharing of private information.

There is no evidence that a review occurred at the level of the department to deal with those concerns."

 

[The Bread Guy]

Holy "holding a mirror in front of a mirror", Batman!

The privacy watchdog is looking at whether a Veterans Affairs investigation of a breach of privacy actually involved another breach of privacy.

The department hired an outside contractor, Amprax Inc., to look at how personal information about veterans advocate Sean Bruyea ended up in a ministerial briefing note in 2006.

Privacy Commissioner Jennifer Stoddard ruled in 2010 that the leak violated the law, but Amprax issued a report which cleared bureaucrats in the case.

In the course of that investigation, however, Bruyea says Amprax was given access to as many as 4,000 documents on him during its investigation.

Bruyea also claims that as many as 24 people — deemed by the commissioner the first time around to have had no business looking at the information — were also shown records they had no reason to see.

Things have now come full circle, with Stoddard investigating the investigation.

"Rest assured that the issue of privacy of veterans is a top priority for our office," said a May 29 letter to Bruyea, obtained by The Canadian Press ....

The Canadian Press, 4 Jun 12

 

[Wookilar]

Seriously? I thought that the Amprax "investigation" was absolute crap to begin with but this takes the cake.

Who thought it was a good idea to hire a (former) snr bureaucrat to investigate other snr bureaucrats in the first place? Don't these people get taught even the most basic tenets of the "front page challenge?"

 

[The Bread Guy]

This from the House of Commons yesterday on the latest:

Mr. Sylvain Chicoine (Châteauguay—Saint-Constant, NDP):  Mr. Speaker, cutting culture and spying on veterans. The Conservatives have a fine record, to be sure.  In terms of violations of veterans' privacy, we thought we had seen it all. But here we have a Department of Veterans Affairs' inquiry into privacy violations that is now under investigation itself for privacy violations.  The allegation has led to an investigation by the Privacy Commissioner.  Can the minister tell us why he is incapable of putting a stop to the continued violations of veterans' privacy?

Hon. Steven Blaney (Minister of Veterans Affairs, CPC):  Mr. Speaker, it is very clear. Our government believes that any breach of confidentiality is totally unacceptable. That is why we do not agree with the Jolicoeur report. We do agree with the Privacy Commissioner's report and that is why I have asked the staff in my department to co-operate fully with the commissioner during her investigation.

Mr. Peter Stoffer (Sackville—Eastern Shore, NDP):  Mr. Speaker, not only privacy issues are at stake at the Department of Veterans Affairs.  Surprisingly, Sarah Atwood, a 90-year-old World War II veteran was denied access to Camp Hill. Ted Shiner, a 91-year-old veteran in Bedford, Nova Scotia, was denied VIP services just like 87-year-old Harry Gulkin of Outremont and Art Humphreys, who unfortunately passed away before he was able to get a lift to help him go up and down his stairs.  All these World War II veterans were denied benefits, but surprisingly the government found $700,000 to give to well-paid executive managers at DVA.  How can the minister possibly justify $700,000 to well-paid public servants and deny World War II heroes—

The Speaker:  Order, please.  The hon. Minister of Veterans Affairs.

Hon. Steven Blaney (Minister of Veterans Affairs, CPC):  Mr. Speaker, we have invested billions of dollars so that our veterans have access to all the services and benefits to which they are entitled.  Of course, veterans must meet the criteria to become eligible for those programs. That is what our officials do. They are dedicated people. Thousands of public servants are working every day to assess each veteran's specific needs. I can tell you that they do a remarkable job. We can be proud of the public servants in the Department of Veterans Affairs. Their job is to look after a national treasure, our veterans themselves.

 

[GAP]

Bonuses appear bogus

Veterans Affairs managers rewarded for dodgy results
Calgary Herald June 3, 2012
Article Link

The news that 57 of the top brass at Veterans Affairs Canada raked in nearly $700,000 in extra pay awarded in bonuses and for getting results in 2011, elicits a two-word response: What results?

The results the department has achieved in the past few years have been less than stellar, and certainly not worth an approximate breakdown of $12,200 extra per manager.

Veterans have made public a litany of complaints about the department, including shabby treatment and privacy breaches. No wonder Gulf War veteran Sean Bruyea describes the bonus situation as "way out of whack with reality."

After Bruyea claimed in 2010 that the department had misused his personal data and harassed his family in an effort to discredit his advocacy, federal privacy commissioner Jennifer Stoddart said that the department had broken the law. A lawsuit was eventually settled out of court, and the department apologized, but Bruyea says every one of the civil servants in his lawsuit received bonuses.

This kind of work in the private sector would more likely result in someone being shown the door, rather than being handed a fat cheque for a job well done.

In February of this year, veterans ombudsman Guy Parent found that many veterans were also unable to appeal the department's denial of benefits because no reason was given for their claims being rejected. Without a reason given, an appeal can't go forward.

Parent also found that the language used to communicate with the veterans was convoluted and confusing, and that veterans may have been wrongly assessed but were left without an avenue of appeal because the letters they received "did not reveal where the department's decision was flawed."

One has to wonder what the managers of Veterans Affairs need to do in order to get passed over for bonuses, if the above incidences aren't enough to make a dent in their annual windfall envelopes.

The bonuses are decided upon jointly by Treasury Board and senior managers at Veterans Affairs - and the latter's involvement is pretty bad optics.

Veterans Affairs Minister Steven Blaney needs to take charge of this mess by calling those senior managers on the carpet and instituting some guidelines by which real results are measured before bonuses are handed around.

Sadly, the impression left by all of this is of a department more interested in perpetuating and enriching itself than in helping those who risked their lives for this country and came home to an uncaring bureaucracy whose priorities have been lost. Blaney has some serious work ahead of him to correct that perception.
end

 

[The Bread Guy]

VAC Info-machine:  Lookit all the changes made to the privacy rules!

The Honourable Steven Blaney, Minister of Veterans Affairs, announced today the full implementation of key elements of his Privacy Action Plan 2.0, which was launched in May 2012. This is part of ongoing efforts to further strengthen the protection of personal information at Veterans Affairs Canada,

“Our Government recognizes that building and maintaining a strong culture of privacy demands ongoing vigilance,” said Minister Blaney. “We are pursuing the highest standards in privacy protection so that all Veterans can be confident their personal information is safe and their rights are being fully respected.”

The Privacy Action Plan 2.0 builds on the success of the Department’s original 10-point Privacy Action Plan, which was announced in October 2010 to address concerns with how Veterans Affairs Canada was safeguarding the privacy of the men and women it serves. The new measures in the Privacy Action Plan 2.0 include:

• providing targeted training on privacy principles;
• streamlining consent forms;
• ensuring new initiatives are compliant with privacy requirements; and
• monitoring and evaluating transactions that involve private information.

   
(....)

More on the new privacy plan here.

 

[blackberet17]

We have one big software which basically runs the show, if you will, called CSDN, Client Service Delivery Network.

It wasn't until the privacy breaches were made public that the ACCESS CONTROLS built into the system WHEN IT WAS FIRST DEVELOPED were finally implemented (essentially turned on, for Pete's sake) roughly A YEAR after the first breach was made public.

Now it's all tracked. We can't access a file on CSDN without indicating for what purpose. Any client file which is being watched for any reason (I don't know what the criteria are) and you try to access it? You get an e-mail, to which we must respond within 24 hours, or they then send an e-mail asking your supervisor to verify the reasons.

It's just one of the new measures I know about anyway. Others are not presently within my arcs

 

[Wookilar]

That's interesting.

Now, to play devil's advocate kinda sorta, does that result in any kind of slow down wrt waiting for responses or clearance to look at files?

And does this really stop the higher levels briefing the minister and DMs? I do not believe that the ground level workers ever really compromised anything, it all seems to be higher level functionaries.

 

[blackberet17]

Some good questions there wook.

It doesn't slow down anything, really. Reading through client files is still a paper-based process for the most part. It takes time and money to create electronic versions of all the documents in a client's file.

The Minister (or his staff, really, which is a separate entity of sorts from the VAC staff) is continuously briefed, just like any other Minister would be (Health, Treasury, Transport, etc.). And it's the ADMs' job to brief the Minister, right? Very similar to any normal CoC.

Now here's the tricky thing with the privacy breaches, and this is already public knowledge, but a lot of folks gloss over it.

I'll take the example of a good friend of mine. Rick went to a VAC District Office in Victoria BC a few years back to look into what he needed to do to apply for a pension. He was never a client before. That first point of contact created a Client Note in CSDN, essentially creating or opening an "account" for him with VAC. A few months later, he called the 1-800 number, which initiated a Client Note again, and he was sent an application form.

A couple months later, Rick completed the application as best he could, and went to the DO to drop it off. Client Note created. A Case Manager starts looking into the Rick's file, and notes something's missing from the application. She calls Rick, and leaves a message. Client Note created.

Already, we have four Client Notes created, so four accesses into this new account on CSDN, and Rick's application hasn't even left the District Office yet.

By the time his application gets to Charlottetown, and it's reviewed by a Disability Adjudicator, and the service docs are ordered and received and copies made and sent back, and the medical docs are ordered and received and you get the point, and then it all goes to a Medical Advisor, and so on, and Rick calls to check on the progress, and etc...long story short, we could have 50 different people accessing Rick's account on CSDN.

There are lots of stories and rumours regarding the privacy breaches. Some folks received suspensions, some got letters of reprimand (call it a Written Warning), some were pushed into retirement. It's not an area I can really comment on. But a lot has been in the press about "hundreds" of people accessing client files who, to some, may have had no reason to access the file. The reality is far different. The CSDN network is the electronic repository of client information. Your address is there, phone number, a lot of banal stuff. You call or write in an update to your mailing address because you've been posted? Bang, at minimum one person is going to access it.

Anyway, this is a minor vent on my part. A lot has been made about the breaches, and maybe some people were in the wrong, and others could have been just a clerk changing your postal code by a digit. Very  few of us lower peons know much about the briefing notes and all that fun stuff which has hit the press, it's out of our arcs.

 

[Nemo888]

http://news.nationalpost.com/2012/11/09/veteran-minister-breach-of-privacy/

Veterans minister halted ombudsman’s investigation into breach of soldier’s privacy

n investigation by Canada’s veterans ombudsman into a controversial breach of privacy was quietly shut down last year on the instructions of Veterans Affairs Minister Steven Blaney, newly released documents reveal.

Blaney asked the ombudsman to discontinue a probe that his predecessor had ordered in January 2011, after the confidential medical information of veterans advocate Sean Bruyea was spread around the department in an alleged smear campaign.

Information from a psychiatrist’s letter was stitched into a ministerial briefing note at the same time Bruyea, an outspoken critic, was publicly criticizing a controversial overhaul of veterans benefits in 2006.

Former veterans minister Jean-Pierre Blackburn asked the ombudsman to investigate Bruyea’s privacy breach, even though the office of the privacy commissioner was already looking in to what happened.
Related

    Disabled veterans, widows slam Harper government ahead of Remembrance Day

    Matt Gurney: Veterans deserve a job at least as much as bureaucrats

    Tories spent more than $750,000 in court battle against veterans’ pension claim

The hope was the ombudsman would get to the bottom of why the personal information of Bruyea and others was rifled through by bureaucrats — motives that were not the focus of the overarching privacy audit by commissioner Jennifer Stoddart.

But in July 2011, just two months after Blackburn went down to electoral defeat, Blaney — Blackburn’s replacement at the cabinet table — wrote to ombudsman Guy Parent to ask that the probe be halted.

“I have since been able to carefully review this case with my officials,” Blaney wrote in the letter, obtained by The Canadian Press.

“We have determined that the best course of action is a review by the office of the privacy commissioner. In this way, the commissioner can complete an assessment of the department’s actions and conclude on its compliance with the requirements of the Privacy Act.”

Lisa Monette, a spokeswoman for the ombudsman, said Parent agreed the privacy commissioner was best positioned to review the matter, but that the ombudsman “stood willing to assist as needed.”

A spokesman for Blaney, Niklaus Schwenker, said the minister acted swiftly to refer the matter to Stoddart, and reiterated that the Harper government has “brought forward sweeping privacy improvements within the department.”

The federal government settled a lawsuit with Bruyea out of court and has implemented a series of measures meant to tighten up the handling of personal information within the department.

Veterans Affairs is in the unusual position of holding a vast amount of personal data — including medical files — on ex-soldiers, some of whom turn into outspoken critics.

    Obviously they’re trying to hide something

A number of advocates other than Bruyea have claimed their files were used to discredit them within the department and political circles.

One of the country’s most decorated veterans of the Bosnia war, retired sergeant Tom Hoppe, is one of those who says officials were snooping in his records in 2006.

Hoppe, who plans to protest by not wearing his medals on Remembrance Day, said no one has atoned for the violations of personal privacy.

In an audit released a few weeks ago, Stoddart gave the veterans department a thumbs-up, suggesting it had cleaned up its act.

Blaney’s letter startled New Democrat veterans critic Peter Stoffer, who said it calls into question the independence of the ombudsman.

“When he gets a request to look into something, that office should have the independence and the staff to do so,” Stoffer said. Precisely why the privacy breaches occurred remains an unresolved issue, he added.

“They had a change of heart — why? There’s no question the government suddenly changed its mind and didn’t want the ombudsman to look into it. Obviously they’re trying to hide something.”

Schwenker pointed out that Parent had the option of continuing with the investigation.

“The Office of Veterans Ombudsman does not follow our direction and is fully independent,” he said late Friday. “The independent ombudsman is free to pursue any case he wishes and MP Stoffer knows this full well.”