OTTAWA — The Conservative government is promising swift action after what it admits was an ”embarrassing” breach of privacy involving a military veteran who was an outspoken critic.
Privacy Commissioner Jennifer Stoddart says the Veterans Affairs Department broke the law by failing to protect the personal information of retired intelligence officer Sean Bruyea.
Stoddart released the findings Thursday of her year-long investigation into a complaint from Bruyea, whose medical and financial information ended up in briefing notes to a federal cabinet minister.
“What we found in this case was alarming,” Stoddart said in a statement.
“The veteran’s sensitive medical and personal information was shared — seemingly with no controls — among departmental officials who had no legitimate need to see it. This personal information subsequently made its way into a ministerial briefing note about the veteran’s advocacy activities. This was entirely inappropriate.”
Bruyea called Stoddart’s findings a vindication and said the privacy violations are “morally disgusting to all Canadians.”
The department’s actions violated the federal Privacy Act, which says individual information must only be shared within government on a need-to-know basis.
Bruyea’s medical information, including diagnosis, symptoms and prognosis, were included in a 2006 briefing note to former veterans minister Greg Thompson. “What happened is serious and we will immediately take action — in fact, I can tell you that’s already begun,” said Veterans Affairs Minister Jean-Pierre Blackburn. “I think it’s actually quite embarrassing.”
Blackburn said his department has hired a privacy expert to help implement Stoddart’s recommendations.
Officials have begun reviewing the department’s use of private information and penalties for breaking the rules. New practices will be “immediately implemented in conformity with strict principles — in other words, on a need-to-know basis,” Blackburn said.
“I would like to reiterate to our veterans that no violation of their privacy will be tolerated.”
The investigation found officials from different branches of Veterans Affairs, including program policy, communications and media relations, were involved in discussing and contributing to the briefing notes and also had full access to them.
Stoddart’s investigation also found the department sent large volumes of Bruyea’s medical information to a veterans’ hospital without his consent.
She’s told Veterans Affairs to institute better protections and controls for the handling of information and to ensure that information is shared only on a need-to-know basis, among other things.
The commissioner can only make recommendations and has no enforcement power, nor is she able to levy penalties for violating the Privacy Act.
Bruyea launched a legal suit against the federal government in early September. He’s asking for $100,000 in compensation.
He said bureaucrats wanted to use his medical records — particularly his psychiatric reports — to smear him, to “falsely portray me and my advocacy to help other veterans as merely a manifestation of an unstable mind.”
“In this manner, my credibility with senior Veterans Affairs bureaucrats and the politicians was destroyed,” he said.
Other veterans, notably former combat nurse Louise Richard, have come forward with evidence that their records have also been inappropriately circulated among department officials.
Stoddart confirmed she has received complaints from other veterans.
The commissioner plans to launch an audit of privacy at Veterans Affairs that will examine the department’s policies and practices.