Collection of RCMP member's health information unnecessary (VAC) - November 17, 2014
The complainant alleged that Veterans Affairs Canada (VAC) inappropriately disclosed her health and financial information to the Royal Canadian Mounted Police (RCMP). The investigation found that VAC disclosed the complainant's medical diagnosis and financial information to the RCMP's National Compensation Policy Centre via its pension award letter. This disclosure was found to contravene the Privacy Act because it was not a 'consistent use' of the information, as neither consent nor a clear need-to-know was established for the RCMP's National Compensation Policy Centre to receive this sensitive personal information. The issue was also found to be systemic, affecting numerous RCMP employees.
- Was the disclosure of the complainant's medical and financial information by VAC to the RCMP a contravention of the Privacy Act?
- Did the complainant provide informed consent for the disclosure of her personal information?
- Was the disclosure of information considered a 'consistent use' under paragraph 8(2)(a) of the Privacy Act?
- Was the disclosure of personal information systemic in nature?
Complaint well-founded — corrective measures recommended
VAC disclosed sensitive medical and financial information to the RCMP without a clear need-to-know or demonstrated consent, failing the 'consistent use' provision of the Privacy Act. The issue was systemic, affecting numerous RCMP employees.
AI-generated summary for reference only. Always verify against the official decision ↗
VAC was recommended to update its Memorandum of Understanding (MOU) with the RCMP to clearly articulate the flow of sensitive personal information and to periodically review it. VAC agreed to update the MOU.
- s. 3 Privacy Act
- s. 8(1) Privacy Act
- s. 8(2)(a) Privacy Act
This summary is informational only and not legal advice.