Canadian privacy & access decisions

A former RCMP member complained that Veterans Affairs Canada (VAC) inappropriately disclosed her medical diagnosis, disability percentage, and financial information to the RCMP's National Compensation Policy Centre. VAC argued the disclosure was a 'consistent use' under the Privacy Act, citing the RCMP's responsibility for members' health services and an MOU between the two institutions. The OPC found that the information provided to the complainant at the time of application was inadequate to establish informed consent for such disclosure. Furthermore, the MOU did not explicitly authorize the sharing of detailed medical and financial information with the RCMP's National Compensation Policy Centre. The OPC concluded that the disclosure was not a consistent use and therefore contravened the Privacy Act, noting the systemic nature of this issue affecting many RCMP employees.

• Whether the disclosure of the complainant's medical and financial information by VAC to the RCMP was authorized by consent under subsection 8(1) of the Privacy Act
• Whether the disclosure of the complainant's medical and financial information by VAC to the RCMP was for a consistent use under paragraph 8(2)(a) of the Privacy Act
• Whether the information provided to disability pension applicants by VAC was sufficient to establish informed consent for disclosure to the RCMP
• Whether the Memorandum of Understanding (MOU) between VAC and the RCMP authorized the detailed sharing of personal medical and financial information
• Whether the RCMP's National Compensation Policy Centre had a 'need to know' the complainant's detailed medical and financial information

A former RCMP member complained that the RCMP inappropriately collected her personal medical and financial information from Veterans Affairs Canada (VAC) after she was awarded a disability pension. The complainant alleged that the RCMP's National Compensation Policy Centre had no need for this sensitive information. The OPC found that the 2002 Memorandum of Understanding (MOU) between the RCMP and VAC transferred responsibility for pension administration to VAC, meaning the RCMP's National Compensation Policy Centre did not require the detailed medical diagnosis or financial information. The OPC concluded that the collection of this information by the RCMP was not for a purpose consistent with section 4 of the Privacy Act. The complaint was found to be well-founded, and the OPC recommended updating the MOU and reviewing RCMP's internal policies on access to medical records.

• Whether the collection of the complainant's financial information by the RCMP was necessary and related directly to an operating program or activity under section 4 of the Privacy Act
• Whether the collection of the complainant's medical diagnosis/pensioned disability by the RCMP was necessary and related directly to an operating program or activity under section 4 of the Privacy Act
• Whether the collection of the complainant's disability percentage by the RCMP was necessary and related directly to an operating program or activity under section 4 of the Privacy Act
• Whether the collection of personal information by the RCMP's National Compensation Policy Centre was consistent with the RCMP's own internal policies restricting access to sensitive medical information
• Whether the MOU between VAC and the RCMP adequately addressed information sharing practices for sensitive personal information