2025-2026 Annual Report Administration of the Privacy Act

• Message from the Chair
• Introduction
• About the Veterans Review and Appeal Board
• Organizational Structure
• Delegation order
• Performance for 2025-2026
  • Formal privacy requests
  • Informal privacy request
• Complaints
• Extensions
• Consultations
• Training and Awareness
  • Onboarding of new staff
  • Privacy awareness and support
  • Privacy breach management and prevention
  • Policies, guidelines, and procedures
• Initiatives and projects to improve privacy
  • Digitization of hearing recordings
  • Physical Records Digitization project
  • Modernization of hearing recording process
  • SharePoint
  • ATIPXpress
• Material privacy breaches
• Privacy impact assessments
• Public interest discloures
• Monitoring compliance
• Annex A: 2025 Delegation Order Access to Information Act and Privacy Act
• Annex B: Statistical reports on the Privacy Act
• Annex C: Supplemental statistical report on the Access to information Act and Privacy Act

On behalf of the Veterans Review and Appeal Board (VRAB, the Board), I am pleased to present the 2025-2026 annual report to Parliament on the administration of the Privacy Act.

This legislation enhances government transparency by allowing Canadian citizens to access information held by the Government of Canada. It promotes openness, accountability, and dialogue between citizens and their government.

The Board continues to strengthen privacy and access to information practices to ensure Canadians can exercise their right of access, receive high-quality information without delay, and have confidence that their personal information is protected.

The Board’s Access to information and Privacy (ATIP) unit advanced privacy and access to information practices in ways that matter to Canadians. Through improved governance, stronger collaboration, and modernized processes, the unit worked to protect personal information, support government transparency, and improve the efficiency and consistency of services provided to the public.

In the 2025-2026 fiscal year, the Board's ATIP unit processed 27,163 pages in response to ATIP requests and met its legislated timelines 98% of the time, ensuring Canadians received timely access to information.

I invite you to explore the report to learn more about our work and achievements

Sincerely,

Richard Thibault
Acting Chairperson

The Privacy Act protects the privacy of individuals with respect to personal information held by a government institution and provides individuals with a right of access to that information.

This Act also protects against unauthorized disclosure of that personal information. In addition, it strictly controls how the government will collect, use, disclose and dispose of any personal information.

Section 72 of the Privacy Act requires that the head of every government institution prepare an annual report on the administration of the Privacy Act for submission to Parliament each fiscal year.

The Board has full and exclusive jurisdiction to hear, determine and deal with all applications for review and appeal that may be made to the Board under the Pension Act, the Veterans Well-being Act - Part 3, the War Veterans Allowance Act and other Acts of Parliament. All matters related to appeals under this legislation are authorized under the Veterans Review and Appeal Board Act.

The Board also adjudicates applications for review and appeal of service-related disability benefits decisions under the authority of the Royal Canadian Mounted Police Pension Continuation Act and the Royal Canadian Mounted Police Superannuation Act.

The Board follows the open court principle. This means that hearings and decisions are open to the public.

The Board's decisions are published on the Canadian Legal Information Institute (CanLII) website. CanLII is a well-known legal resource that organizes decisions by year and is searchable by key word.

To balance openness in decision-making while maintaining an applicants’ privacy, the Board removes personal information that is not relevant to the reasons for the decision. This includes the name of the applicant and non-expert witnesses, as well as other information that could identify the individual (e.g. file numbers or home address). A published decision may contain personal information that is relevant to the decision, such as:

• the relationship between the applicant and a family member or witness at the hearing;
• medical conditions;
• occupational information;
• personal characteristics that are relevant to the disability application; and
• excerpts of medical opinions and doctors’ reports.

This approach is consistent with the principles found in the "Use of Personal Information in Judgments and Recommended Protocol" approved by the Canadian Judicial Council.

The Board has full responsibility for the administration of the Access to Information Act and the Privacy Act. The ATIP unit is under the Director, Strategic and Corporate Services, who acts on behalf of the Chair of the Board to oversee the administration of the Access to Information Act and the Privacy Act.

Responsibilities of the ATIP unit :

• Process requests for information submitted under the Access to information Act and the Privacy Act in accordance with the legislation, regulations, and Treasury Board of Canada Secretariat (TBS) policies, guidelines and directives.
• Provide Board managers and staff with advice and guidance regarding the interpretation and application of the Access to information Act and the Privacy Act and related TBS policies, guidelines and directives.
• Develop policies, procedures, and guidelines for the administration of the Act and related TBS policies, guidelines, and directives.
• Coordinate the resolution of any complaints against the Board made to the Information Commissioner under the Access to Information Act and the Privacy Act.
•  Respond to consultations from other government institutions on access and privacy requests. 
• Promote awareness to ensure employees understand their roles and responsibilities and the Board fulfills its obligations under the Acts.
• Respond to Parliamentary Written Questions on access to information and privacy breaches.
• Support the Board’s commitment to openness and transparency through proactive disclosures, informal releases of information and publishing the summaries of completed access to information requests to the Open Government portal.
• Review contracts with third parties using TBS guidance documents.
• Update the Board’s Information regarding Info Source chapter on the Board’s website in accordance with the TBS directive.
• Monitor and report on the Board’s proactive disclosures.
• Prepare the annual reports to Parliament and the Annual Statistical Report on the administration of the Access to Information Act and the Privacy Act.

In September 2025, the Chairperson of the Veterans Review and Appeal Board delegated his authority for the purposes of the Act. Annex A is a copy of the signed delegation instrument that took effect September 1, 2025.

In the 2025-2026 fiscal year, the Board’s performance in responding to requests for personal information under the Privacy Act has been marked by notable efficiency and transparency. The number of privacy requests received increased from the previous year.

Formal privacy requests

In fiscal year 2025-2026, the Board processed 98% of personal information requests within the legislated timeline, reflecting the Board's commitment to timely service

Of the 41 requests received, 39 were completed within 30 days, including 31 that were responded to within the first 15 days. Only two requests required more than 30 days to process, underscoring the Board's strong performance in providing timely access to personal information.

Most requests resulted in full disclosure, with 21 records released without the need for exemptions. Three requests were disclosed in part through the application of Section 26 of the Privacy Act, while one request was abandoned by the requester.

In total, there were 14,639 pages processed and 10,695 pages disclosed under the Privacy Act. When the reporting period concluded, there were no outstanding privacy requests to carry forward into 2026-2027.

Informal privacy requests

An informal privacy request is a request for personal information made through informal channels that does not invoke the Privacy Act. This type of request allows individuals to access their personal information more easily and quickly, without the need for a formal process.

In 2025-2026, the Board’s ATIP unit processed 18 informal privacy requests.

In the 2025-2026 fiscal year, the Board handled a total of 18 informal privacy requests, all of which were responded to within 0 to 15 days. This distribution is reflective of the Board’s dedication to maintaining high standards of service.

A total of 458 pages related to these informal privacy requests were processed and released.

A complaint under the Privacy Act is a formal grievance lodged by an individual who believes that a federal institution has mishandled their personal information. This can include unauthorized disclosure, improper collection, or failure to provide access to personal records.

The Board received one complaint during fiscal year 2025-2026, which was resolved through the Office of the Privacy Commissioner’s early resolution process.

Under the Privacy Act, extensions are permissible in certain circumstances to allow institutions more time to respond to requests for personal information. These extensions ensure that institutions can provide thorough and accurate responses while maintaining operational efficiency.

In fiscal year 2025-2026, two time extensions were taken: one to facilitate internal consultations and the other to allow for document translation.

Consultations can be necessary when responding to formal privacy requests under the Privacy Act to ensure that the information provided is accurate, complete and compliant with legal and regulatory requirements. These consultations help maintain the integrity and reliability of the information provided, ensuring that the institution meets its obligations under the Privacy Act.

In 2025-2026, there were no consultations received from other Government of Canada institutions and other organizations.

In 2025-2026, the Board’s ATIP and the Information Management (IM) units worked together to strengthen ATIP training for Board staff and Members.

Onboarding of new staff

As part of the onboarding process, many of our new employees and students at the Board participated in a newly developed ATIP training session. The session provided a comprehensive overview of personal information and information of business value, while reinforcing the important role employees play in information management and compliance with legislative requirements. It also highlighted best practices for handling information of business value and outlined measures to help prevent privacy breaches.

During the 2025-2026 fiscal year, the Information Management unit facilitated targeted small-group sessions with Board employees on information management processes and the transition to SharePoint. Approximately 35 employees (representing 100% of new staff) received role-specific training tailored to their business activities and information-handling needs. Broader organization-wide training was also delivered to provide employees with general guidance on using SharePoint, managing documents and applying consistent information management practices.

These sessions supported the ATIP program by promoting consistent recordkeeping practices, improving the organization and retrieval of information, and helping employees store sensitive information in appropriate locations with suitable access controls.

The training that was provided to students working on the hearing recording digitization project covered proper handling and transportation of client records, disposition protocols of physical media once digitized, and the handling of client information in electronic client systems. Once completed, these students transitioned to the Physical Records Digitization Project. This Project converts paper records (both corporate and client records) into secure electronic formats to improve accessibility, preservation and retrieval. It also reduces reliance on physical storage and supports more efficient searches for records responsive to ATIP requests.

Privacy awareness and support

In 2025-2026, the Board's ATIP unit supported staff and program areas on a range of privacy matters. Activities included providing advice on privacy obligations and best practices, assisting with the management and assessment of privacy incidents, supporting the completion and review of Privacy Event Forms, responding to privacy-related enquiries, identifying and mitigating privacy risks, and promoting awareness of privacy requirements in day-to-day operations.

Privacy breach management and prevention

In 2025-2026, the Board’s ATIP unit provided support to employees and program areas on a wide range of privacy-related matters. Activities included providing advice on privacy obligations and best practices, assisting with the management and assessment of privacy incidents, supporting the completion and review of privacy incident reports, responding to privacy-related inquiries, identifying and mitigating privacy risks and promoting awareness of privacy requirements as part of day-to-day operations.

Policies, guidelines, and procedures

The Board’s ATIP unit continued to support managers by providing ongoing advice and guidance on policies, guidelines and procedures. This consistent support helped managers implement and follow established protocols, reinforcing a culture of compliance and informed decision-making.

In today’s digital age, access to information is essential. The Board is working on key projects that use innovation to protect and manage information, improve access to justice, boost productivity, and foster an inclusive culture that empowers staff to support all Veterans.

We strive to be open and transparent as an organization so that Veterans and Canadians can hold the Board accountable for its actions and decisions.

Digitization of hearing recordings

The digitization of hearing recordings allows for enhanced access to historical hearing recordings. It ensures the preservation of the information and streamlines the record retrieval process by reducing the time and effort needed to access recordings.

The digitization of hearing recordings on cassette tapes began in March 2023 with over 115,700 cassettes that needed to be digitized.

From April 1, 2025, to March 31, 2026, 25 students that were hired through the Federal Student Work Experience Program (FSWEP) worked on the cassette digitization project. During that time, their team processed over 74,200 cassettes on top of the more than 47,100 cassettes processed the year prior. This resulted in nearly 121,400 cassettes digitized at the completion of the project.

Following the cassette project, some of these students transitioned to work on the Physical Records Digitization project.

Physical Records Digitization project

The Board began uploading historical client files and physical records through Digital Imaging into client files within the Client Service Delivery Network (CSDN). This work creates a more accessible, centralized and defensible source of client information.

The initiative supports the ATIP program by improving the completeness and reliability of client records, reducing reliance on physical files, and enabling more efficient searches and retrieval of information responsive to requests

Modernization of hearing recording process

During the 2025-2026 fiscal year, the Board completed the transition from legacy handheld recording devices to a digital-first MS Teams recording process. The new approach improves storage security, accessibility and retrieval of hearing recordings. It also reduces the risk of data loss or unauthorized disclosure, and supports more timely responses to ATIP requests.

In addition, the Board is exploring further enhancements, including automated transcription, to improve searchability, accessibility and operational efficiency.

SharePoint

The Board continued preparations to transition information from shared network drives to SharePoint. This work included reviewing information holdings, identifying access requirements and assessing the sensitivity of records before migration.

The transition also required the Board to revamp its retention and disposition schedule to reflect the significant differences between the two information environments. The updated schedule will support more consistent classification, retention and timely disposition of records.

Together, these initiatives support the ATIP program by improving the organization, accessibility and lifecycle management of information, facilitating searches for responsive records, and helping ensure that personal and sensitive information is appropriately protected.

ATIPXpress

During the reporting period, VRAB began implementing ATIPXpress, a modern Request Processing Software Solution designed to improve the management of access to information and privacy requests. The first phase of implementation at the Board included system setup, customization, internal testing, and hands-on training for the ATIP team. Once fully operational, ATIPXpress will streamline processes by automating many manual tasks and enhancing access to released records.

The implementation is nearly complete, with a full launch anticipated in the next reporting cycle.

A material privacy breach happens when an institution loses or improperly shares personal information, or when unauthorized access occurs. A breach can lead to serious harm to the affected individual(s), including physical or mental injury, social harm, damage to reputation, and/or financial loss.

The Board reported four material breaches in 2025-2026.

A privacy impact assessment (PIA) is a process used to identify and address privacy risks in projects or systems that handle personal data. It helps ensure that personal information is collected, stored and used in a way that respects privacy laws and protects individuals’ privacy rights.

No PIAs were conducted by the Board in 2025-2026.

Section 8(2)(m) of the Privacy Act grants the head of an institution the discretion to disclose personal information if it is deemed to be in the public interest.

No information was disclosed under this provision in 2025-2026.

The Board's ATIP unit actively monitors and manages access to information and privacy requests throughout their lifecycle to support timely processing and compliance with legislative requirements. Ongoing oversight of workload, deadlines and case progress helps ensure requests are administered efficiently and effectively.

To support effective oversight and decision-making, the ATIP unit prepares monthly reports for senior management and the Office of the Chair. One report provides a snapshot of current operational activities, including requests received, pages processed and pages released during the fiscal year to date. A second report presents workload and performance trends over a five-year period, enabling analysis of changes in request volumes, complexity and processing demands.

The reports also highlight emerging issues, risks, and operational pressures, such as shifts in workload, competing priorities, or resource considerations. This reporting framework supports informed decision-making, facilitates proactive workload management, and helps ensure the ATIP program remains responsive to evolving organizational needs.

The Chair of the Veterans Review and Appeal Board, pursuant to Section 73 of the Access to Information Act and Section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Chair as the head of the Veterans Review and Appeal Board, under the provisions of the Act and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.

Signed in Charlottetown, this first day of September, 2025.

Christopher J. McNeil

Chairperson, Veterans Review and Appeal Board

TBS/SCT 350-63

Name of institution:
Veterans Review and Appeal Board

Reporting period
From:2025/04/01

To: 2026/03/31

Name of institution:
Veterans Review and Appeal Board

Reporting period
From: 2025-04-01

To: 2026-03-31