Afghanistan veteran takes government, Royal Canadian Legion to court over privacy breach

The first legion branch in Canada, located on the 1800 block of Cornwall St., is shown in Regina, Sask. on Thursday, Jan. 3, 2013. (Roy Antal / THE CANADIAN PRESS)

A Saskatchewan veteran is taking the federal government and the Royal Canadian Legion (RCL) to court over an alleged privacy breach.

Internal Veterans Affairs Canada emails shared with CTV News outline a months-long investigation into breaches of the personal medical and other information of up to six veterans by one service officer at the Regina branch of the Legion.

The information comes from a Saskatchewan veteran who was one of two notified their information was accessed inappropriately.

On May 31, he filed a statement of claim against the ministry and several members of the Royal Canadian Legion – Saskatchewan Command, seeking damages in excess of $500,000.

The veteran, who is referred to only as C.D. in the lawsuit, told CTV News he was shocked when he discovered the granular level of personal information the Legion has access to.

“It’s disturbing. They can literally read all of our medical documents … our psychologists questionnaires that get submitted to VAC in order for us to get pension for PTSD, and usually in those conversations a lot of very sensitive stuff comes up.”

The ministry has an agreement with the Legion allowing service officers at the Legion to access personnel, financial and medical records in a federal government database in order to help veterans apply for benefits. As part of the agreement, they are required to have signed permission to represent a veteran before accessing files.

The emails, obtained through a series of access to information requests by one of the veterans involved, describe what one VAC staff member calls “a lot of carelessness when accessing files” on the database.

Two Regina veterans were sent letters saying their private information was accessed “where there was no work-related requirement to do so.”

“There was no need-to-know,” one of the ministry’s privacy analysts said in an internal email.

“We have discussed this in the past about how the RCL services officers seem to be overreaching … for their scope of work for VAC clients,” a staffer writes in an email from Sept. 2022.

In a statement to CTV News, a VAC spokesperson said on Friday it wasn’t at liberty to confirm details of the privacy breach, as “to do so would constitute a privacy breach in and of itself.”

The director of the Saskatchewan Command of the Royal Canadian Legion confirmed he was aware of only one privacy breach at the Regina branch.

“We are aware of one incident that we’ve actually received direct information from Veterans Affairs,” said Chad Wagner.

He said he was unable to comment on the incident as it was before the courts, but he said Legion staff are security cleared through Veterans Affairs, and they can only view files that veterans give signed permission for them to access.

Veterans can pull their consent at any time, said Wagner.

Wagner is one of four Legion employees named in the current civil suit.

Similar incidents came to light in 2016, with the Royal Canadian Legion admitting there had been “unauthorized access” of the client database by its staff.

In a Dec. 2016 news release, the Legion said “corrective actions were immediately taken” when it learned of the breaches, and there were no “founded” complaints since then.

In the 2022 investigation into privacy breaches at the Regina Legion, VAC questioned the Legion’s Veterans Services Director Carolyn Hughes about why the Regina staff member needed to access certain files, she said in many cases he “could not recall why he would have accessed them in the past.”

Hughes also said previous staff at that Legion branch weren’t tracking their access at all.

“Unfortunately for the first several months he was working there, and also the previous officers, were not keeping any form of tracking whatsoever.”

A security officer at Veterans Affairs noted the Regina staff member also included minimal detail when filling out the online forms required for access.

As a result of the investigation, the emails show VAC told Hughes Legion service workers would now be required to include detailed reasons for every document they pull.

In the course of the investigation, Hughes also emailed the ministry trying to get the names of the whistle-blowers who triggered the investigation.

“How do we find out who put the complaint in? There are a few outspoken people in Regina who are bad-mouthing Sask. Command for personal reasons and the command suspects it may be the same person/people,” Hughes wrote.

Veterans Affairs told Hughes that they don’t provide names of complainants as that would also be a breach of privacy.

Hughes is also a named defendant in the civil suit.

‘THEY TEACH US TO FIGHT FOR OTHERS NOT TO FIGHT FOR OURSELVES’

Retired Captain Sean Bruyea knows what it’s like to be the subject of a privacy breach.

He discovered what he calls "a smear campaign" where his private medical and financial information was shared among hundreds of bureaucrats, many of whom had no valid reason to have access.

He says they tried to use his information to discredit him.

“[They said] ‘hey, he’s criticizing our program. By the way, here’s all his private information, and let’s distort it, make it sound like he’s a bit cuckoo, and we’ll discredit him on the personal side,’” said Bruyea.

He took the case to Ottawa-based human rights lawyer Paul Champ in 2010. Less than two months after he went public about the incident, Bruyea says they "fast-tracked" a settlement.

In October 2010, the federal government publicly apologized to Bruyea for the incident.

Bruyea says veterans are particularly vulnerable because they have a hard time asking for help.

“Bureaucrats just can’t seem to bend their mind around to understand just how much help veterans need to prepare these applications, and although it’s nice the Legion does it, they seem to be playing pretty fast and loose with, you know, controlling or regulating access to these private databases,” he said.

“You’re giving a federally regulated collection of private information for people that have made supreme sacrifices in many cases … and there’s no control over these third parties that access this information and I just don’t get it.”