The central finding of the Amprax Inc. review flies in the face of the country's privacy watchdog, who concluded almost two years ago that two briefing notes sprinkled with the references to well-known critic Sean Bruyea's psychiatric reports broke the law.
The report was prepared for former veterans minister Jean-Pierre Blackburn at the insistence of bureaucrats who were the target of Privacy Commissioner Jennifer Stoddart's scathing critique of the case.
The review, which cost taxpayers $24,990, didn't find "any malice" or "fault" in the actions of bureaucrats and senior department officials.
"The Minister had the right to obtain the information provided in the two notes," said the review, part of a briefing package dated Dec. 21, 2010.
"The Minister also had a need for that information. The Minister had a need for that information at those very moments. It is debatable whether he needed all of it. Most people believe he did."
The records, requested by The Canadian Press 18 months ago, were released last week under access to information laws following a complaint to the country's information commissioner.
The internal investigation by Amprax also uncovered evidence that Bruyea's private data had been stitched into more than just two documents.
It found that "several briefing notes contained sensitive medical information concerning a complainant. As well, the notes contained significant detail about how the complainant interacted with the department."
It laid responsibility for the mishandling of the information at the doorstep of the deputy minister and the assistant deputy minister, but largely excused the actions as ignorance, rather than characterizing it as a deliberate smear campaign against Bruyea, who was a critic of the Conservative government's implementation of the New Veterans Charter.
"The question of malfeasance clearly do not apply in this case," the document said. "Everybody was trying to help the client. What can be reproached is a lack of sensitivity to privacy and a lack of adjustment of the policies and procedures."
It was noted some of the bureaucrats involved had retired, "but even if they were still in the system, it would not be a question of discipline. It would be a question of performance. Performance pay is the tool to deal with those situations, not discipline."
The Privacy Commissioner's Office acknowledged it was aware of the Amprax review, but declined to comment on its contents. Instead, spokesman Scott Hutchinson noted that the commissioner is conducting a comprehensive audit of Veterans Affairs.
Bruyea was shocked at the contents of the report and said it goes part of the way towards explaining why no one was fired over his case or subsequent breaches involving other critics.
He described it as a "white wash" meant to save reputations at the expense of his own.
"It shows contractors can be hired to find any conclusion the government wants and it's pretty clear it was a pre-ordained conclusion," he said. "What I was afraid of was that the only thing the government would learn was to how to hide and cover its tracks and that's exactly what happened."
Senior officials in the current minister's office would not speak about the contents of the report on-the-record, but claimed it played no role in the government's actions and it was the privacy commissioner's findings that influenced the subsequent tightening of rules.
The company that conducted the review is headed by Alain Jolicoueur, a former career civil servant who served as deputy minister of Indian and Northern Affairs and president of the Canada Border Services Agency.
The current deputy minister at veterans affairs also served in a senior position at Indian Affairs, but not at the same time as Jolicoueur.
Codi Taylor, a spokeswoman for minister Steven Blaney, said recently announced improvements "provides targeted training to employees to ensure that they are aware of their obligations to follow the law when it comes to protecting the private information of our veterans."
She reiterated that the government believes that "any privacy violation is totally unacceptable."
Questions about the handling private information at Veterans Affairs first arose in June 2006, according to the Amprax report.
"It should have triggered serious concerns at the department level about practises around the sharing of private information. There is no evidence that a review occurred at the level of the department to deal with those concerns."
Also on HuffPost