Summary of privacy impact assessment for staffing and e-recruitment

PIA for e-recruitment (PDF, 450 Kb)

1. Overview and Privacy Impact Assessment (PIA) Initiation

1.1. Overview of the Atlantic Canada Opportunities Agency

The Atlantic Canada Opportunities Agency (ACOA) supports Atlantic Canada’s economic growth, wealth creation and economic prosperity through inclusive clean growth and by building on competitive regional strengths. ACOA helps small and medium-sized enterprise (SME) growth through direct financial assistance and indirectly through business support organizations. SMEs become more innovative by adopting new technologies and processes and by pursuing new avenues for expansion and market diversification in order to compete and succeed in a global market.

ACOA is subject to the accountability regime set out in Part II of the Financial Administration Act (FAA) and is listed under Schedules IV and VI of the FAA.

1.2. Description of the Activity

As part of the Public Service Commission (PSC) "New Direction in Staffing" initiative, government departments have been given greater ability to customize approaches to staffing, including agile approaches, an increased focus on outcomes, and less focus on process. ACOA’s Human Resources directorate has been tasked with finding innovative ways to attract candidates from the public to the Agency and to speed up the collective staffing processes.

One of the innovations identified as an industry best practice is a suite of assessment applications hosted in a cloud environment by a third party. The current choice of third-party vendor, VidCruiter, is a Canadian software company based in New Brunswick. The online services provided by VidCruiter include software for video interviewing services, testing as well as automated referencing to assess qualifications.

Video/audio recordings (live or pre-recorded) may be used to evaluate candidates on qualifications and include a system for reviewing video, test and reference responses provided by candidates and rating the quality of those responses. While it is acknowledged that this necessitates the additional collection of personal information, automation of this process replaces a manual process where candidate information is provided electronically (or on paper) to each of the Assessment Committee Members and collated once their assessment is complete.

Privacy and information management are major concerns when video is used to collect personal information, as video systems act as a storage medium for personal information and can be used to transmit personal information. Because candidates provide Protected B information in their video interviews, the video files will be saved, shared and stored safely. Files will be transferred from the service provider to the storage medium on a Protected B bridge.

An initial PIA examining the potential privacy risks associated with this activity was completed in August 2018 and submitted to the Treasury Board Secretariat (TBS) of Canada and to the Office of the Privacy Commissioner of Canada (OPC). This revised version was prepared in response to the feedback received from both the TBS and OPC.

1.3. Government of Canada (GC) Policy Alignment

The Directive on Privacy Impact Assessment provides direction to federal government institutions on how to assess the privacy impacts of new or substantially modified programs or activities involving the creation, collection and handling of personal information. It also ensures that privacy implications will be appropriately identified, assessed and resolved before a new or substantially modified program or activity involving personal information is implemented.

GC Policy Hierarchy

• Privacy Act
  • Policy on Privacy Protection
    • Directive on Privacy Impact Assessments
    • Directive on Privacy Practices
    • Directive on Social Insurance Number

1.4. Description of the Related Class of Records (CoR)

Recruitment and Staffing – Includes records related to the recruitment and staffing of people to fill full-time or part-time positions within the institution. Records may include information related to screening, examining, testing, interviewing, assessing, selecting, hiring and promoting candidates for employment. It may also include information related to terms and conditions of employment (including conflict of interest), deployments, assignments and secondments, student, professional, and occupational recruitment, post-employment appeals, and area of selection, as well as information received from or shared with central agencies responsible for recruitment and staffing, other employment agencies, or both.

ACOA CoR Number: PRN 920

1.5. Description of the Related ACOA Specific Standard Personal Information Bank (PIB)

Staffing – This bank describes information about recruitment and staffing activities, which includes solicited and unsolicited applications for employment, position reclassifications, secondments, deployments, and other work assignments or arrangements within government institutions. Personal information may include name, contact information, assessment/test results, biographical information, citizenship status, date and place of birth, educational information, employee identification number, employment equity information, employee personnel information, financial information, official language proficiency, medical information, opinions and views of, or about, individuals, and signatures.

PIB Bank Number: ACOA PPU 112

1.6. Legal Authority for the Activity:

The collection of personal information for staffing at ACOA is authorized by the Public Service Employment Act, the Employment Equity Act, and the Canadian Human Rights Act (section 16).

2. Risk Area Identification and Categorization

2.1. Type of Activity

2.2. Type of Personal Information Involved and Context

Details: Biographical information such as work experience, education, competencies, skills, knowledge, capacities, personal suitability, assets, as well as personal contact information are provided by the candidate via the PSC online portal jobs.gc.ca, and/or via VidCruiter if applicable. In addition, personal information about the candidate may be obtained from their references.

2.3. Program or Activity Partners and Private-Sector Involvement

Details: The software suite that ACOA will use to expedite and enhance the selection process is hosted by VidCruiter, including hosting the personal information collected and used by ACOA. The Agency has entered into a contract to obtain service of the suite of applications and information storage. While the PSC will be the initial point of contact for the collection of information related to staffing, this PIA focuses on the new approaches facilitated by the VidCruiter software. The PSC is not a partner in the VidCruiter portion of the staffing process.

2.4. Duration of the Program or Activity

Details: ACOA intends to use virtual staffing tools and assessment techniques on an as-needed basis.

2.5. Program Population

Details: Individuals (federal employees and individuals outside the federal public sector) who apply for a position and agree to participate in the process using VidCruiter services will be affected.

2.6. Technology and Privacy

	Risk level
Does the new or modified program or activity involve the implementation of a new electronic system, software or application program, including collaborative software (or groupware) that is implemented to support the program or activity in terms of the creation, collection or handling of personal information?	YES NO
Does the new or modified program or activity require any modifications to IT legacy systems and/or services?	YES NO

Does the new or modified program or activity involve the implementation of one or more of the following technologies:

Details: The VidCruiter application suite will not have any direct linkages to ACOA information holdings but will need to be accessible from behind the ACOA firewalls.

2.7. Personal Information Transmission

Details: VidCruiter’s functionalities are offered via an online internet platform with data stored in a cloud environment located in Canada and hosted by VidCruiter. Hiring managers access only the relevant information to their own staffing process through the online portal. HR staffing, assessment committee members and hiring/delegated managers may access the software via protected corporate Wi-Fi or VPN and using ACOA-provided equipment. The COVID-19 crisis might strain the network resources, requiring that employees use VidCruiter outside the GC firewalls. Even though the departmental policy recommends accessing VidCruiter from behind the GC firewalls, employees are allowed to use it without the web VPN during these specific situations because the existing VidCruiter encryption ensures sufficient security. Candidates could access the software via any Wi-Fi connection and with any personal device that has the required capabilities (camera, application, etc.), but ACOA does not have any control over the security measures protecting those devices or Wi-Fi connections.

2.8. Privacy Breach Individual Impact

Details: In the event of a privacy breach involving routine non-sensitive personal information, the impact to the affected individual(s) may be considered minimal. However, the impact may increase depending on the sensitivity of the personal information, resulting in embarrassment for the individual. The Agency has developed procedures to address privacy breaches.

2.9. Privacy Breach Institutional Impact

Details: In the event of a privacy breach involving routine non-sensitive personal information, the impac to the institution may be considered minimal. However, the impact may increase depending on the sensitivity of the personal information, resulting in embarrassment for the individual. The Agency has developed procedures to address privacy breaches.

2.10. Risk Impact to the Agency

2.11. Risk Impact to the Individual or Employee