VidCruiter - Privacy impact assessment summary

Human Resources Branch
Employment Programs Directorate
Canada Revenue Agency

Overview & PIA Initiation

Government institution

Canada Revenue Agency

Government official responsible for the PIA

Dan Couture

Assistant Commissioner

Human Resources Branch 

Head of the government institution or Delegate for section 10 of the Privacy Act

Marie-Claude Juneau

Director

Access to Information and Privacy Directorate

Name of program or activity of the government institution

Human Resources Management

Description of the class of record and personal information bank

Standard or institution specific class of record:

Recruitment and Staffing PRN 920

Standard or institution specific personal information bank:

Staffing PSE 902

Legal authority for program or activity

Personal information is collected under section 54 of the Canada Revenue Agency Act.

Summary of the project / initiative / change

Overview of the program or activity

A staffing process is a series of activities and decisions taken by a manager or delegated to a staffing board (group of individuals identified by a manager to perform staffing activities on their behalf) to appoint a candidate to or retain a candidate in a position. A staffing process normally involves four stages: planning, screening for prerequisites, assessment, and appointment. Staffing requirements are the attributes of a position (or multiple positions) that are used to identify candidates for appointment and are linked to business requirements. Managers must respect the minimum staffing requirements for the position being staffed, which include education, language, performance level, and security status. Managers can identify other staffing requirements and decide whether they are essential (must be assessed) or asset (may be assessed). Examples of other staffing requirements include: experience, knowledge, or qualifications.

The assessment stage of a staffing process allows managers to evaluate candidates against the staffing requirements. To assess candidates against the staffing requirements, managers use assessment tools, such as CRA standardized assessment tools or locally developed tools (created by manager). These assessments may be administered in a variety of ways, such as in person (interview, written exam on paper/computer), online (written exam, reference check) or by telephone (interview, reference check).

What's new

Video-based assessment is becoming a mainstream part of recruitment in the private sector, with almost every major platform provider now offering tools for video interviewing. Managers and candidates alike are beginning to expect increased flexibility in staffing assessment, through the use of modern technology, which can also help to reduce the amount of time it takes to complete a staffing process and appoint candidates in positions. VidCruiter is a Canadian company that offers online video interviewing software, with both live (synchronous) and pre-recorded (asynchronous) options.

Canada Revenue Agency has engaged in a contract with VidCruiter in order to determine whether the Agency should adopt the use of this technology for staffing purposes. As the use of video interviewing relates to assessment in a staffing process, the Resourcing Tools, Training and Recourse (RTTR) section in the Employment Programs Directorate (EPD) of the Human Resources Branch (HRB) has been identified as the lead to examine the use of this technology at the Agency. The contract, signed September 13, 2018, terminates on September 11, 2019.

For the length of this contract, a select number of staffing boards will be permitted to use VidCruiter to conduct pre-recorded video interviews with candidates. This allows applicants to complete an interview by recording their responses to questions that have been pre-determined by the staffing board. This provides the candidate with the flexibility to record their interview at a time and location convenient to them and allows the staffing board to review and assess the video interview at a time and location convenient to them. The system is completely customizable with regard to: the number of questions that can be uploaded, the amount of preparation time given to candidates, the amount of time candidates have to respond to a question, the number of attempts permitted for each video recording, etc. Based on the results of the staffing processes conducted during this contract, RTTR will make recommendations to senior management as to whether the Agency should adopt the use of this technology for assessment purposes in staffing. 

Scope of the privacy impact assessment

This privacy impact assessment identifies and assesses privacy risks to personal information relating to asynchronous video interviewing in a staffing process. All staffing activities that normally occur pre or post interview in the staffing process are out of scope. 

Risk identification and categorization

A) Type of program or activity

Administration of Programs

Level of risk to privacy: 2

Details:

The personal information collected will be used by staffing board members in a staffing process to assess whether or not a candidate meets a staffing requirement (i.e. passes the interview).

B) Type of personal information involved and context

Social insurance number, medical, financial or other sensitive personal information and/or the context surrounding the personal information is sensitive. Personal information of minors or incompetent individuals or involving a representative acting on behalf of the individual.

Level of risk to privacy: 3

Details:

It is possible that candidates in a staffing process could use real life examples or scenarios in an interview response which may include personal information or sensitive details about themselves or others.

C) Program or activity partners and private sector involvement

Private sector organizations or international organizations or foreign governments 

Level of risk to privacy: 4

Details:

The video interviewing software to be used is provided by VidCruiter Inc., a Canadian corporation. VidCruiter hosts the online portal that will be used to conduct recorded video interviews. The company offers the ability for Canada Revenue Agency to create a personalized and branded landing page for candidates and provides the staffing board the ability to completely customize each aspect of the interview experience, including the questions that will be asked, the amount of preparation time the candidate will have and the length of time the candidate has to respond. Those candidates who reach the video interview assessment stage will be sent a personalized link to the VidCruiter website where they will be given an opportunity to practice recording to ensure their device is able to properly record their responses. Video responses to the interview questions are saved by VidCruiter and the data is stored in the Amazon Web Services (AWS) Network cloud, with servers located in Canada. AWS is approved by the federal government and is considered the most secure cloud data hosting solution in the world. The staffing board is then able to log into the VidCruiter website to view the video interviews and assign scores based on their predetermined scoring grid. VidCruiter’s bilingual and reliability security status cleared technical support staff are available to support the candidates and staffing board with any technical issues.

D) Duration of the program or activity:

Short-term program

Level of risk to privacy: 2

Details:

A select number of staffing processes will be conducted during the length of the contract to explore the online video interviewing services offered by VidCruiter and to determine if it would be an appropriate tool to adopt as an option for staffing boards to conduct assessment in a staffing process. The current contract with VidCruiter is valid until September 11, 2019.

E) Program population

The program affects certain employees for internal administrative purposes / The program affects certain individuals for external administrative purposes.

Level of risk to privacy: 3

Details:

A restricted number of staffing processes will be run using VidCruiter, including both employee and executive level positions at CRA. One or more processes will be posted externally, which means that applicants could include individuals from the general public, students, CRA employees and employees from other government departments or agencies.

Any personal information collected will be used for the administrative purposes of staffing (that is, determining whether or not a candidate meets a staffing requirement identified as necessary).

F) Technology & privacy

Does the new or modified program or activity involve the implementation of a new electronic system, software or application program including collaborative software (or groupware) that is implemented to support the program or activity in terms of the creation, collection or handling of personal information? 

Risk to privacy: Yes

Does the new or modified program or activity require any modifications to IT legacy systems and/or services?

Risk to privacy: No

The new or modified program or activity involves the implementation of one or more of the following technologies:

Enhanced identification methods - this includes biometric technology (i.e. facial recognition, gait analysis, iris scan, fingerprint analysis, voice print, radio frequency identification (RFID), etc...) as well as easy pass technology, new identification cards including magnetic stripe cards, "smart cards" (i.e. identification cards that are embedded with either an antenna or a contact pad that is connected to a microprocessor and a memory chip or only a memory chip with non-programmable logic).  

Risk to privacy: No

Details: N/A

Use of Surveillance - this includes surveillance technologies such as audio/video recording devices, thermal imaging, recognition devices , RFID, surreptitious surveillance / interception, computer aided monitoring including audit trails, satellite surveillance etc. 

Risk to privacy: No

Details: N/A

Use of automated personal information analysis, personal information matching and knowledge discovery techniques - for the purposes of the Directive on PIA, government institutions are to identify those activities that involve the use of automated technology to analyze, create, compare, identify or extract personal information elements. Such activities would include personal information matching, record linkage, personal information mining, personal information comparison, knowledge discovery, information filtering or analysis. Such activities involve some form of artificial intelligence and/or machine learning to uncover knowledge (intelligence), trends/patterns or to predict behavior.

Risk to privacy: Yes

Details:

The online video interviewing system provides the user (staffing board) with the ability to view and extract an automated aggregation of information either online or in an Excel spreadsheet which summarizes the information (related to scores for each question/candidate) entered by the board members.

Where there is a disparity between candidate scores, board members will have a discussion to review the responses and come to a consensus on the appropriate scores to allocate for each candidate.

VidCruiter provides the technology to compare the information input by board members and extract it into an Excel spreadsheet for ease of reference.

G) Personal information transmission

The personal information is used in a system that has connections to at least one other system./ The personal information is transferred to a portable device or is printed.

Level of risk to privacy: 3

Details:

Candidates use the internet to access the online video interviewing platform. The recorded videos are hosted by VidCruiter on a cloud network located in Canada. Staffing board members access the videos relevant to their staffing process through an online portal.

In a situation where a candidate requests a copy of their video recording, the staffing board is able to provide the individual with a link that would provide them online access to view their recording. Should they require a downloadable copy, CRA can request that VidCruiter enable a feature which would allow the Agency to download a copy of the applicable videos in a standard format (e.g. MP4), and then transmit them via email to the candidate. 

H) Risk impact to the individual or employee

Details:

If the personal information is compromised, it has the potential to impact the candidates in the following areas: Context, Financial Loss, Health and/or Reputation.

Given the security measures in place by VidCruiter and nature of the information contained in the interview videos, the probability of an impact occurrence is unlikely and the degree of harm (level of injury) is very low.