Privacy Impact Assessment Summary for the Public Service Performance Management Application (PSPM App)

Table of Contents

• Overview and Privacy Impact Assessment (PIA) Initiation
  • Government institution
• Summary of the project / initiative / change
• Description of the Class of Record and Personal Information Bank
  • Class of Record
  • Document Types
  • Related Personal Information Banks
• Legal Authority for Program or Activity
• Privacy Impact Assessment Findings: Summary of Risk and Mitigations
  • 1. Notice and consent is not sufficient:
  • 2. Necessity to collect personal information must be clear:
  • 3. A retention and disposal schedule for the data has not been established:
  • 4. Accounting for new uses in Info Source and the Personal Information Bank (PIB):
  • 5. Insufficient safeguards for the protection of privacy:
  • 6. Notice of contact:

Overview and Privacy Impact Assessment (PIA) Initiation

Summary of the project / initiative / change

OCHRO is the organization responsible for implementing the Directive on Performance Management in the core public administration of the Government of Canada. The project charter for the performance management project outlines the roles and responsibilities of OCHRO in implementing the directive:

Governance, Planning and Policy (GPP) sector, Office of the Chief Human Resources Officer (OCRHO), Treasury Board of Canada Secretariat (TBS) works across all human resources (HR) disciplines to strengthen people management in departments and agencies, while undertaking transformation initiatives to improve the functionality and efficiency of HR management and systems infrastructure. In the People Management Program Architecture, these two areas of activities are referred to as Direction Setting and Enabling Infrastructure.

The project charter also says the following:

Deputy heads are primarily responsible for people management in their organizations. GPP's role is to support deputy heads in fulfilling their people management responsibilities.

GPP has launched the Performance Management (PM) project to strengthen and standardize performance management across the Core Public Administration (CPA) for all employees below the level of Executives. For the EX group, a separate, but related performance management process exists that is standardized across the CPA and has been in operation since July 2007.^{Footnote 2}

A PIA was required in order to identify and assess any risks to privacy once users—both employees and managers/supervisors—begin to complete the new standardized performance agreement. They are obliged to provide personal information to the Treasury Board of Canada Secretariat (TBS) as a part of the evaluation and assessment of employee performance. The PIA is a means to identify the sensitivity of personal information and the effectiveness and efficiency of appropriate controls to protect against the possible risk of unauthorized or inadvertent disclosure, the possible corruption or modification of data, and the lack of availability of the data. The PIA also addresses compliance of the program or service of a federal department with existing legislation such as the Privacy Act and related regulations such as the Privacy Regulations, and the policies, standards, directives and guidelines of the Treasury Board and of TBS. The PIA must also follow the Policy on Privacy Protection, the Directive on Privacy Impact Assessment, the Directive on Privacy Practices, and other relevant documents in the policy framework.

The Directive on Performance Management came into force on April 1, 2014. In order to support all 88 departments and agencies across the core public administration in adhering to the directive, TBS developed an enterprise-wide solution. The PSPM App was designed to allow all employees and their managers to use a web form to complete their performance agreements and to capture discussions and ratings related to performance. The PSPM App requires public service employees to register in the TBS Applications Portal (TAP). First-time TAP users must complete mandatory field information such as their given name, surname, Personal Record Identifier (PRI), or Human Resources Management Information System (HRMIS) number for members of the RCMP, and provide their government email address. The email address is necessary so that the PSPM App can generate and send an email notification to employees indicating that their manager/supervisor has selected them as their employee and that they are required to confirm this selection. Login authentication of all users requires the use of myKEY from Internal Credential Management, Shared Services Canada.

The PSPM App is considered an interim step prior to the migration to PeopleSoft version 9.1 for human resources management across the Government of Canada. Managers may also be users of the PSPM App if they are subject to performance agreements themselves. Senior managers in the EX group are not subject to the Directive on Performance Management.^{Footnote 3}

Description of the Class of Record and Personal Information Bank

Legal Authority for Program or Activity

The PSPM App supports the consistent collection, secure storage and controlled access to and reporting on performance management data. It is managed and maintained by OCHRO, TBS.

The information provided in an individual's performance agreement is collected under the authority of subsection 11.1 of the Financial Administration Act for the purpose of supporting performance management of employees in the core public administration.

Use of this performance agreement fulfills the responsibility of departments' deputy heads to establish an employee performance management program, including annual written performance assessments for all employees as set out in the Directive on Performance Management, issued pursuant to section 7 and subsection 11.1 of the Financial Administration Act. All employees are required to be assessed in accordance with their terms and conditions of employment.

The information provided may be used or disclosed for the purposes of policy analysis, research, audit, evaluation, statistics, staffing and recruitment, talent management, and succession planning. Specifically, it may be used by federal departments and agencies (listed in Schedules I and IV of the Financial Administration Act) for staffing and recruitment purposes, talent management and succession planning, and by TBS for policy analysis, research and evaluation purposes.

Privacy Impact Assessment Findings: Summary of Risk and Mitigations

© Her Majesty the Queen in Right of Canada, represented by the President of the Treasury Board, [2015],
[ISBN: 978-0-660-25693-1]