Privacy Impact Assessment (PIA) Summary for Staffing with VidCruiter

1. Name of program or activity:
   Staffing with VidCruiter

2. Institution responsible for delivering the program or activity:
   Department of Justice Canada

3. Government official responsible for the privacy impact assessment:
   Senior Director, Talent Acquisition and Development Division, Human Resources Branch

4. Head of institution/delegate:
   Director, Access to Information and Privacy Division

5. Description of Program Activity

   This report examines the privacy impacts associated with the collection, use, disclosure and retention of personal information by the Department of Justice (JUS) in the administration of the staffing process, particular to the use of a third party, hosted platform called VidCruiter.

   VidCruiter is a suite of online candidate assessment solutions, hosted in a third-party cloud environment, that facilitates scheduling, testing against merit criteria established by the hiring/delegated manager, providing a central repository of the information in a digital platform, enabling recorded video/audio and live interviews and the reference check process. As JUS intends to implement the various solutions suite offered by VidCruiter (excluding the onboarding feature), the PIA examined the potential privacy risks for each of the five solution offerings by the company.

6. Description of the class of record associated with the program or activity:
   Justice Recruitment and Staffing (JUS IS 100)

7. Personal information bank:
   Employee Personnel Record (PSU 901)
   Staffing (PSE 902)
   Application for Employment (PSU 911)
   Recruitment and Staffing Activities Using Virtual Staffing Tools (JUS PPU 020)

8. Legal authority for the program or activity:
   Public Service Employment Act
   Employment Equity Act
   Canadian Human Rights Act

9. Necessity for a Privacy Impact Assessment

   The VidCruiter suite of applications records personal information in order to assess candidates with virtual staffing tools. With users’ awareness, it captures an individual’s image/voice to facilitate the screening process, to be tested against the merit criteria, to participate in a video/audio recorded interview and for the reference check process all of which are part of the staffing process. These new collections of personal information are not covered by any standard personal information bank. The fact that the implementation of the platform is considered to be a substantial modification to program delivery has also necessitated the completion of a privacy impact assessment, in compliance with the Standard on Privacy Impact Assessment.

   This PIA focused on JUS’ processes and its handling of personal information to ensure compliance with the Privacy Act and associated Treasury Board privacy policies and directives. The PIA analysis of the risks reflects 10 universal privacy and fair information practice principles of the Canadian Standards Association’s Model Code for the Protection of Personal Information.

   The PIA recommended mitigation actions in the following risk areas:

   • Access
   • Collection
   • Use
   • Disclosure
   • Safeguards