By Office of the Privacy Commissioner of Canada
Privacy Act Bulletins are intended to offer lessons learned, best practices and other important privacy news, trends and information related to privacy protection in the federal public sector. We encourage you to share this information with colleagues.
The COVID-19 pandemic has increased interest within the federal public service in conducting job interviews and candidate assessments virtually. The OPC has provided advice to a number of federal public sector institutions on their use of virtual staffing platforms.
This bulletin highlights key privacy considerations when using third-party staffing platforms that provide human resources services. It is a follow-up to our February 2020 Bulletin on the privacy implications of video job interviews.
Privacy considerations when using virtual staffing platforms
Consider risks when outsourcing the collection and management of personal information
This includes examining third parties’ retention procedures to ensure that personal information is not kept for longer than necessary. See the Bulletin entitled: Consider privacy implications when outsourcing functions to a third party for more information.
Institutions should also limit the amount of personal information that third parties collect to reduce the risk of over-collection and breaches. Specifically, institutions should only collect supplemental documents when they need them to assess the applicant and should think carefully whether such documents need to be shared with a third party.
Provide training on managing personal information in a virtual hiring context
The institution’s ATIP team should instruct human resources officers, hiring managers and selection board members on how to protect individuals’ privacy when reviewing video interviews. For example, it would not be appropriate for a hiring manager to watch video interviews in public spaces or allow others outside their workplace to view videos. Institutions should also ensure that access to videos and other HR documents is limited to those with a need to know.
Ensure compliance with section 4 of the Privacy Act
Institutions can prevent the collection of unnecessary personal information when interviewing by instructing candidates to:
- conduct the interview in a neutral space, or employ background filters/blurring
- hide personal objects that may reveal sensitive personal information from view of the camera
- limit providing excessive personal information about others when responding to a question
- this is especially important in a video interview setting, as everything the candidate says is recorded, and therefore collected by the institution.
Consider how long the personal information should be retained
In contrast to an in-person or live video interview, a pre-recorded video interview may be accessed and used multiple times. Institutions should consider the privacy risks (for example, a breach) of retaining and using the videos over the long term. They should also consider how long-term retention may create a compliance risk with paragraph 6(2) of the Privacy Act, as personal information within a recorded video may become outdated and inaccurate.
Resources
- TBS Guidance Document: Taking Privacy into Account Before Making Contracting Decisions
- OPC Annual Report to Parliament 2019-2020
- OPC Annual Report to Parliament 2020-2021
