Introduction
The Talent Bank project’s goal is to compile a more comprehensive view of employee skills, learning interests and professional experiences with the view of understanding organizational strengths and weaknesses, and individual strengths and to provide opportunities to employees for professional development.
Objective
A privacy impact assessment for the Talent Bank project was conducted to determine if there were any privacy, confidentiality, or security issues with this initiative and, if so, to make recommendations for their resolution or mitigation.
Description
The Talent Bank aims to provide valuable information about Statistics Canada’s employees’ education, skills and learning interests. This information is required to make better decisions about how to manage programs and policies to meet business objectives and engage employees to perform at their highest level.
To respond to this, Statistics Canada launched the Talent Bank project. The Talent Bank project’s goal is to compile a more comprehensive view of employee skills, competencies, learning interests and professional experiences with the view of understanding organizational strengths and weaknesses, and individual strengths and opportunities for professional development. The results will contribute to a number of different human resource planning functions, such as identifying improved development, recruitment, and retention strategies, at the aggregate level, and identifying possible hiring opportunities related to employee-specific career aspirations.
In its current state, the Talent Bank has established a searchable inventory of information on employee education, skills and learning interests. Moving forward, the Talent Bank data entry form will collect all the same information, and will remain voluntary and transparent to the employee, but to better meet the needs of employees and managers, the new form will be linked with HR administrative data with employee consent, inputting administrative information without requiring the employee to do so manually. This will reduce the burden faced by the employee when completing the form.
Risk Area Identification and Categorization
The PIA identifies the level of potential risk (level 1 is the lowest level of potential risk and level 4 is the highest) associated with the following risk areas:
| a) Type of program or activity | Risk scale | |
|---|---|---|
| Administration of program or activity and services | 2 | |
| b) Type of personal information involved and context | ||
| Personal information, with no contextual sensitivities after the time of collection, provided by the individual with consent to also use personal information held by another source. | 2 | |
| c) Program or activity partners and private sector involvement | ||
| Within the institution (among one or more programs within the same institution) | 1 | |
| d) Duration of the program or activity | ||
| Long-term program or activity. | 3 | |
| e) Program population | ||
| The program's use of personal information for internal administrative purposes affects all employees. | 2 | |
| f) Personal information transmission | ||
| The personal information is used in a system that has connections to at least one other system. | 2 | |
| g) Technology and privacy | ||
| No issues identified | ||
| h) Potential risk that in the event of a privacy breach, there will be an impact on the individual or employee. | ||
| There is a very low risk of a breach of some of the personal information being disclosed without proper authorization. The impact on the individual would be low with the possibility of minor embarrassment. | ||
| i) Potential risk that in the event of a privacy breach, there will be an impact on the institution. | ||
| There is a very low risk of a breach of some of the personal information being disclosed without proper authorization. The impact on the institution would be moderate, resulting in loss of trust and a small impact on the reputation of Statistics Canada. | ||
Conclusion
This assessment of the Talent Bank project did not identify any privacy risks that cannot be managed using existing safeguards.