Performance Discussion Process and Personal Learning Plans Automated Application Project Privacy Impact Assessment

EXECUTIVE SUMMARY

In the January 2004 Speech from the Throne, the Government of Canada called for the creation of a Public Health Agency of Canada (PHAC, hereinafter) to deliver on the Government of Canada's commitment to help protect the health and safety of all Canadians. Its activities focus on: preventing chronic diseases, including cancer and heart disease, preventing injuries, and responding to public health emergencies and infectious disease outbreaks.¹

PHAC consists of two branches, led by a Senior Assistant Deputy Minister Programs Branch and an Assistant Deputy Minister Emergency Management & Corporate Affairs. Each program is led by an Assistant Deputy Minister Infectious Disease and Prevention Control and an Associate Assistant Deputy Minister Health Promotion and Chronic Disease Prevention. Other PHAC executives report directly to the Chief Public Health Officer and the Associate Deputy Minister: the Chief Science Officer, the Chief Audit Executive, the Chief Financial Officer as well as the Strategic Policy and International Affairs Directorate and the Communications Directorate. To maintain the knowledge and skills needed to develop and deliver the public health advice and tools required by Canadians, the Agency relies on the efforts of its dedicated staff. PHAC’s approximately 2,400 employees work across Canada in a wide range of operational, scientific, technical and administrative positions. In a recent past, the Clerk of the Privy Council asked Deputy Heads to share the Public Service Renewal Action Plan with their employees, and report back to the Clerk on how they are engaging their employees in Renewal, and to commit to an action of importance to Renewal tailored specifically to their institution. Four public service-wide priority areas for renewal were set out to include: Planning, Recruitment, Employee Development and Enabling Infrastructure.

As a means to address the Public Service Renewal Action Plan, the Clerk of the Privy Council determined that there is a requirement to attain a 90% completion rate for the Performance Discussion Process (PDP) and Personal Learning Plans (PLP) of all employees to whom these processes apply. To facilitate compliance and reporting, it is essential that the process is made functional and as user friendly as possible. The PDP/PLP automated application project (formerly known as the Info Hub project) was initiated by PHAC in 2007, following detailed consultation and focus groups with PHAC staff. An automated application was proposed and created within the Lotus Notes environment.

A pilot project was initiated in May 2010 by the HR Administrators, to test the PHAC PDP/PLP Automated Application, and participants were asked to respond to a survey to provide HR Administrators with comments or recommendations on the application. The implementation of the PHAC PDP/PLP Automated Application is expected to be completed for official launch in fiscal year 2010-2011.

The proposed application will allow employees and managers to complete performance appraisals and personal learning plans within the database, review them as appropriate, and allow the production of reports on completion rates, as required.

The PDP/PLP automated application entails employees and managers to work collaboratively to support and record discussions and decisions pertaining to a variety of topics about growth and development of both the employee and the institution.

Therefore, the PLP/PDP provide a framework to facilitate the acquisition, use, retention of knowledge, skills and behaviours to assist the future operational requirements planning as well as to help PHAC meet individual aspirations of its employees.

The PDP/PLP automated application project collects personal information when PHAC managers initiate PDPs for PHAC employees under their immediate supervision. Further, personal information is also collected when a PHAC employee’s account profile contains the following information:

1. Employee identification;
2. Exceptions;
3. Assessment of Employee Performance;
4. Identification of Performance Objectives;
5. Identification of Performance Objectives for Supervisors and Managers;
6. Personal Learning Plans;
7. Approvals.

Employees and managers are responsible for completing the PDP/PLP in paper format annually.

Learning, training, leadership development and professional development are keys to ensuring that the public service is equipped to meet the challenges of the 21st century. The acquisition of skills and knowledge and the development of managerial and leadership know-how is critical for the effective management of the public service; it is the foundation of a responsive, accountable and innovative government. PHAC Learning, Diversity and Employee Programs Division (LDEPD) is committed to attaining the Agency-wide objective of a 90% completion rate by piloting and implementing the PHAC PDP/PLP Automated Application, developed through the Lotus Notes environment, for all of PHAC employees and managers.

A Privacy Impact Assessment (PIA) is then required to determine if there are any privacy risks associated with the implementation of the PDP/PLP automated application project and to determine any privacy concerns with shifting from a paper to an electronic platform.

The PIA describes the data flow of personal information collected, and the uses and disclosures throughout the process. It identifies privacy risks associated with the application and suggests strategies to mitigate any identified risks to an acceptable level. The recommendations are based on the description of PDP/PLP automated application business model described hereinafter. Throughout the PIA process, the pilot process and the proposed implementation of the electronic platform have been assessed, and recommendations are included as a mean to mitigate privacy risks prior to the implementation of PHAC PDP/PLP Automated Application.

Accordingly, we reviewed PHAC policies pertaining to security, network use, and protection of personal information in the workplace, procedures, guidelines, and forms, to determine compliance with federal privacy requirements (as well as retention and maintenance of paper records). We examined PHAC general management of personal information collected as part of the PDP/PLP process as specified in the statement of work. Although the pilot and the shifting to an electronic platform was the catalyst for launching the process, there was a global need to assess the overall program information management system.

---

¹ Before its creation, PHAC was a Branch within Health Canada (HC). HC is the federal department responsible for helping the people of Canada maintain and improve their health. HC is committed to improving the lives of all of Canada’s people and to making this country's population among the healthiest in the world as measured by longevity, lifestyle and effective use of the public health care system.