Innovation, Science and Economic Development Canada fails to ensure that the information it used to staff a position was accurate

Complaint under the Privacy Act (the Act)

August 20, 2018

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) contravened the accuracy provisions of the Privacy Act (the Act) when it used inaccurate information about him when staffing a position.
ISED confirmed that it failed to ensure that the information it used to staff a position was accurate. The information in question was associated with the complainant’s profile on the MyGCHR human resources system (MyGCHR).
After reviewing the available evidence we determined that the complaint is well-founded. The reasons for this finding are outlined below.

MyGCHR is a human resources system based off PeopleSoft 9.1^{Footnote 1} software that automates human resources functions such as staffing, classification, scheduling, and leave. Public Services and Procurement Canada (PSPC) is responsible for implementing, hosting, and maintaining MyGCHR. PSPC also provides training to government departments that use MyGCHR.
At the time of the alleged incident, about 44 departments (including ISED) were using MyGCHR.
When a department using MyGCHR hires an individual, it checks to see if the individual has a profile on the system. If the individual has a profile then they are selected and their profile is associated with the position at the hiring department.

The complainant alleged that in January of 2017, ISED “hired” him rather than another individual with the same name. That is, according to MyGCHR, the complainant was associated with a position that ISED intended to staff. Because of the error the complainant was, according to MyGCHR, terminated from his position at PSPC and as a result missed some pay periods.

ISED acknowledged that inaccurate information was used by officials to staff a position. According to ISED, in January of 2017 Human Resources (HR) officials attempted to hire an individual with the same name as the complainant.^{Footnote 2} However, the complainant’s employee profile in MyGCHR was selected in place of the intended candidate. ISED confirmed that according to the MyGCHR system, the complainant was “hired” by ISED and “terminated” from his position at PSPC.
At the time of the incident, ISED HR officials had instructions to search MyGCHR using an individual’s first and last name. They had not been instructed to consistently use a third data field, such as a Personal Record Identifier (PRI) number or date of birth. In this case, only the first and last name data fields were used for the profile search.
In response to the error, ISED created a document to remind staff that they are required to validate the identity of individuals with multiple data fields, such as PRI or date of birth. However, MyGCHR still allows individuals to be selected using only first and last name (no other data fields are required).

In making our determination, we considered sections 3 and 6 of the Act.
Section 3 of the Act defines personal information as information about an identifiable individual that is recorded in any form including, without restricting the generality of the foregoing: information relating to race, national or ethnic origin, colour, religion, age, marital status, education, medical, criminal or employment history, financial transactions, identifying numbers, fingerprints, blood type, personal opinions, etc.
Subsection 6(2) of the Act states that institutions must take all reasonable steps to ensure that personal information that is used for an administrative purpose by the institution is as accurate, up-to-date and complete as possible.

Was the complainant’s personal information at issue?

The information at issue includes the complainant’s name, PRI, and financial information. This constitutes his personal information as defined by the Act.

Did ISED take all reasonable steps to ensure that the personal information it used to staff the position was as accurate as possible?

Our investigation determined ISED used inaccurate information about the complainant for a staffing process.
In our view, the error could have been avoided if HR officials had taken additional steps – such as checking the candidate’s PRI or date of birth – to validate his identity. Therefore, ISED did not take all reasonable steps to ensure that the personal information used to staff the position was as accurate as possible.

ISED submitted that it has since created a document to remind staff that they are required to validate the identity of employees with multiple data fields including PRI or date of birth. Given that ISED is not responsible for making changes to MyGCHR, we are satisfied that it has taken reasonable steps to ensure that the information it uses when selecting profiles from MyGCHR is as accurate as possible. Therefore, we have no further recommendations.