Sample privacy impact assessment: payroll and HR software hosted in Ontario

Example Machining, a manufacturer with 80 employees, is replacing the payroll software installed on an office computer with a cloud payroll and human resources platform supplied by a Canadian vendor. The project falls under the acquisition or development of an information system. Example Machining is undertaking it to run payroll and produce tax slips, to keep employee files, and to manage absences and performance reviews. The information will not be used for any purpose other than these.

This assessment covers the personal information about Example Machining staff that the platform will hold. That information includes identification details, financial details, health information and employment information. The assessment concerns fewer than 100 people. Because of the health, financial and identification information involved, the sensitivity of the information is considered high. The assessment is limited to the platform and the purposes described here. It does not address any other system or use of this information.

The personal information concerns the employees of Example Machining. It includes each employee's social insurance number, date of birth and address, as well as salary, deductions and banking details. It also covers reasons for absence with the related medical notes, and performance reviews. This information is entered into the cloud platform, where the vendor hosts and processes the payroll and human resources files. The vendor's servers are located in Ontario, so the information is processed in Canada but outside Québec. Example Machining has signed the vendor's standard contract, which serves as the written agreement with the vendor.

Within Example Machining, access to the information on the platform is limited to the staff who need it for their duties. No decision about employees is made exclusively by automated processing. The platform returns pay stubs, which employees view from their phones, and produces tax slips. Employees have not yet been informed of how their information is handled on the new platform.

No retention period has been defined for the information, and this remains to be confirmed. In particular, how long the vendor keeps the files of former employees has not been discussed with the vendor and remains to be confirmed.

The assessment produced two findings. First, no retention period has been defined for the information held on the platform. Second, the employees concerned have not been informed of how their information is handled. It also identified three risks, each of high severity given the sensitivity of the information. The most likely is that information is kept longer than necessary, which is rated as a medium likelihood. The other two are processing outside Québec without adequate protection and unauthorised access to the information, both rated as a low likelihood.

Some points remain to be confirmed. These include the retention period for the information and, in particular, how long the vendor keeps the files of former employees, which has not yet been discussed with the vendor. Example Machining adopts the five measures set out in this document to address the findings and risks identified.