The Conflict of Interest Program
Description
The Health Canada (HC) and Public Health Agency of Canada's (PHAC) Values and Ethics Code requires all employees to report and resolve any situations that could lead to a real, apparent, or potential conflict of interest.
A conflict of interest occurs when a public servant's private interests could improperly influence their official duties or when they use their position for personal gain. The Conflict of Interest (COI) Office, managed by Labour Relations (LR) Division, helps employees understand their COI obligations. The program identifies and manages conflicts between personal interests and official duties and provides mitigation measures when possible.
Why a privacy impact assessment was completed
A PIA was conducted on the COI Program in accordance with Appendix C.2.2.9 of the Treasury Board of Canada Secretariat (TBS) Directive on Privacy Practices:
- Prior to undertaking a new program or activity that will involves the creation, collection, use, disclosure, retention or disposal of personal information for an administrative purpose.
Additional information
This PIA assessed the personal information collected, used, retained, disclosed, and disposed of by the COI Program. The assessment identified key areas where privacy measures could be strengthened:
- Privacy Notice and Transparency:
- The current privacy notice does not specify the legal authority under the Financial Administration Act for collecting personal information, limiting transparency. Employees may also be unaware that their declarations are automatically shared with their managers, and managers may not know their personal information is being collected, as they are not provided with a privacy notice. These gaps reduce individuals' ability to make informed decisions about their information.
- Collection and Minimization:
- When consulting with an employee's manager, there is a risk of overcollection, as managers may share opinions or details that are not necessary to assess a conflict of interest. This increases the likelihood of collecting irrelevant personal information.
- Access Controls and Safeguards:
- There are no formal processes in place to ensure personal information is only accessed by those with a need to know. This creates a risk of unauthorized access. Additionally, without routine quality checks, safeguards may fail over time without being detected.
- Security and Oversight:
- A Threat and Risk Assessment (TRA) has not been completed for Power Automate, which hosts the online declaration form. Without this assessment, there is a risk that personal information may not be adequately protected from security vulnerabilities.
Related personal information banks
Info Source describes how HC manages your personal information. Refer to the personal information bank PSE 915 - Values and Ethics Codes for the Public Sector and Organizational code(s) of Conduct.
For more information about this privacy impact assessment
For more information about this PIA, contact HC by email at: coi.inquiries-demandes.ci@hc-sc.gc.ca