Building trust and understanding: Privacy notices and usability testing

Improving government services in the digital age means providing public services that are simple to use and trustworthy. The Government of Canada Digital Standards highlight that services should be built to address the needs of users, not the internal constraints or complexities of government. Designing and developing with user feedback results in services that are more accessible, secure, and easy to use.

Usability testing is critical to better digital services, but sometimes it’s tricky to figure out where to start.

Start with trust: Creating privacy and consent notices for usability testing

An important part of any plan to conduct research with the people who will be using your service is a privacy and consent notice. Easy to read privacy notices help people understand how their information is used, what their legal rights are, and who to contact with concerns.

Building trust with research participants builds public trust in the services you’re working on. Our colleagues, Hillary Lorimer and Janice LaGiorgia, wrote about the importance of privacy notices in usability testing, noting:

“As government employees, we need to take extra care to empower participants by providing them with information about who we are, why we’re doing research, how their data will be used, and their right to withdraw at any time during the process. This is one way we manage real and perceived power imbalances between ourselves as public servants and participants, so that their decision to take part in usability testing is not unduly influenced.”

While working with Veterans Affairs Canada (VAC) on the Find benefits and services tool, the team tested 9 product iterations with more than 100 participants across several locations in just 9 months. The team wrote a lot of new privacy notices in a short time. This process, and all the back and forth with our Access to Information and Privacy (ATIP) colleagues, clearly demonstrated the need for a simpler way to create these notices. An early solution to this problem was to include a policy analyst with every product team, to help with drafting privacy notices and ensuring compliance. Even with the power of multidisciplinary teams, there was still a lot of back and forth with ATIP, and repetitive approvals on very similar notices.

After working with the Treasury Board of Canada Secretariat (TBS)’s ATIP team, our policy analysts identified some basic patterns and components for privacy and consent notices. In 2021, we used these patterns to build and launch an internal tool to help create templates for notices for usability testing. This tool could be used to quickly generate notices that were consistent, met privacy standards, and needed fewer exchanges before being approved.

A solution for teams across government

Two years after launching the tool, we’ve made some updates to make it easier for teams across government to use, and to improve security and functionality. Previously, the language in the form was focused on teams at TBS. The updated tool has been expanded, in collaboration with policy advisors and content designers, to be more helpful for other federal departments and agencies. The tool can help teams get started on creating privacy and consent notices for usability testing. As always, all privacy notices need to be reviewed by your department’s ATIP team prior to use.

We’ve written before about how reducing the length and complexity of privacy notices can increase trust in a service, and we applied these same principles in our review of this tool. We made the language easier to read and understand, helping both the teams creating notices, and importantly the people who will read and respond to them.

Some ways we made the content easier to read and understand:

Removing passive voice and simplifying sentence structure
Before: “If a correction has been made to your personal information, we will ensure that any institution we’ve shared it with corrects their records as well.”

After: “If you make corrections, then we’ll correct this information in the research records for X and Y.”
Making the content flow more intuitive for readers
In previous versions of the template, everything a participant was consenting to was included in different sections throughout the notice. We made a change to summarize everything at the end of the notice, to improve clarity and ensure participants understood exactly what they are signing.
Eg:
By signing, you confirm that:

You’ve read and understood this page and agree to participate.
You’re not a former federal public servant who received a pension or lump sum payment from the Government of Canada.
You’re not a federal public servant participating during working hours.

Increasing security and reliability

The online tool was originally created to answer a need identified by CDS product teams, but it was launched quickly without a lot of forward planning for maintenance and ownership. The tool, initially hosted on the Heroku cloud platform, was moved to Amazon Web Services (AWS). This move ensures greater reliability and consistency with other CDS products. From a maintenance perspective, this makes it easier for our teams to monitor and mitigate any issues as they arise, rather than having to conduct checks across multiple platforms. The tool was built in small components, which made this ‘lift and shift’ exercise much faster and simpler.

These updates by our Site Reliability and Engineering (SRE) team, have made the tool more secure and easier to maintain. Site reliability engineering, an approach to tackling operations and infrastructure problems using software engineering methodology, allows the team to iterate and improve frequently. The SRE team continues to monitor the tools’ use and reliability, and will make adjustments and updates when needed.

Working together to deliver better services

Now that the privacy notice generator has been updated, we encourage teams across the GC to try it out! If your team has used it to help prepare for usability testing, reach out and share your story and any feedback on the tool. Together, we can improve how we design and deliver services across government.