A city's HRIS vendor asks to train its machine-learning models on municipal employee records, saying the product will improve for every customer. The CHRO is aligning HR data practices to the city's data-protection strategy. What should the CHRO do first?
Select an answer to reveal the explanation.
Short Explanation
Handing the city payroll file to a vendor's AI lab is like giving a contractor the master key just so they can practice on real locks. Hosting the HRIS does not mean the vendor gets a new purpose for the data. The city's data-protection strategy—and the contract—decide whether employee records can train someone else's model.
Full Explanation
SPHR-level HR aligns any new vendor processing of personnel data to the organization's data-protection strategy before that processing begins. Treating machine-learning model training on municipal employee records as a privacy-strategy decision—and withholding city data unless the contract and strategy expressly allow it—prevents purpose creep beyond HRIS hosting. Hosting does not equal a right to train models for every customer.
Approving because the vendor already hosts the HRIS confuses custody for operations with a new secondary use. Leaving the decision solely to IT later and keeping HR language out of the contract abandons CHRO accountability for personnel-data purposes. Asking employees to opt in through a pulse survey so training can start immediately is not a substitute for policy, contract, and often legal review of municipal data use.
Exam caveat: even anonymization claims need scrutiny; municipal HR data can be re-identifiable and may face charter or ordinance limits on secondary use. Operational check: require written strategy and contract clauses covering model training before any extract, log a refuse-or-condition decision, and brief the CIO and counsel on the outcome.