A city's HRIS vendor asks to train its machine-learning models on municipal employee records, saying the product will improve for every customer. The CHRO is aligning HR data practices to the city's data-protection strategy. What should the CHRO do first?
Select an answer to reveal the explanation.
Short Explanation
Handing the city payroll file to a vendor's AI lab is like giving a contractor the master key just so they can practice on real locks. Hosting the HRIS does not mean the vendor gets a new purpose for the data. The city's data-protection strategy—and the contract—decide whether employee records can train someone else's model.
Full Explanation
SPHR-level HR aligns any new vendor processing of personnel data to the organization's data-protection strategy before that processing begins. Hosting an HRIS does not confer a right to train models on municipal employee records; model training is a distinct purpose that requires documented policy and contractual authorization. Deferring solely to IT or collecting informal survey opt-ins does not substitute for a strategy-and-contract decision. The CHRO should refuse or tightly condition the use until alignment is explicit.