Human Resources’ Role in Data Privacy and Cybersecurity, Part II: Assessing Five Key Areas of Risk

Quick Hits

• Five critical areas HR may want to assess for potential risks related to data breaches include inadequate privacy frameworks, training for employees regarding their data privacy duties, data flowing out of the organization, internal data transfers, and key employee life cycle moments.
• Even organizations with established policies may struggle with their implementation and enforcement.
• Well-designed training programs, including refresher courses, can help clarify employees’ data privacy and security responsibilities.

1. Inadequate Privacy Framework

One significant risk for organizations is the lack of a comprehensive privacy framework for managing employee data. Alternatively, organizations with established policies may struggle with their implementation and enforcement. A clear framework is crucial for data management. Consider the policies regarding employee data access, storage, and the individuals permitted to access sensitive information. HR representatives often handle confidential data, so familiarity with the organization’s expectations is essential. If there is no policy in place, there is a risk that employees may not follow good guidelines, which can substantially increase the likelihood of an incident.

2. Employees Not Trained in Data Privacy Duties

The effectiveness of a privacy framework hinges on employees understanding their roles within it. When employees are unclear about their responsibilities, the organization becomes more susceptible to cyberthreats. Training programs that emphasize the importance of data privacy and security are vital. Such programs highlight employees’ duties to protect sensitive information and outline the risks of mishandling data. Regular refresher courses can help ensure that employees remain aware of evolving privacy practices and legal obligations, reducing the risk of human error during a data incident.

3. Data Flowing Out of the Organization

Understanding how employee data flows in and out of the organization is critical for risk assessment. Many HR functions rely on third-party software for payroll, scheduling, and other management tasks, often involving the sharing of sensitive data. HR personnel may want to consider the implications of using these tools, especially regarding biometric data, employee monitoring, and the use of artificial intelligence (AI) for recruitment or evaluations. Identifying potential risks and compliance obligations related to external data transfers can help mitigate liability in the event of a breach. Understanding where data flows in and out can also assist the organization’s privacy officer in determining what contracts are necessary to ensure that data is protected between organizations. The risk of data breaches rises sharply without solid safeguards in place, especially if third parties are careless with data.

4. Internal Data Transfers

Data flow within the organization also presents risks, particularly when transferring employee data across jurisdictional boundaries. An HR function in data security is remaining vigilant about compliance with local laws, as some regions impose strict data residency requirements. For example, transferring employee data from Québec to other Canadian provinces may necessitate explicit consent, contractual agreements, and risk assessments. Familiarity with jurisdiction-specific requirements can help prevent costly penalties and foster transparency, especially during a data breach. Additionally, understanding the security standards of the jurisdictions involved when data is transferred can help mitigate the risk of penalties in the event of a breach. A way HR can provide assistance to an organization’s data security is by considering the privacy compliance obligations of those jurisdictions as a factor for reducing overall risk for the organization.

5. Key Life Cycle Moments

Data security and privacy risk management include key moments in the employee and applicant life cycle, such as onboarding and offboarding. The onboarding process typically includes informing new hires about their privacy obligations and the security protocols in place. Providing training on data protection from the outset can significantly reduce risk. Similarly, during offboarding, HR can collaborate with IT and other relevant departments to ensure that departing employees return all company property and that access to sensitive systems is promptly revoked. Similarly, HR can involve IT early, by collaborating to ensure that any applicant data is appropriately stored and retained, and that access is limited to those on a need-to-know basis. Establishing a structured communication process between departments can mitigate risks associated with employee departures.

Conclusion

Navigating employee data privacy and risk management is a vital function of HR. By assessing these key areas—developing a solid framework, ensuring employee understanding, monitoring data flows, comprehending internal requirements, and addressing critical employee life cycle moments—HR professionals can better safeguard both employee data and the organization as a whole. Fostering a culture of privacy and accountability can help maintain employee trust and the integrity of the organization.

Ogletree Deakins’ Cybersecurity and Privacy Practice Group will publish additional articles on the Cybersecurity and Privacy blog as an ongoing part of this series. The next article in our series delves deeper into HR’s role during a data incident.

Follow and Subscribe

LinkedIn | Instagram | Webinars | Podcasts