Unauthorized Access to Workforce Data

A subject accesses, views, searches, queries, or retrieves information relating to members of the organization’s workforce without a legitimate business purpose or authorization to do so. The subject may possess valid technical access to the relevant system or dataset but uses that access outside the requirements of their role, assigned duties, casework, management responsibilities, or other approved activity.

Workforce data may relate to employees, contractors, consultants, temporary workers, secondees, or other individuals working for or on behalf of the organization. This may include personnel records, payroll and compensation data, performance or disciplinary records, absence or medical information, internal communications, security records, investigation material, or other information relating to an identifiable member of the workforce.