HR Folder Exposure at Northbridge Bank
At Northbridge Bank, the HR shared-services team keeps employee leave and accommodation records in a departmental folder. 240 HR staff can access it; permissions were copied from a legacy group. A branch manager browsing for a team roster opened a folder and saw a coworker's cancer diagnosis and disability accommodation letter. The bank's privacy office learns that the folder also holds 6 years of workplace investigation files, some involving customers. Retention policy says investigation files are kept 7 years after closure; leave records 3 years. The bank operates in three states, one with a breach-notification statute and one with a medical-privacy law. The folder is on a network share with no logging. The HR director wants to 'delete everything older than a year' before an audit.
1. What immediate containment and assessment steps should the privacy office and records manager take?
Read the worked answer
First restrict the folder to a small incident team and preserve the current permissions, folder listing, and any available logs; the absence of logging is itself a finding. Interview the branch manager and HR staff to determine who accessed what, but avoid broadcasting the incident to all 240 users. Classify the data elements: medical diagnosis, accommodation letters, investigation files, and customer information. Engage counsel and the privacy officer to assess state breach-notification and medical-privacy obligations. Notification depends on jurisdiction, data type, and risk of harm, not on the branch manager's intent. Do not delete the folder. Document the timeline, access scope, and decisions. The HR director's instruction to delete everything older than a year must be refused in writing because it could destroy evidence, violate retention, and worsen notification obligations. Issue a preservation instruction immediately.
2. How should access to these records be redesigned?
Read the worked answer
The legacy group gave 240 people access, which fails least privilege. Redesign by role: leave administrators, HR business partners, and investigators should have differentiated access; medical accommodation files should sit in a separate restricted repository with named access and encryption. Implement logging and alerting, quarterly access reviews, and manager attestation. The branch manager's access was unnecessary for a roster task, which shows the danger of broad browse rights. Consider file-level encryption for sensitive categories and data-loss prevention. The goal is not zero access but documented business need, with break-glass access for urgent cases and review after use. Also separate customer investigation files from employee files if legal or privacy requirements differ. Access redesign should be tested before the audit, not after.
3. How should the records manager respond to the HR director's mass-deletion plan?
Read the worked answer
Do not mass-delete. Apply the schedule: leave records are kept 3 years, investigation files 7 years after closure, but first suspend disposition for any open litigation, complaint, or audit. Identify closed versus open investigations; customer-related files may trigger separate retention and notification duties. Destroy only eligible records using secure methods with certificates, and log what was destroyed and who approved. The privacy principle is minimization, but compliant minimization follows the schedule, not an arbitrary one-year cutoff. If an audit is imminent, issue a hold and preserve. Explain to the HR director that deleting records before an audit can be treated as obstruction and can destroy evidence needed for breach assessment. Offer a defensible alternative: inventory, classify, apply retention, and destroy only eligible records with documentation.