D&DCPD Workplace Protection Newsletter: Are You Using Workforce Information Responsibly — Or Just Efficiently?

Most organizations have spent the last few years focused on collecting more workforce information. More analytics. More dashboards. More AI-generated insights. More visibility into productivity, performance, and workforce trends.

But here is the question that is increasingly landing on the desks of HR leaders, executives, and legal counsel: how is that information actually being used — and can you explain it?

That distinction matters more than most organizations realize.

The Real Risk Is Not Collection. It Is Use.

The conversation about workforce information has largely been framed around data protection — keeping information secure, managing access, ensuring privacy compliance. Those things matter. But they are only part of the picture.

The risk that is growing inside most organizations right now is not that workforce information is being collected. It is that it is being interpreted and applied in ways that are inconsistent, unexplained, and in some cases, legally indefensible.

Managers are maintaining parallel records in personal spreadsheets outside approved systems. Employees are pasting internal workforce information into AI tools to complete tasks more efficiently — without clarity on where that information is processed or retained. Analytics platforms are generating outputs that influence hiring, scheduling, and performance decisions without clear oversight or validation.

Individually, any one of these situations might seem manageable. Collectively, they represent a growing disconnect between what organizations believe is happening with their workforce information and what is actually happening in practice.

When Information Starts Driving Decisions

There is a meaningful difference between workforce information that supports a decision and workforce information that drives one.

When AI tools summarize employee feedback, when dashboards surface performance patterns, when analytics flag scheduling inefficiencies — these outputs are increasingly treated as authoritative. Leaders rely on them. Decisions follow from them.

The problem is that those outputs are only as good as the data behind them, the context around them, and the governance over them. And in most organizations, that governance has not kept pace with the speed at which AI tools are being adopted and used.

The result is a category of risk that sits at the intersection of bias, transparency, and accountability. Conclusions drawn without full context. Over-reliance on AI-generated insights. Limited ability to explain how an output was derived — or how it influenced a decision about a person's career.

What the Law Is Beginning to Require

This is no longer just an ethical consideration. It is an increasingly legal one.

Where decisions about employees cannot be clearly explained or justified, where sensitive information is used beyond its intended purpose, where AI outputs influence outcomes without documented oversight — organizations face real legal exposure. Human rights legislation across Canada, Quebec's Law 25, and an accelerating body of AI-related litigation in the United States are all moving in the same direction: organizations must be able to account for how workforce information was used in decisions affecting people.

More data does not mean better decisions. Without structure and accountability, more data increases inconsistency, amplifies bias, and reduces transparency. The question is no longer whether you have workforce analytics. It is whether you can explain what they told you, how you interpreted them, and whether that process was fair and consistent.

The Shift That Is Required

Addressing this does not require restricting information or abandoning AI tools. It requires something more deliberate: a shift from using workforce information efficiently to using it responsibly.

That means defining how workforce information should support talent decisions, culture, and performance — not just reporting. It means establishing clear expectations for how data is interpreted and applied across teams. It means ensuring human oversight remains central in decisions that affect people's careers, employment, and livelihoods. And it means building awareness across the organization — not just within HR or IT — about what responsible use actually looks like in practice.

The organizations that are getting ahead of this are not necessarily the ones with the most sophisticated tools. They are the ones that have asked the harder question: are we using workforce information in a way that is responsible, explainable, and aligned with how we say we treat people?

And critically: who is accountable for making sure the answer is yes?

** Session 2 of the Beyond Data Series — Workforce Information Strategy & Ethics: Enabling People, Not Just Systems — takes this conversation further.

We will examine how workforce information is currently being used in practice, where fairness, transparency, and accountability risks are emerging, and the practical frameworks organizations can use to bring structure and consistency to how workforce information is applied.

Wednesday, June 25, 2025 | 12:00 PM ET Free. Interactive. Built for leaders who want to get ahead of this.

Contact us for registration information at info@dndcpd.com

Missed Session 1 of the Beyond Data Series? Here's What You Need to Know Before June 25

If you missed our first session, no problem. Here is a quick summary of what we covered — and why it matters for Session 2.

The Foundation: What Is Workforce Information?

Most organizations think of workforce information as HR data — contracts, performance reviews, payroll records. It is much broader than that.

Workforce information is everything created about, by, or related to your people across every system, platform, and conversation in your organization. That includes structured records, but also emails, Teams messages, meeting notes, AI-generated summaries, manager observations, and the workflows, methodologies, and processes your employees build as part of their work.

The critical distinction: the structured part is generally managed. The unstructured part is moving freely — across platforms, into AI tools, and between systems — without anyone fully tracking where it goes, who has access, or how it is being used.

Why This Is Urgent Right Now

The legal landscape has shifted significantly. According to DOAR Consulting's AI Litigation Analysis published in April 2026, AI-related class action lawsuits in the United States rose from seven in 2022 to ninety-four in 2025 — a thirteen-fold increase in three years.

These are not abstract lawsuits. They fall into three categories directly relevant to how organizations manage workforce information: employers monitoring employees through AI without adequate disclosure; AI tools influencing hiring and performance decisions in ways that produce discriminatory outcomes; and employee data being processed through third-party platforms that were never authorized.

Canada is not far behind. PIPEDA, Quebec's Law 25, Alberta PIPA, and human rights legislation across every province create real obligations around how organizations handle employee information. The exposure is here and growing.

The Hidden Risk: Shadow AI and Intellectual Property

One of the most consistent themes from Session 1 was Shadow AI — employees using AI tools that have not been approved or governed by the organization. Not because they are trying to circumvent policy, but because those tools are efficient and available. The problem is what happens when sensitive workforce information, proprietary processes, or organizational IP enters a platform the organization has no visibility into, no agreement with, and no control over.

This connects directly to a question most organizations have never formally answered: who owns what employees create? Workflows, methodologies, client processes, custom tools — the intellectual output of your workforce may represent your most valuable and most vulnerable assets. Without clear IP and confidentiality clauses in employment agreements, enforcement when someone walks out the door becomes genuinely complicated.

The Governance Gap

No single function in most organizations holds the complete picture. HR manages records. IT manages systems. Legal responds reactively. Leadership interprets analytics. Cybersecurity guards the perimeter. Everyone is doing their job — but workforce information moves through all of them and between all of them without anyone tracking the full lifecycle.

That space between functions is where risk accumulates. It is not a failure of intent. It is structural. And it creates accountability gaps that are often invisible until a termination is disputed, a discrimination complaint is filed, or a former employee takes proprietary information to a competitor.

What It Means Legally

When employment decisions — terminations, promotions, performance outcomes — are built on ungoverned data, informal notes, or AI outputs that cannot be verified or explained, organizations face three compounding risks. They may not be able to show what information was considered. They may not be able to explain how AI-influenced decisions were made. And they may face significant additional damages if the process itself is found to have been conducted in bad faith. Building defensibility before a decision is made — not after a complaint arrives — is the practical takeaway.

What's Coming in Session 2

Session 1 established the diagnosis. Session 2 moves to direction.

Beyond Data: Workforce Information Strategy and Ethics — Enabling People, Not Just Systems will examine what it means to govern workforce information not just as a compliance obligation, but as a strategic and ethical commitment. We will look at what ethical leadership looks like when AI is involved in decisions about people's careers and employment, where the line sits between enabling organizational capability and exposing individuals to harm, and what proactive governance delivers for both the organization and the people it serves.

Session 2 — Wednesday, June 25, 2025 | 12:00 PM ET

Registration is free. Spots are limited.

Contact us for registration information at info@dndcpd.com

Beyond Data is a free, three-part live series presented by Darcy Daoust, founder of D&DCPD Workplace Protection and Compliance Group, and Dianna Pieper, founder of Innovus Techne — bringing together workplace compliance and technology governance to address one of the most underappreciated risks in organizations today.