A new audit compares eighteen months of the Living Dashboard's own query traffic against CheckPoint's no-join pledge, and finds the boundary holding in policy but not in practice.
An eighteen-month log audit finds the Living Dashboard querying CheckPoint identifiers more each month, unmoved by a reissued no-join pledge
CheckPoint was built not to talk to the Living Dashboard. Eighteen months of the Dashboard’s own query traffic say otherwise: a share of its queries now reference CheckPoint’s participant records that was close to zero when the wellbeing tool launched, and reissuing the no-join pledge partway through the audit window changed none of it.
The audit, from the School of Continuous Improvement, set the pledge against traffic the Dashboard already logs for its own performance tuning rather than for this purpose, tracking how often a query’s terms touch a CheckPoint identifier across the full window. A parallel staff item on whether check-in data reaches performance review moved together with a fall in who opted in.
The pledge is doing exactly what it says in every document we checked. It’s the query log that isn’t.
— Associate Professor Casimir Beng, Lead of the Adaptive Metrics Lab
“A cadence of audits will tell us more about where a boundary actually sits than any single restatement of it,” said Dr Osei Vandermeer, Research Fellow and Convenor of the Review Cadence Observatory.
The School treats the finding as an argument for auditing its own systems on the same cadence it audits everyone else’s.
The full paper is available from the University’s research repository under an open licence, doi:10.5555/slop.hxwf45.