{"id":"PLT-012","section":"Platform, Privacy & Assurance","requirement":"Support pseudonymized and aggregate-only views where required","acceptance":"Provide role-scoped views that withhold individual identity while preserving team, department and tool-level analysis, so monitoring can proceed where works councils, unions or local law restrict individual attribution.","tier":"Tier-independent","whyItMatters":"Where works councils or local law restrict individual attribution, monitoring still has to be possible.","verificationMethod":"W","verificationTest":"Pilot data viewed at team level with individual identity withheld.","formerly":"GOV-013","alsoIn":[],"sort":66,"adoptionContext":"Privacy-appropriate reporting views can be needed across the listed employee AI contexts; the tier itself does not determine whether individual attribution is permissible.","mappings":[{"frameworks":["csf","soc2","iso27001"],"explanation":"Role-scoped views that withhold identity implement access restriction and masking while enabling team-level monitoring aligned with relevant stakeholder and privacy requirements. Pseudonymization or aggregation does not guarantee anonymity; the buyer must establish the permitted use and validate re-identification and alternate-access risks.\nSOC 2: P4.1 requires the Privacy category and relevant information in scope.\nISO/IEC 27001: Operate masking within the buyer’s ISMS scope and enforce restrictions before access; monitoring or warnings alone are insufficient. Check local law and workforce-consultation duties separately.","kind":"framework","references":{"csf":["GV.OC-02","PR.AA-05"],"soc2":["CC6.3","P4.1"],"iso27001":["A.8.11","A.8.3","A.5.34"]},"relation":null,"conditions":[]},{"frameworks":["rmf"],"explanation":"Withholding identity supplies a concrete privacy-risk treatment and evidence for evaluating impacts on individuals and relevant AI obligations. It does not replace the privacy/individual-impact assessment or determine which workforce-monitoring obligations apply.","kind":"framework","references":{"rmf":["GOVERN 1.1","MEASURE 2.10"]},"relation":null,"conditions":[]}],"area":"Platform, Privacy & Assurance","areaSlug":"PLT","url":"/r/PLT-012","frameworkRefs":{"ISO27001":["A.8.11","A.8.3","A.5.34"],"NIST-CSF":["GV.OC-02","PR.AA-05"],"NIST-AI-RMF":["GOVERN 1.1","MEASURE 2.10"],"SOC2":["CC6.3","P4.1"]}}