People who work in human resources would be considered a secondary audience for privacy metrics if they do not have privacy policy as their main task. A secondary audience is a group of stakeholders who are indirectly involved or affected by the privacy program, but do not have primary responsibility or authority over it. They may use privacy metrics to support their own functions or objectives, such as hiring, training, or compliance. References: IAPP CIPM Study Guide, page 23.