Time to Dust Off your Privacy Policy (Episode 2)
It feels like everybody is using AI, one way or another. Some of you work for organisations that have a well-developed and understood AI Policy and employees use only the permitted AI tools for their work.
There will be other organisations where there is no AI Policy and employees can use any free AI tool. If your company is in the second category, the Privacy Commissioner advises that employees should not enter any Privately Identifiable Information (PII) into these tools, because of the risks involved.
“As a matter of best practice, the OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, due to the significant and complex privacy risks involved.”
In any event, you should update your Privacy Policy to reflect your current practices.
The same care should be taken by your employees loading commercially sensitive information that your organisation values highly!
At the very least, conduct a survey inside your organisation to get a better understanding of what your employees are doing today. This won’t take long and will at least tell you whether you have a problem. Reach out if you could use some help!