Privacy Protection

Privacy and Data Protection in Everyday AI Use

This is the responsible-AI failure most likely to happen this week, by accident, in a hurry. A manager pastes an employee record into a public AI tool to "draft something quickly" and has just committed a data-protection violation. The rules here are concrete and testable.

If you would not post it on a public noticeboard, do not paste it into a public AI tool.

Never paste these

  • Full employee names
  • Employee IDs
  • Medical or personal disclosures made in confidence
  • Prior formal HR documentation
  • Confidential business data
  • Client data

Safe to paste (sanitized)

  • Generic behavioral descriptions
  • Structural requirements ("a PIP with timeline, measurable targets, and review cadence")
  • Anonymized meeting notes
  • General role descriptions without identifying details

The Legal Context

Regulation Is Tightening, Not Loosening

Under GDPR, personal data must be limited to what is necessary for specified, legitimate purposes (data minimization, Article 5). Entering an employee's name, performance history, or health information into a commercial AI tool that may use inputs for training is unauthorized processing. California's CPRA requires notification when automated decision-making is used for significant employment decisions, with opt-out mechanisms. The direction of travel: more accountability, not less.

Sam's story

Sam is preparing a performance improvement plan and is tempted to paste the full case, name, history, a private health disclosure the employee made, into an AI tool to draft it fast. Sam stops. Into the AI goes only the generic behavioral description and the structural requirements for the PIP. The AI returns a solid structure. Sam fills in every identity-bearing detail in the HR system, never in the AI tool. The PIP got drafted faster, and no employee data left where it was safe.

Apply It Today

Apply the noticeboard test

Apply the noticeboard test to the last thing you pasted into an AI tool. If it would fail the test, change your default for next time.

Reflect

  • What is the most sensitive thing you or someone on your team has likely pasted into a public AI tool?
  • What is one default you can change so privacy protection happens automatically, not by memory?