AI at Work: How to Maintain Your Privacy and Data Security
Generative AI tools are entering the business world, but are they safe?
The entry of generative AI tools, such as OpenAI’s ChatGPT and Microsoft’s Copilot, into the business world raises important questions regarding privacy and data security. These tools are evolving rapidly, accompanied by concerns surrounding their potential to lead to privacy and security issues, particularly in the work environment.
Privacy Concerns: Microsoft Recall and ChatGPT
New tools from Microsoft and OpenAI are raising questions about the collection of sensitive information. Last May, privacy campaigns labeled Microsoft’s Recall tool a “privacy nightmare” due to its ability to take screenshots every few seconds. This feature raised regulatory concerns in the UK, where the regulator asked Microsoft to provide further details on the tool’s safety. OpenAI faced similar criticism following ChatGPT’s screenshot capabilities, which could expose sensitive data.
Ban on Copilot Use in the U.S. Congress
Concerns over privacy breaches led to a ban on the use of AI tools in parts of the U.S. government. The U.S. House of Representatives decided to ban the use of Copilot among House staff due to fears that sensitive information might leak to unauthorized clouds. These concerns were also echoed by market analysts who argue that AI tools can lead to internal and external exposure of sensitive data.
Danger to Companies: Is Your Information Safe?
Companies may unknowingly expose sensitive information when using AI. One of the primary challenges in using tools like ChatGPT or Copilot is the risk of accidental disclosure of sensitive information. According to experts, these systems act as “large sponges” that absorb vast amounts of information from the internet to train their language models. This raises concerns that sensitive data could enter a system and become accessible to others.
AI as a Tool for Employee Monitoring: A New Possibility?
AI tools may be used for employee monitoring—are we on the verge of a breach of privacy at work? Another concern worrying companies is the possibility that AI tools will be used to monitor employees. For example, although Microsoft notes that the Recall feature is stored on the user’s local computer, some warn against the future use of these tools to track employees, representing a potential violation of their privacy.
Corporate Promises: Maintaining User Privacy
What do the major companies say about data security in their AI tools? Companies like Microsoft, Google, and OpenAI are trying to reassure users, stating that they invest heavily in privacy protection and security. Microsoft guarantees that there is control over the Recall feature, and Google notes that its AI does not change the fundamental data protections. OpenAI even offers tools to control user data and the option to export and delete personal information.
Steps to Protect Privacy When Using AI
Recommendations from IPV Security specialists for the safe use of generative AI tools:
- Do not input confidential or sensitive information into prompts – When using public tools like ChatGPT or Google Gemini, avoid entering sensitive details such as budgets or personal data.
- Use general phrasing in prompts – Use general language in prompts. For example, instead of “Here is a secret budget,” write “Request for a budget template.”
- Use of Copilot requires thorough review – Within the organization, organizational data permissions must be examined; otherwise, employees may be exposed to information they were not supposed to see.
- Use AI as a first draft only – It is recommended to use AI tools to create an initial version of a document and add sensitive details manually afterward.
- Verify information received from AI – If using AI tools for research, it is important to verify answers by requesting sources and links for the information provided.
- Re-check AI-generated code – When asking AI to write code, it must be reviewed to ensure it is suitable and not assumed to be ready for use.
- Define Least Privilege access for sensitive information – Permissions should be configured to assign access only to those who need the information, in accordance with the Principle of Least Privilege (PoLP).
- Disable data collection when necessary – In systems like ChatGPT, you can disable data collection for model training through settings, or use enterprise versions with additional controls.
Summary: AI Is Here to Stay, But With Risks
The future of AI in business is promising but requires caution. It appears that AI will become an integral part of the working world, but as it evolves, so will the risks. It is important to treat AI as any other third-party service and exercise extra caution regarding information sharing to prevent unnecessary exposure of sensitive data.
For more information: AI Is Your Coworker Now. Can You Trust It? | WIRED