More and more people are using AI at work. You type a question into a chatbot and within a few seconds you have a text, summary, or schedule. Handy! But: what are you actually allowed to put in there? And when does it become a data leak?
In this blog, you will read what you can and cannot share with AI. We look at the GDPR, the privacy law, in doing so.
1. What is personal data?
The GDPR concerns personal data. This is any information that says something about a person whom you can identify. Examples include: name, address, telephone number, email, employee number, IP address, or a combination thereof.
There is also special personal data. This is extra sensitive. This concerns, for example:
- data about your health;
- race or ethnic origin;
- religion or worldview;
- political views;
- sexual orientation;
- membership of a trade union.
This data is so sensitive that organizations may only use it in exceptional cases.
Important to know:
Everything you put into an AI chatbot is processed. Processing is a broad word: it concerns everything an organization can do with data, such as storing, viewing, passing on, or analyzing.
2. What can you actually do with AI at work?
You can use AI safely if you do not share any personal data or trade secrets. Consider, for example:
- a. General writing
- Write a neutral text about working from home.
- Make this text clearer and shorter.
- You then paste a text without names of individuals or companies, without customer numbers, and without sensitive information.
- b. Examples without recognizable persons
You can describe a situation without anyone being recognizable. For example:- Yes: “An employee in an office is suffering from work pressure. How can an employer deal with this?”
- Not: “A 34-year-old woman from Utrecht, with two children and a temporary contract at department X, has panic attacks.”
- The fewer details, the smaller the chance that someone can be recognized.
- c. Formats and ideas
You can ask AI for a format or idea:- Create a sample meeting agenda.
- Name ten ideas to reduce work pressure.
- In doing so, you do not use real names or other personal data.
- d. Public texts
You can have public information, such as legal texts or already published government policy documents, summarized or explained. Do pay attention to copyright regarding non-public documents.
3. What should you never put in an AI chatbot?
The Dutch Data Protection Authority (AP) warns that data breaches are increasingly occurring because employees paste personal data into AI chatbots. Free chatbots, in particular, pose risks because it is not always clear what happens to the data.
In any case, do not put the following in AI chatbots:
- a. Data of colleagues, customers or patientsFor example:
- names, addresses, telephone numbers, email addresses;
- employee or customer numbers;
- salary details;
- schedules, absence data;
- assessments and performance reports;
- BSN or copies of identity documents.
- b. Special personal dataAmong other things:
- health data (think of diagnoses, sick leave notifications, medical appointments);
- trade union membership;
- belief or political preference;
- sexual orientation.
This data is afforded extra protection under the GDPR.
- c. Confidential business informationThink of:
- unpublished figures;
- strategic plans;
- source code and security information;
- documents under confidentiality.
Rule of thumb:
Wouldn't you also email the information to a stranger outside the company?
Then it doesn't belong in an AI chatbot either.
4. Your employer's rules: what do they mean?
Many organizations create rules regarding the use of AI.
Here, we call this your employer’s policy.
These are the agreements your employer puts in writing, for example in:
- an ICT regulation;
- a privacy policy;
- an AI or security policy.
It states, for example:
- or whether you may use AI;
- which tools you are allowed to use;
- what you may and may not do with it;
- whether there is an internal, secure AI solution.
Important:
If your employer blocks AI at work, do not use AI indirectly.
So no free chatbot via your private account to get that customer letter written with real data after all.
If you do, you could be held personally responsible for a data breach or a violation of company regulations.
Are you unsure? Ask your manager, HR, the Works Council, or De Unie.
5. What can De Unie do for you?
De Unie helps you if you have questions about AI at work, privacy, and the GDPR. We can:
- Reviewing with you whether the use of AI is permitted in your situation;
- to advise you if you are in doubt whether something is a data breach;
- support you if your employer addresses you about the misuse of AI;
- Collaborating with the Works Council and employers to develop clear rules for AI in the workplace.
Do you have a specific question or are you worried?
Please contact our Service Center at sc@unie.nl or 0345 851 963 (on working days from 8:30 AM to 5:00 PM).
