Generative AI and Copilot: Privacy Risks

Privacy and confidentiality are key concerns when using gen AI tools.

Read the Terms of Service (ToS) of any tool you use, to help you make an informed decision on whether you wish to access the service. ToS usually include details on how the provider may use your personal data (e.g., monitoring your use for tool diagnostics or training material, using your data for advertising, having (non)exclusive rights to work you create on their platform, giving them permission to on-sell your identifying or health data to third parties).

Sometimes you have to agree to the ToS to access the service at all, whereas other tools will allow you to use the service without committing to their ToS.

You should be aware of what you choose to share on these platforms, given this potential for re-use. Avoid sharing sensitive, protected or highly personal data with gen AI tools. This includes:

• personally identifiable information (names, addresses, biometric data, health and medical information, government-issued ID, etc.)
• unpublished exams
• unpublished research data and results
• confidential or commercially sensitive material (including asking gen AI for input on business plans, strategies or security credentials)

Third-party resources are often under Copyright. Inputting them into a gen AI tool would be a breach of Copyright Law. Ensure you only upload resources where you have explicit permission from the Copyright holder, or where Fair Dealing provisions apply.

When uploading third-party resources, you are advised to opt out of data collection (See: manage your data in ChatGPT.).