Guarding Your Privacy: Cautionary Insights on Using Generative AI with Personal Data

 

In the era of advanced Artificial Intelligence, the need for prudent handling of personal data in conjunction with generative AI models cannot be overstated. Recent revelations surrounding Google Bard Conversations have illuminated a pressing concern: sharing exchanges with AI chatbots such as Google Bard and OpenAI's chatGPT can inadvertently lead to the indexing of these conversations by search engines. This inadvertent indexing transforms what was meant to be a private exchange into potentially accessible public knowledge. In this article, I dive into the risks inherent in deploying generative AI and underscore the paramount importance of anonymizing personal data to fortify privacy.

Consider this scenario: You engage in a conversation with Google Bard, Google's AI-powered chatbot, similar to OpenAI's chat GPT, especially as it integrates with the Bing search engine. If you choose to share a conversation link with a colleague, here's the startling revelation: Google can index this conversation, thereby making it accessible in future search results. Imagine collaborating with a coworker to develop a confidential business plan; such information is not meant to be disseminated beyond your organization's walls. Yet, by sharing the conversation link, it inadvertently becomes indexable, rendering it susceptible to Google's web crawlers. Should someone else employ the right search query, this confidential exchange could surface in search results. What was once safeguarded as personal data now risks public exposure.

Similar concerns arose in the past with OpenAI's ChatGPT, where users occasionally gained access to other users' chat histories, a situation OpenAI has since addressed and rectified. However, in Google's case, it's not a bug, but rather a feature. According to a Google scientist, indexing occurs only when a user actively clicks the "share" button. The nuance here is that users often assume that "share" implies selective sharing with specific individuals, not a broader audience. Regrettably, this is not the case.

In response to the inadvertent indexing of shared conversations, Google has acknowledged the problem and is actively working on a solution [source: https://twitter.com/searchliaison/status/1706733784534859909]. This acknowledgement underscores the importance of caution when sharing personal information via AI chatbots.

In light of these developments, the use of generative AIs demands caution, particularly when personal data exposure is at stake. It is strongly recommended that when engaging with these chatbots with your personal information, thorough anonymization be employed. Anonymization is an irreversible process that renders personal data non-personal and ensures that once acquired, data cannot be traced back to its original owner. By adopting these precautionary measures, individuals can prioritize their safety and the security of the information they entrust to generative AI. Remember, the responsibility of upholding privacy begins with you.

In this dynamic landscape of AI-driven innovation, vigilance is our greatest ally in safeguarding the sanctity of personal data and preserving our privacy.

Jordan Kinobe works in the Data Protection Affairs department at PDPO.

Comments

Post a Comment

Popular posts from this blog

The State of Data Protection in Uganda: PDPO

Image
  Caption: The Deputy Speaker, Rt. Hon Thomas Tayebwa launches the PDPO strategy during the Data Privacy Day celebrations in January this year. Uganda, like many nations globally, is making significant strides in personal data protection. For the past three years, t he Personal Data Protection Office (PDPO), established by the Data Protection and Privacy Regulations 2021 has been at the forefront of this mission. The Personal Data Protection Office is Uganda’s independent data protection office. It was established as an independent office responsible for overseeing the implementation of and enforcement of the Data Protection and Privacy Act No. 9 of 2019. Uganda’s data protection journey is anchored in t his Act , which ensure s the privacy of individuals by regulating the collection, storage, and use of personal data. The Act provides a robust framework for data protection, outlining the responsibilities of data controllers, processors, and the rights of data subjects. ...
Read more

PDPO Unveils the 2024 Data Privacy Campaign

Image
  Kampala, Uganda – 9 th January, 2024 In a bid to promote public awareness about personal data protection and privacy, the Personal Data Protection Office (PDPO) has today flagged off the 2024 Data Privacy campaign under the theme; “Stop, Think, Own Your Privacy”. This campaign is part of the drive towards commemoration of the international data privacy day that is celebrated annually on 28 th January. While launching the campaign at the Uganda Media Center, the Minister for ICT and National Guidance Hon. Dr. Chris Baryomunsi noted that in Uganda just like in other parts of the world, data privacy is a fundamental right and a cornerstone upon which digital freedoms are built. He emphasized that while we must acknowledge and embrace the transformative power of technology, we must also remain cognizant of its potential to infringe upon our privacy. He applauded the team at the Personal Data Protection Office for the efforts undertaken towards execution of their mandate and...
Read more

PDPO wraps up investigation into data security breach at USE

Image
  Following the notification of an alleged data security breach at the Uganda Securities exchange in June 2022, t he Personal Data Protection Office (PDPO) has concluded its investigation into the data security breach involving the Uganda Securities Exchange (USE) and its technology partner, Soft Edge Uganda Limited. In its report, the Office revealed that the breach resulted in unauthorised access of personal data of individuals whose data was collected by USE.   Findings from the investigation indicated that the data security breach was caused by non-compliance with the Information Systems Policies Manual, the Data Protection and Privacy Act, and supporting Regulations. The breach was specifically attributed to a change in the firewall configuration that left a port open, which did not follow the established change management procedures.   Additionally, there were critical areas of non-compliance with the Data Protection and Privacy Act and supporting Re...
Read more