The rise of artificial intelligence (AI) offers promising opportunities for businesses, but the use of AI also carries risks. In particular, the popularity of AI chatbots such as ChatGPT and CoPilot raises questions, especially when your employees use these tools for their daily work. One of the biggest risks is a possible data breach, as the Dutch Data Protection Authority (AP) emphasized once again on 6 August 2024.
What does the AP say?
In its statement, the AP points out that the use of AI chatbots can lead to unintended data breaches. These chatbots can process data without it being clear how that data is stored, protected, and managed.
What are the possible risks for your business?
- Breach of privacy: sensitive personal data of customers, employees, or other data subjects may be unintentionally exposed to third parties. This can happen, for example, because data entered by one person is used as training data and ultimately ends up in the output generated for another person.
- Breach of the General Data Protection Regulation (GDPR): Under the GDPR, organizations are required to take appropriate measures to protect personal data. If it turns out that employees have entered personal data into an AI chatbot and this data subsequently leaks, this can result in substantial fines.
- Your commercially sensitive information becomes public: In addition to personal data, business strategies, internal know-how, or contracts may also be accidentally disclosed. This can have serious consequences and is anything but beneficial for your business.
How can your organization limit these risks?
Although it is impossible to fully rule out the risks mentioned above, there are steps you can take to reduce the chance of data breaches:
- Raise awareness among employees: Discuss with your employees the dangers of entering (sensitive) personal data into AI chatbots. Awareness is the first step toward better data protection.
- Establish clear guidelines for the use of AI chatbots: consider drawing up rules based on your instructional authority under Article 7:660 of the Dutch Civil Code, setting out how employees are allowed to use AI tools.
- Carry out a (pre-)Data Privacy Impact Assessment ((pre-)DPIA)*: A (pre-)DPIA can help you map out the risks of using AI chatbots or other tools and take appropriate measures before implementing such tools.
- Make clear arrangements with third parties: Do you use AI systems from third parties? Then make sure your contracts include clear agreements on the processing, storage, and protection of data. Create an AI policy and include it in your staff handbook.
Need help drafting an AI policy, or updates to your internet, email, and social media policy?! Then you’ve come to the right place.
Watch out for this too! IP rights lost to the trash because of AI?
Another interesting development regarding the use of AI systems concerns the question of how intellectual property rights apply to output generated by AI. Under Article 1 of the Dutch Copyright Act, copyright is in fact reserved for works that are the result of human creativity. This raises the question of whether AI creations also fall under this. Business owners who use AI should be aware of this, since the legal status of such creations is not yet fully clear. Another development is that AI output may fall within the design-law definition of a “product”. Design-law protection in turn carries its own separate requirements.
In any case, the Court of Justice of the European Union (CJEU) will soon address a number of preliminary questions on the role of the creative process and proof of originality in the context of copyright protection for applied art. The Court’s answers will have a major impact on the protection of AI creations within the EU. We will of course keep you informed of these developments!
Our business lawyers are happy to help you draft clear AI guidelines, review contracts with third parties, and advise on privacy, AI, and intellectual property rights. This way, you minimize the risk of data breaches, GDPR violations, loss of valuable intellectual property, and fines. Contact us directly via info@thelegalcompany.nl or 020 345 0152.
*Would you like to know more about what a DPIA involves? Click here.
Nothing changes as constantly as laws and regulations. Please note that our blogs may no longer align with current laws and regulations and may therefore be outdated. If you have questions or an issue relating to this blog, or would like legal assistance, please contact us.
