"Advances in artificial intelligence (AI) and machine learning (ML) are an obvious topic for Data Privacy Day 2024 - both because of the potential benefits that these tools bring and the associated risks that are causing concern. Given the widespread adoption of AI tools in the last year alone, it is vital that we, as representatives of the IT security community, take this opportunity to raise awareness and deepen understanding of the risks posed by AI in terms of protecting our data. AI is increasingly finding its way into our everyday lives and therefore affects the right to data protection for all of us."

'Free' services call up data as a 'price'

Carla Roncato warns: "Companies and individual users should never forget one thing: If a service they use is 'free', then in the end it's probably about data that is called as a 'price' in return. This also applies to AI tools, so everyone should act accordingly. Many early AI services and applications - including ChatGPT - use a usage model similar to that of social media platforms such as Facebook and TikTok. Although users do not pay money to use these platforms, they compensate the providers by consenting to the sharing of private data. Companies use this to make money with targeted advertising, for example. Similarly, a free AI service can collect data from devices, store the individual prompts and then use this data to train its own model. While this may not seem malicious, this is exactly why it is so important to know what is happening and to what extent processing the collected data to train generative AI algorithms raises privacy issues. Just suppose one of these companies is hacked and data falls into the wrong hands: then this kind of individual information can be cleverly used as a weapon."

AI tools are powerful and safe to use

As Roncato goes on to explain, AI also has many advantages. Accordingly, many AI tools are quite powerful and can be used safely with the right precautions. "The risks that arise for companies in the course of business use depend primarily on the respective tasks, objectives and data used. In terms of security, it all starts with a policy, which means that organizations ultimately need to define clear AI guidelines that are tailored to their company's specific use case. Once these have been defined, the next step is to inform employees and raise awareness of the risks. It is also important to adapt the rules accordingly as soon as the framework conditions change, for example in the form of new regulations. Regular communication with the workforce is crucial in this context."