AI in the Workplace: Beware of Data Leaks

The Risks of AI Without Policy

The situation in Eindhoven highlights the dangers of uncontrolled AI use by employees. Personal data was unintentionally shared via public AI tools – not out of malice, but due to ignorance and convenience. This resulted in citizens’ and colleagues’ data leaving the organization, with unclear scope and impact, possibly risking a data breach.

This is not just a theoretical risk: with public AI chatbots like ChatGPT, inputted text (such as company documents, code, or personal data) may be stored and used to improve the model. If a similar question is asked later, fragments of the original input could be shown to another user.

Since AI tools are as accessible as email or search engines, the risk lies not in the technology itself, but in everyday usage. Many employees don’t realize that entered data in public AI tools is processed on external servers and may be stored and used for model development. Entering personal data, sensitive business information, or confidential documents in public tools like these results in losing control over that data, and potentially violating the GDPR.

What Can Employers Do?

Many employers already have policies on confidentiality and handling personal data. It’s wise to review these policies: is it clear to employees that they must not upload information to public AI tools, and why?

As with many other types of workplace policies, be very clear and consistently adhere to your own policy. As an employer, include the following in your policy:

• Specify which public AI tools may and may not be used;
• Clarify how public AI tools can be used (e.g., for translating general texts without sensitive data, but not for optimizing customer files);
• List available internal alternatives and how they should be used;
• Describe the procedure if an employee is unsure about using AI (e.g., consult a manager or IT staff first);
• State possible consequences for policy violations (such as a warning, additional training, or in severe cases, dismissal).

Enforcement: Be Consistent

Employers have the right to enforce consequences for breaches of AI policy. This is not to punish every minor mistake, but to manage risks, similar to other compliance and safety rules. Repeated or deliberate mishandling of sensitive data may justify disciplinary measures.

At the same time, employees must understand the policy. Provide training and raise awareness about AI to ensure safe usage. Employees should also feel safe to ask questions and discuss uncertainties. If people fear sanctions for every mistake, they may hide errors instead of reporting them. Involving staff in safe AI use helps ensure the policy is accepted and followed.

Implementing AI Policy for Employees

In short: employers should review and tighten their guidelines on confidentiality, personal data, and IT use as needed. Involve staff or the works council in the process. This way, you can safely implement AI within the organization without risking the trust or data of customers, citizens, or employees.

Need help drafting policies? Or want to learn more about AI in the workplace and what you can do as an employer, employee, or works council member? Feel free to contact our Employment Law team or one of our AI specialists. Or sign up for our newsletter to stay updated on the latest developments!