WARNING! The use of artificial intelligence may pose risks to personal data

       In view of the increasingly frequent reports of risks associated with the use of artificial intelligence (AI) highlighted at international level, the National Center for Personal Data Protection of the Republic of Moldova (NCPDP) draws attention to the need to safeguard privacy and personal data in the context of the use of these technologies.

       Although AI-based tools may facilitate everyday and professional activities, their use without appropriate precautionary measures may pose risks to information security and individuals’ rights. In this regard, the NCPDP issues the following recommendations for controllers and individuals.

       The NCPDP urges controllers to assess the risks associated with the implementation and use of AI systems, establish clear internal rules governing their use, and ensure that staff are adequately informed and trained.

       In the workplace, where employees use chatbots and digital assistants, such as ChatGPT or Copilot, to draft documents, respond to customer requests or summarize large volumes of files, clear restrictions must be established regarding the input of personal data or confidential and sensitive information into these tools, as such actions may expose organizations and data subjects to significant risks.

       Depending on the terms of use and the settings applied, personal data entered into such tools may be transmitted to the providers of these services and stored on their servers. In many cases, users are unaware of how this information is stored or used, while the individuals to whom the data relate may be unaware of or uninformed about such processing.

       The use of AI tools without clear rules or without complying with legal requirements may lead to the unauthorized disclosure of personal data or other forms of unlawful processing. Depending on the circumstances, such an incident may constitute a personal data breach.

       To prevent such situations, controllers must clearly establish whether and under what conditions staff may use these tools, as well as which categories of information may be permitted or prohibited from being entered into them. It is also important to review the terms of use of these services and the safeguards provided by their providers, including those relating to data storage, retention and deletion.

       The use of AI tools must respect the right to personal data protection in accordance with the applicable legal framework, including the principles of lawfulness, transparency, data minimisation and security.

       Furthermore, the NCPDP recommends that individuals exercise the utmost caution when using AI tools and pay particular attention to the information they provide through these tools. The NCPDP draws attention to the following aspects:

• Protect personal and confidential information. Do not enter personal data from identity documents, medical or banking information, or other sensitive data into chatbots and other AI applications without first reviewing the terms of use and the safeguards provided for their protection.
• Review the terms of use of applications. Pay attention to the permissions granted and to how the information entered may be collected, stored, retained or reused.
• Exercise caution when dealing with suspicious messages and requests. Do not disclose personal data before verifying the identity of the person making the request through official channels.
• Verify the authenticity of information received. Messages, phone calls, images and audio or video recordings may be created or manipulated using AI, even if they appear to originate from people you know or representatives of institutions.
• Verify AI-generated information before using or sharing it. Such information may contain errors or misleading content. Cross-check the results against reliable sources, particularly when they concern specific individuals or situations.

       The NCPDP reiterates that the development and use of AI-based technologies must not undermine the right to privacy or the right to personal data protection. Data controllers must ensure compliance with legal requirements in the course of their activities, while individuals are encouraged to exercise vigilance when providing information through these technologies.

       Awareness, prevention and respect for the rights of every individual are essential to reducing the risks associated with the use of artificial intelligence.