Artificial Intelligence (AI) based applications are the most significant addition to automation. AI-based chatbots work as enablers to enrich customer service, employee experience, performance improvement, and other processes which truly eliminate human intervention, by bringing in accuracy, speed, and agility.

However, as these chatbots become more prevalent in use, concerns about privacy also arise. The occasion of Data Privacy Day (or week) is a good time to reflect on the implications of using AI-based chatbots.

One of the main concerns about chatbots and privacy is the collection of personal information (such as PI, PII, PHI, SPDIs). Many chatbots collect user data, including their conversations, personal preferences, and location. This data can be used to personalize the chatbot responses and improve the user experience, though it can also be used for purposes like targeted advertising or more nefarious purposes, such as identity theft.

Key concerns

• There are concerns about the security of chatbot systems. Chatbots are often connected to the internet, which means that they are vulnerable to hacking and cyberattacks. If a chatbot system is hacked, personal information can be stolen, and the chatbot can be used to spread malware or launch cyberattacks.
• Another concern is the lack of transparency around how chatbot data could be collected, stored, and accessed. Many chatbot developers do not clearly explain how they collect and use user data, leaving users in the dark about how their personal information is being handled. This lack of transparency can lead to mistrust of chatbots and reluctance to use them.
• Furthermore, there is a concern that chatbot data may be shared with third parties without the user’s knowledge or consent. This could potentially lead to the data being used for targeted advertising or other purposes that the user may not be comfortable with.
• Users also have a role to play in protecting their privacy when using chatbots. It is always advisable to provide the minimum necessary information that which does not contain personal information. Caution needs to be exercised when dealing with chatbots and the terms of service and privacy policy should be carefully read.

To address these concerns, it is important for chatbot developers to be transparent about their data collection practices and to provide users with clear and easy-to-understand explanations of how their data is being used.

• A cybersecurity angle holds relevance when handling data collected through AI chatbots
• It is important to integrate data privacy processes with a zero-trust framework through the principle of reauthentication
• Consent based information sharing from users should be built in by design where data protection impact checks (automation) are conducted providing clear and concise privacy notices that are designed for transparency and have a data retention policy.
• Implementing data minimization techniques, such as only collecting the minimum amount of data necessary to perform the intended task will go a long way in achieving privacy objectives.
• Identity and access management policies for personnel should be clearly factored in for handling data received from chatbots. Multifactor authentication, role-based access privileges are some services that may need implementation.
• Information rights management with data loss prevention measures to ensure the restricted sharing of sensitive data within and outside the organisation also needs consideration.

As the use of AI chatbots become more prevalent, it is important to be aware of the potential privacy concerns. It is significant for government, businesses, and individuals to be aware of these concerns. One of the most important steps is to be aware of the types of data that chatbots collect and to be careful about sharing personal information with chatbots.

Additionally, it is important to ensure that chatbot systems are secure and protected from cyberattacks.

In conclusion, AI chatbots have the potential to be a significant enabler at the same time they also raise important privacy concerns. Developers of chatbots must be transparent and responsible with the data they collect, while users must be aware of the potential risks and take steps to protect their personal information.

On this Privacy Day, let’s take a moment to reflect on how we can protect our personal and sensitive information when using AI chatbots and reflect on the importance of privacy with the steps we ought to take to protect it.

[This story was authored by Akshay Garkel, Partner and Cyber Leader and Labdhi Jhatakia, Manager at Grant Thornton Bharat. The views expressed are solely of the authors’.]