Security & Privacy — Foundations Lesson 7

Scenario

Your company has a data privacy policy. You're told to use AI to help with customer support, but you realize the AI tool stores everything you paste into it. This means customer emails (with names, addresses, account information) get stored on a third-party server. Is that a privacy violation? What about compliance requirements like GDPR or HIPAA? You realize: Using AI isn't just about prompting. It's about protecting data.

---

Learning Objectives

By the end of this lesson, you will be able to:

1. Understand data privacy risks when using AI

2. Know the regulations that affect AI use (GDPR, HIPAA, CCPA, etc.)

3. Identify sensitive data that requires special handling

4. Implement safeguards to protect data while using AI

5. Make compliant choices about which AI tools to use

---

Think Before You Prompt

Before you paste anything into an AI tool, ask:

What data am I about to share?

Who does this data belong to?

Would they want me pasting this into a third-party service?

What regulations apply to this data?

Where will this data be stored?

Can I accomplish the task without sharing sensitive data?

---

Types of Sensitive Data

Not all data is equally sensitive. Here's what requires special care:

Personally Identifiable Information (PII)

What it includes: Names, addresses, phone numbers, email addresses, social security numbers, driver's license numbers, passport numbers, birthdates

Why it matters: Can be used for identity theft or stalking

Rule: Never paste into public AI without anonymizing

Example:

❌ "Can you write a thank-you email to Sarah Chen at 555-123-4567?"

✅ "Can you write a thank-you email to a customer thanking them for a referral?"

---

Financial Data

What it includes: Credit card numbers, bank account info, salary information, investment account numbers, tax returns

Why it matters: Fraud, theft, extortion

Rule: Never share directly. Work with aggregated or anonymized numbers only

Example:

❌ Pasting a spreadsheet with employee salaries to ask "Analyze our payroll structure"

✅ "Analyze this payroll structure: We have 50 employees with salary range $40K-$120K. Median is $70K. What's a fair structure?"

---

Medical/Health Data

What it includes: Diagnoses, medications, medical history, treatment plans, lab results, mental health information

Why it matters: Discrimination, privacy violation, violates HIPAA (in the US)

Rule: Absolutely never share directly. Work with AI carefully in healthcare

Example:

❌ Copying a patient's medical record into ChatGPT for analysis

✅ "A patient has condition X and takes medication Y. What are general considerations for treatment planning?" (No patient details)

---

Payment Card Information (PCI)

What it includes: Credit card numbers, expiration dates, CVV, cardholder names

Why it matters: Fraud, payment processing violations

Rule: Never handle this data outside secure payment systems. Never paste into AI.

Example:

❌ Pasting a credit card number anywhere except the payment processor

✅ Using a PCI-compliant payment system

---

Company Confidential Information

What it includes: Trade secrets, unreleased products, strategic plans, customer lists, proprietary methods, internal communications

Why it matters: Competitive advantage lost, contract breaches, business harm

Rule: Get company approval before sharing. Many companies forbid using public AI with confidential info

Example:

❌ "Here's our Q4 strategy. Can you refine the marketing angles?"

✅ Asking your company's internal AI tool, or getting written approval to use external AI

---

Regulatory Compliance Data

What it includes: Any data subject to GDPR, HIPAA, CCPA, SOC2, HIPAA, PCI-DSS, etc.

Why it matters: Compliance violations, legal liability

Rule: Understand your compliance requirements before using AI

Regulations to know:

**GDPR (European data):** Strict rules on processing EU resident data

**HIPAA (US health data):** Can't share patient info with non-compliant systems

**CCPA (California):** California residents' data has special protections

**FERPA (Education):** Student records have specific protections

**SOC2:** Data security and privacy attestation

---

Data Risk Assessment

Before pasting anything into AI, do a quick risk assessment:

Question 1: Does this data belong to me, or someone else?

If someone else → Need their consent or company approval

If me → Continue

Question 2: Is this data protected by regulations?

If yes → Need compliance-aware AI tool

If no → Continue

Question 3: Could exposure of this data harm someone?

If yes → Don't share

If no → Continue

Question 4: Would my company allow this?

If unsure → Check with compliance or leadership

If yes → Proceed

If you answer "yes" to any risk, don't share the data directly.

---

Privacy Safeguards: Protecting Data While Using AI

Safeguard 1: Anonymization

What it is: Remove identifying information from data.

How to do it:

Replace names with "Person A," "Person B"

Replace specific numbers with ranges ("$50K-$70K" instead of exact salary)

Remove dates, addresses, account numbers

Keep only the information relevant to your task

Example:

❌ Raw data:

`

Sarah Chen (sarah.chen@email.com, 555-123-4567): Purchased 3 items,

total $450, lives in Seattle WA 98101, VIP customer since 2020

`

✅ Anonymized:

`

Customer A: VIP status, 3 purchases, $400-500 total spend,

3+ year loyalty, Seattle region

`

---

Safeguard 2: Data Minimization

What it is: Share only the minimum data necessary to get help from AI.

How to do it:

Remove unnecessary details

Focus AI on the core task

Leave out specifics that don't affect the outcome

Example:

❌ "Our customer Tom Johnson (tom@email.com) from New Jersey is angry about his $240 order that arrived late. He's a regular customer with 15 previous orders. Can you write him an apology email?"

✅ "A customer is upset about a late $200-300 order. They've been with us 2+ years and ordered frequently. How would you write an apology email?"

---

Safeguard 3: Using Enterprise/Private AI Tools

What it is: Using AI tools specifically built for data privacy (vs. public AI like ChatGPT).

Why it matters: Enterprise tools often have:

Data retention controls (they delete your data after processing)

Encryption

Compliance certifications (SOC2, HIPAA, GDPR-ready)

Usage restrictions (your company keeps your data)

Options:

**Claude API with private deployments** (Anthropic offers enterprise versions)

**ChatGPT Enterprise** (OpenAI's privacy-focused version)

**Internal company AI tools** (if your company deployed one)

**Open-source models** (self-hosted, maximum privacy)

Rule: For sensitive data, use enterprise tools, not public AI.

---

Safeguard 4: Limiting AI Access

What it is: Not using AI for tasks where it doesn't need access to sensitive data.

How to do it:

Do the work that requires sensitive data yourself

Use AI only for parts that don't require data

Have humans handle PII and regulated data

Example:

❌ Full task to AI: "Here's a customer list (with emails, addresses, phone numbers). Send personalized emails to our top 20 customers thanking them for loyalty."

✅ Split task:

You identify top 20 customers

AI writes a personalized thank-you template

You customize and send emails (preserving customer privacy)

---

Safeguard 5: Audit and Consent

What it is: Knowing where your data goes and getting permission first.

How to do it:

Read the AI tool's privacy policy

Check data retention (how long do they keep your data?)

Get approval from compliance/legal before using with regulated data

Document what data you've shared (for audit purposes)

Checklist:

[ ] I've read the AI tool's privacy policy

[ ] I understand where data is stored

[ ] I know how long the tool keeps data

[ ] I have approval to use this tool with this type of data

[ ] I've anonymized sensitive information

[ ] I'm using minimum necessary data

---

Compliance Quick Reference

If You Work With EU Resident Data

Regulation: GDPR

Key rule: Need lawful basis to process data; must honor data subject rights

With AI: Use GDPR-compliant tools; document processing; get consent or legal basis

Action: Ask compliance: "Is [AI tool] GDPR-approved?"

---

If You Work With US Patient Data

Regulation: HIPAA

Key rule: Can't share protected health information with non-compliant systems

With AI: Use HIPAA-compliant AI; minimal PHI exposure; signed Business Associate Agreement (BAA)

Action: Ask compliance: "Is [AI tool] HIPAA-compliant?"

---

If You Work With California Resident Data

Regulation: CCPA

Key rule: Residents have rights to know, delete, opt-out of data sales

With AI: Transparent about data use; document consumer rights

Action: Check if AI tool is CCPA-compliant; disclose in privacy notice

---

If You Work With Payment Information

Regulation: PCI-DSS

Key rule: Can't process or store raw card data outside secure systems

With AI: Never, ever paste payment card data into AI

Action: Use only PCI-compliant payment processors; never share raw card data

---

If You Work With Student Data

Regulation: FERPA

Key rule: Student records are protected; parents/students have access rights

With AI: Get school approval; ensure tool is FERPA-compliant

Action: Ask administration before using any AI with student data

---

Mission: Data Privacy Audit

The Task

1. Identify three tasks you currently do that involve some data

2. Classify the data — Is it PII? Financial? Medical? Company confidential? Public?

3. Assess the risk — If this data were exposed, what's the harm?

4. Check compliance — What regulations apply?

5. Plan safeguards — How would you use AI safely for this task?

Example task:

Task: Summarizing weekly expense reports

Data type: Financial + PII (employee names, amounts)

Risk: Medium (exposure could harm employee privacy, create audit issues)

Compliance: SOX (audit compliance), internal expense policy

Safeguards:

Anonymize employee names in AI prompt

Use company AI tool (not public ChatGPT)

Remove specific transaction details

AI only summarizes patterns, not individuals

Compliance team has approved this use

---

Deliverables

Privacy Audit Document:

`

Task: [Your task]

Data Type: [PII / Financial / Medical / Confidential / Other]

Risk Level: [High / Medium / Low]

Regulations: [GDPR / HIPAA / CCPA / Other / None]

Current Process: [How you do it now]

AI-Assisted Process:

Data sharing: [What data, how minimized?]

Tool choice: [Public AI / Enterprise AI / Private tool?]

Safeguards: [Anonymization / Minimization / Approval?]

Compliance: [Who needs to approve? What's the policy?]

Is this compliant? [Yes / Needs approval / No]

`

Keep this. You're building compliance awareness.

---

AI Coach: Privacy Is Risk Management

Here's what companies get wrong about AI and privacy: They think "Can I do this?" instead of "Should I do this?"

Something might be technically possible (pasting data into AI) but organizationally risky (violates your data policy).

The professionals who stay out of trouble:

1. Understand their data

2. Know their compliance requirements

3. Ask "What could go wrong?" before acting

4. Get approval when unsure

5. Document their choices

It's not paranoia. It's professionalism.

Key insight: Your company's legal and compliance teams exist for exactly this reason. When you're unsure, ask them. It's faster than fixing a breach later.

---

Reflection: What's Your Company's Policy?

You might not know your company's AI policy. Most don't have one yet.

Reflection questions:

Does your company have an AI use policy?

What tools are approved? What's forbidden?

Who should you ask about compliance?

What data is off-limits?

Action: Find out. Ask your manager or compliance team. Document it.

---

Portfolio Check

Portfolio principle: If your portfolio includes AI-assisted work, be prepared to explain the privacy safeguards you used.

This doesn't mean including detailed privacy docs. It means:

You anonymized any sensitive data

You used appropriate tools

You followed your company's policy

You'd feel confident defending your choices

This is ongoing practice.

---

Bonus Challenge

Read a privacy policy: Pick an AI tool you use (ChatGPT, Claude, Gemini, etc.). Read its privacy policy, specifically:

Where is data stored?

How long is it kept?

Can they use it for training?

What are user rights?

Understanding privacy policies trains you to make informed tool choices.

---

Key Takeaways

Sensitive data types: PII, financial, medical, payment, confidential, regulated

Risk assessment: Does it belong to me? Protected by regulations? Could harm someone? Company allows?

Safeguards: Anonymization, minimization, enterprise tools, limiting access, audits

Compliance: GDPR, HIPAA, CCPA, PCI-DSS, FERPA (understand which apply to you)

Privacy is risk management; ask compliance when unsure

Next: Lesson 8 explores When NOT to Use AI — decision frameworks for knowing when humans should handle tasks.