The topic of data protection is very important in Europe, according to the impression gained from the political developments of recent years and the resulting laws. Nevertheless, the study concludes that there is a major data protection risk in German companies when dealing with freely accessible AI. The respondents also feel that there has been too little education of employees on the subject to date.
One question put to managers was: Does your company have specific guidelines or restrictions for handling internal or customer-specific data and the use of open AI systems? Almost two thirds of respondents (62%) answered this with “No”. Only 24% stated that they had such guidelines. A further 13% could not provide any information or were not sure.
More than half of respondents use freely accessible AI solutions at work
31% of the study participants stated that internal AI solutions are already firmly implemented in their company. However, working with freely accessible AI solutions such as ChatGPT or Claude.ai is much more common. 58% of respondents said that they use such solutions for professional purposes. The most common applications were proofreading or editing texts (68%) and gathering ideas or information (54%). However, more than a quarter of respondents (26%) also use these systems to process data (26%). What does this mean for data protection?
Sensitive internal data is regularly shared with open AI solutions
When asked how often they shared internal company data or information or customer data or information with open AI solutions, 8% said they did so daily. 21% did so several times a week and 29% at least once a month. “This represents a significant security risk for German companies,” emphasizes Kishor Sridhar. Especially as only 24% of respondents stated that there were clear guidelines for handling data when using freely accessible AI solutions. 23% of participants did not feel sufficiently informed about data protection when using freely accessible AI solutions.
However, there is at least a basic awareness of this topic among managers. This is because 34% admitted that they have deliberately not shared sensitive data and information with freely accessible AI systems because they had concerns about data protection.
"Basically, this study shows that internal guidelines and GDPR requirements are not sufficient, as even the most sensitive company and customer data is passed on to freely accessible, external AI solutions without much care,” summarizes Sridhar. “This data protection problem is exacerbated by the fact that it is not clear how AI solutions process data overall. The results of the survey underline the need for increased efforts on the part of companies and legislators. Clear guidelines and regular reviews are needed to ensure that all companies are taking the necessary steps to comply with data protection regulations."
