Samsung workers accidentally leak confidential data via ChatGPT: Implications for PDPA compliance in Singapore

Samsung workers accidentally leak confidential data via ChatGPT: Implications for PDPA compliance in Singapore

“Employees are considered the weakest link in an organisation’s cybersecurity”- this phrase has remained true since time immemorial especially if there are no policies in place to regulate possible mistakes in the workplace. For the longest time now, the PDPC has repeatedly reminded organisations who suffered hefty penalties before to check on their employees to prevent accidental breaches of personal data from happening. This is because the PDPC does not tolerate good faith mistakes, as long as there is a breach, a financial penalty can be given. 

The point of this is, an employee’s mistake could be detrimental to the organisation. By accident, they can cause the organisation to be penalized a hefty fine, or worst case scenario is, it could cause reputational damage which could lead to losing the trust of its customers. Moreover, the employee’s mistake could also give up the trade secrets that makes a company ahead of its competitors. This is what happened with Samsung, where its engineers accidentally revealed sensitive information at its expense. 

Samsung workers accidentally leak confidential data via ChatGPT

Workers at Samsung who utilized ChatGPT, an AI writer, inadvertently disclosed confidential information and trade secrets. Engineers were permitted by the semiconductor division of the company to use the AI writer to correct errors in their source code. However, the employees entered sensitive information, such as the source code for a new program, notes from internal meetings, and information about their hardware.

In less than a month, three instances of employees disclosing sensitive information via ChatGPT were documented. Due to the fact that ChatGPT retains user input data to further train itself, Samsung’s trade secrets are now effectively in the hands of OpenAI, the company behind the AI service. This incident raises questions about the hazards and benefits of utilizing artificial intelligence (AI) services such as ChatGPT, as well as the need for businesses to implement adequate data protection measures.

AI services such as ChatGPT can be immensely beneficial for streamlining and optimizing business operations. However, there are hazards associated with these services. For instance, the data entered into the AI service is stored and utilized to train the AI algorithm further. If the inputted data contains sensitive or confidential information, it may be disclosed or accessed by unauthorized parties.

Companies must implement appropriate data protection measures to prevent incidents like the Samsung ChatGPT leak. Companies should ensure, for instance, that employees are trained in data protection and are aware of the dangers associated with the use of AI services. In addition to implementing access controls and other security measures to prevent unauthorized access to the data inputted into AI services, businesses should also implement access controls.

How a DPO can help

Your appointed DPO can work with you on ensuring that there will be policies in place to prevent unwanted data breach, especially if your organisation also handles personal data. 

A Data Protection Officer (DPO) oversees data protection responsibilities and ensures that organizations comply with the Personal Data Protection Act (PDPA). Furthermore, every Organization’s DPO should be able to curb any instances of PDPA noncompliance and data breaches as it is the officer responsible for maintaining the positive posture of an organization’s cybersecurity.

DPOs complement organizations’ efforts to ensure that the organisation’s methods of collecting personal data comply with the PDPA. It also ensures that policies are set in place to make sure that there will be no instances of data breaches in the future.

Don’t wait any longer to ensure your organisation is PDPA compliant. Take our free 3-minute PDPA Compliance Self-audit checklist now, the same “secret weapon” used by our clients to keep them on track. Upon completion, we will send you the results so you can take the necessary action to protect your customers’ data. Complete the free assessment checklist today and take the first step towards protecting your customers’ personal data.