Latest / MBA Training AI / LLM data privacy: the retention settings legal misses

Transcript

LLM data privacy: the retention settings legal misses · MBA Training AI

• 0:00
  Host: Welcome to the Leaders Insights podcast.
• 0:07
  Host: Today's episode, data privacy, when everything goes to a model, the blind spots your legal
• 0:12
  Host: team isn't catching.
• 0:14
  Host: Everyone's got a data privacy policy.
• 0:17
  Host: So why do you keep saying most companies are exposed and don't know it?
• 0:20
  Expert: Because a policy governs what you meant to do.
• 0:23
  Expert: It doesn't govern what your architecture actually does.
• 0:26
  Expert: Combined with language models, the systems that generate text by predicting the next
• 0:30
  Expert: word from everything they've seen, the architecture leaks in ways the policy never anticipated.
• 0:36
  Host: Give me a concrete leak, not a hypothetical.
• 0:39
  Expert: Samsung 2023.
• 0:42
  Expert: Engineers pasted proprietary source code into chat GPT to debug it.
• 0:46
  Expert: That code became part of a conversation history sitting on a third party's servers.
• 0:51
  Expert: No policy said, don't paste our chip designs into a public model.
• 0:55
  Expert: Nobody thought they had to say it.
• 0:57
  Expert: That's the blind spot.
• 0:59
  Expert: The harm happened in a behavior no framework had a line for.
• 1:02
  Host: But that's a training mistake, right?
• 1:04
  Host: Tell people not to paste secrets.
• 1:07
  Host: Problem solved.
• 1:08
  Expert: That's exactly the compliance checkbox thinking that gets you burned.
• 1:11
  Expert: You can ban the obvious paste.
• 1:13
  Expert: You can't ban the thousand quieter versions.
• 1:16
  Expert: Your customer support agent summarizes a ticket that contains a home address.
• 1:20
  Expert: Your sales tool enriches a lead by feeding it into a model.
• 1:24
  Expert: Every one of those is a data transfer.
• 1:26
  Expert: And most companies have zero visibility into where that data physically lands.
• 1:31
  Host: So the lesson the good operators already learned, what is it?
• 1:35
  Expert: Data privacy is a property of your plumbing, not your paperwork.
• 1:39
  Expert: The best team stopped asking, are we compliant?
• 1:42
  Expert: And started asking, what, where does this data actually go?
• 1:45
  Expert: And can I prove it came back deleted?
• 1:48
  Expert: Those are different questions.
• 1:50
  Expert: The first one a lawyer answers.
• 1:52
  Expert: The second one only an engineer can.
• 1:54
  Host: That sounds like you're telling legal teams they're useless here.
• 1:57
  Expert: Not useless, out-ranged.
• 1:59
  Expert: A privacy lawyer reads contracts.
• 2:02
  Expert: But the exposure lives in retention settings in whether your vendor uses your inputs for
• 2:06
  Expert: training in whether embeddings, the numerical fingerprints a model makes of your text, can
• 2:12
  Expert: be reversed back into the original data.
• 2:14
  Expert: Yes, that's a real attack.
• 2:17
  Expert: Vendors have reconstructed readable text from embeddings people assumed were anonymous.
• 2:22
  Expert: Your lawyer has never heard the word embedding, and that's the gap.
• 2:26
  Host: Okay, but the vendors all swear they don't train on your data now.
• 2:30
  Host: Open AI, anthropic, the enterprise tiers.
• 2:33
  Host: Isn't this solved?
• 2:34
  Expert: On the enterprise tiers, mostly, if you configure them right.
• 2:39
  Expert: And that if is doing enormous work.
• 2:43
  Expert: The default consumer product is a different animal.
• 2:46
  Expert: But here's the part vendors won't put on a slide.
• 2:49
  Expert: We don't train on it is not the same as we don't store it.
• 2:53
  Expert: Data can sit in logs for abuse monitoring for 30 days.
• 2:57
  Expert: In a regulated industry, 30 days of retained patient records you didn't authorize is a
• 3:02
  Expert: reportable breach waiting to happen.
• 3:04
  Host: You mentioned regulated industries.
• 3:06
  Host: Is anyone actually getting fined for this yet?
• 3:09
  Host: Or is it all theoretical fear?
• 3:11
  Expert: The company's regulator fined OpenAI 15 million euros in late 2024 over exactly this,
• 3:18
  Expert: processing personal data without a proper legal basis and weak age checks.
• 3:23
  Expert: That wasn't a leak.
• 3:24
  Expert: That was the architecture and the defaults being wrong from the start.
• 3:28
  Expert: The enforcement is here.
• 3:30
  Expert: It's just not evenly distributed, and companies are betting they won't be first.
• 3:34
  Expert: Bad bet.
• 3:35
  Host: So a mid-sized company hears all this and panics.
• 3:38
  Host: What do they actually do Monday morning?
• 3:40
  Expert: They don't panic, they map.
• 3:43
  Expert: One exercise, list every place employees or systems send data to a model.
• 3:48
  Expert: And for each one, write down three things.
• 3:51
  Expert: Where it's stored, how long, and whether it trains the model.
• 3:56
  Expert: Most companies can't fill in that grid for even half their tools.
• 4:00
  Expert: That empty grid is your risk register.
• 4:02
  Host: And if they only do one thing this week?
• 4:04
  Expert: Find your five highest volume model integrations and check the data retention setting on
• 4:09
  Expert: each.
• 4:10
  Expert: Set the marketing page, the actual configuration in the account.
• 4:13
  Expert: I'd wage your money at least one is on a default you never chose, retaining data you
• 4:18
  Expert: never meant to hand over.
• 4:20
  Expert: Fix that one setting today, and you've closed more real exposure than a quarter of policy
• 4:24
  Expert: revisions ever will.
• 4:26
  Host: Done.
• 4:27
  Host: Want to know where you actually stand?
• 4:29
  Host: Take the AI self-assessment at MBA-training.com.