Aussie employees are using ChatGPT as their confidant and telling it things they might be reluctant to say out loud. It’s created a “treasure trove” of information, with people not realising it could be used in workplace investigations if they find themselves in a dispute with their bosses.
More than 13 million Aussies are now using AI tools like ChatGPT, Gemini, Copilot and Claude, with ChatGPT the most popular of the bunch. Along with people using personal accounts, some Aussie businesses have introduced company-managed ChatGPT accounts for their employees.
Digital forensics expert and founder of Conseek, Blair Joynson, told Yahoo Finance the benefit of a company account was that your company data isn’t used to train AI models and your data is secure. But it also means the company owns all of that data.
RELATED
“It’s the same as if you have a phone that is a company phone. If you’re using it for personal material, the company owns everything that comes onto that phone,” Joynson said.
“So if you’re using Telegram, you’re using WhatsApp, you’re Facebook Messenger and all this sort of stuff, it’s saving messages to that phone. That local data, technically, is discoverable by the company.”
Joynson is a former NSW police detective and now has a business that helps lawyers and organisations use digital evidence in investigations and proceedings.
After an incident happens, Joynson said people will typically seek advice from ChatGPT, using it as a mediator or to figure out what to do.
Joyson said people often seek advice from ChatGPT after an incident, which could actually help them. · Source: Conseek
This allows investigators to get the person’s knowledge and understanding of an event immediately after the incident, even if they aren’t willing to be truthful to an investigator.
Joynson said this information could only be obtained in certain circumstances. For private accounts, it is done via the account holder’s consent.
“If you sign into something with your work email, but it’s a personal account on that platform, I personally don’t think it’s ok for that company to get that data,” Joynson said.
“I don’t think anybody has ever done it as of yet. I think it’s kind of too new as well. But if it was a company account, then it’s company-managed and they can.”
Employees using ChatGPT to help plead cases
Conseek uses specialist tools to forensically extract information, which isn’t available to your average HR or IT department.
Joynson said he hasn’t seen a matter yet where the organisation has sought to access their employee’s ChatGPT entries. Instead, it’s actually been employees seeking to use the data as evidence to help plead their case.
Story continues
“When something happens, after an incident, people are asking and seeking advice. Typically, they don’t record notes,” he said.
“So people want to use those entries that they’re asking as notes in proceedings. To show this was a legit problem that I had at this time or this was my understanding, and these are actually notes that I’ve recorded.”
ChatGPT entries can only be obtained in certain circumstances and you’ll need the account holder’s consent for private accounts. · Source: Getty
They are then able to use ChatGPT entries as “contemporaneous notes”, like you would with text messages.
But as ChatGPT becomes more commonplace in workplaces, Joynson expects organisations could also seek to use the data in matters as they do with other company-managed tools like emails or Teams messages.
“I think the main problem is going to be just how voluminous it is. There’s so much data … You actually need proper digital forensics tools to help to go through it and do the discovery,” he said.
Aussies urged to check company policies
Digital work activity is something that is increasingly being tracked, with the pandemic seeing an explosion in demand for surveillance technology that can track employees through screenshots of their computer, keystrokes, mouse movements, and even their webcams and microphones.
The Office of the Australian Information Commissioner notes that an employer monitoring staff use of email, internet and other computer resources would generally be allowed if they’ve told you about the monitoring. If they keep a record of their monitoring, then the Australian Privacy Principles may apply.
When it comes to what data is accessible, Joynson said the specific policies and procedures of the organisations and agreements were important.
“A lot of the time, if you have a corporately managed device, read the terms, read what the conditions are, what the policies are, what the procedures are in relation to that and what is available,” Joynson said.
Joynson said it was also important to understand where there data was being stored and if it was being backed up anywhere.
“It’s important to know for companies where that data is being stored,” he said.
“Also, it’s important for employees to know where their data is being stored because if it is company-managed, then it’s discoverable by the company.”
Get the latest Yahoo Finance news – follow us on Facebook, LinkedIn and Instagram.