The Dutch Autoriteit Persoonsgegevens AP) warns of an increase in data breaches caused by the use of AI chatbots such as ChatGPT, Claude, and Gemini. According to the privacy watchdog, dozens of reports have been received this year from organizations that unknowingly shared sensitive information with these systems, writes Het Financieele Dagblad.
A recent incident at the municipality of Eindhoven shows how quickly things can go wrong: during an internal investigation, it emerged that employees had entered personal data such as CVs, youth care documents, and internal reports into public chatbots. The municipality has since blocked access to such AI services and asked OpenAI to delete the files.
According to the AP and privacy lawyer Stephan Mulders, many of these leaks occur because employees experiment with free AI tools on their own initiative, also known as"shadow AI."These versions store the data entered and may use it to train models, which means that confidential details can reappear in responses.
Companies can limit this risk by blocking websites offering free AI services, providing secure alternatives, and establishing clear guidelines. Mulders points out that since the introduction of the AI Act, organizations are also required to provide training on the safe use of artificial intelligence. However, he expects that raising awareness will take time—just as it did when the GDPR was introduced.
