Slack is a cloud-based team communication platform developed by Slack Technologies, which has been owned by Salesforce since 2020. Slack has freemium and paid subscriptions. Slack’s primary userbase is businesses, and has functionalities primarily for businesses. It is also popular among many groups including Māori.
Recently and very discreetly Slack announced on their Privacy Principles: Search, Learning and Artificial Intelligence that it was using users data (feeds, information, emojis, etc) to train its Artificial Intelligence (AI). There were no other public announcements only users making public posts and media requests that were replied to.
Inside the policy, Slack stated that users can opt out, but that only the admin of the organisation of the Slack account can opt out. This creates major Māori Data Sovereignty, Intelectual Property Rights and Privacy issues for users and in particular risks for New Zealand company directors.
By not opting out of Slack using your data for its AI, it means that your data will be harvested and used to train the Slack AI to learn various tasks about your behaviour. You are then invited to pay a subscription to use the AI.
While at the time of writing, the data may not be significant, there are a number of risks to consider including:
- What Privacy Act and organisation policy implications exist?
- Will another discreet policy change again to be more intrusive?
- How anonymous is the data being harvested?
- Who has access to that data?
- What happens if your confidential company data is used in the AI?
- General Data Protection Regulation (European) Compliance Issues: There are concerns about whether Slack’s practices comply with GDPR regulations, which require explicit consent for data usage. The ambiguity around Slack’s consent mechanisms has led to doubts about its adherence to these regulations.
Furthermore, it should be noted that by using Slack which is an American based company, that the following American laws are applicable to all New Zealanders regardless of the AI usage:
- The Clarifying Lawful Overseas Use of Data Act (CLOUD Act) (H.R. 4943)
- The USA PATRIOT Act (commonly known as the Patriot Act)
The Stored Communications Act - US Foreign Intelligence Surveillance Act (FISA 702)
My recommendation is to read the above policy and ‘opt out’ to ensure you are not breaching the Privacy Act, review your organisation policies in regards to Intelectual Property, Privacy and data storage.
Leave a Reply