Information entered into a third-party tool has been disclosed to that provider. Privacy obligations follow it, so customer and employee information needs the same care as any other transfer to a processor.
The framing that resolves most of this
Typing into a chat window feels private, like a notepad. It is not. It is sending information to a company that processes and may retain it.
Which means the question is not whether it feels sensitive. It is whether you would email that same material to an outside supplier without thinking about it.
Under Canadian privacy legislation, personal information transferred to a third party for processing remains your responsibility. The transfer does not move the obligation.
So a business pasting a customer list, a set of invoices, or a client's file into a tool has made a disclosure it is accountable for.
What should not go in
- Customer personal information, including names with addresses, phone numbers or details of their situation.
- Employee information, including performance matters and anything health-related.
- Anything under a confidentiality obligation, whether or not it is personal.
- Payment details, which should not exist in a form you could paste.
- Credentials, including anything from a configuration file.
- Unreleased commercial material, such as pricing strategy or a bid in progress.
The third catches people out. A client agreement frequently restricts disclosure to third parties, and a tool is a third party even if the person using it is you.
The fifth happens accidentally, when somebody pastes a whole file to ask what an error means and the file contains keys.
What is generally fine
Being proportionate rather than alarmed.
Your own published material. Generic questions about how something works. Drafts containing no identifying detail. Anonymised descriptions of a situation. Your own writing, which is yours to share.
Most day-to-day use falls here, which is why the sensible position is a boundary rather than a prohibition.
The anonymising step
Frequently all that is needed and rarely done.
A question about a difficult customer situation does not require the customer's name, address, or invoice number. Describe the situation generically and the answer is identical.
Same for a technical problem: the error, not the file with the credentials. Same for a document: the structure, not the client's version.
Two cautions. Removing the name is not always enough in a small market, where a description can identify somebody as effectively as a name. And an anonymised set can be re-identifiable when combined with what the recipient already holds.
For most small business use, generic description is sufficient and takes seconds.
What to check about the tool itself
- Whether your input is used for training, and whether that can be turned off.
- How long input is retained, and whether you can delete it.
- Where it is processed, since that affects which regimes apply.
- Whether a business tier offers different terms from the consumer one.
- Who can see it internally at the provider.
- What the terms actually say, rather than what the marketing page says.
The first and fourth are related and matter most. Consumer and business tiers of the same product frequently have materially different data terms, and businesses use the consumer one without checking.
The regulated cases
Where general caution is not enough.
Health information, legal client information, financial client information and anything covered by a professional obligation carry their own requirements, and several professional bodies have issued guidance on using these tools.
If you operate under a professional regulator, that guidance is the reference and it may be more restrictive than general privacy law.
The same applies to information belonging to a client who is themselves regulated, since their obligations flow to you through your agreement with them.
A short policy is enough
For a small team, half a page.
Which tools are approved. What must never be entered. What to do instead, meaning anonymise. Who to ask when unsure.
The point is not the document. It is that staff have been told, because the default assumption is that a chat window is private and nobody corrects it.
Most incidents in this area are somebody being helpful and quick rather than anybody being careless.
What you hold and where it lives, which this adds to, is covered in knowing what customer data you actually hold.
Frequently asked questions
Why is pasting into a chat window a disclosure?
Because it sends information to a company that processes and may retain it. Under Canadian privacy law, information transferred for processing remains your responsibility.
What should never be entered?
Customer and employee personal information, anything under a confidentiality obligation, payment details, credentials, and unreleased commercial material.
What catches people out?
Client agreements restricting disclosure to third parties. A tool is a third party even though the person using it is you.
What is generally fine?
Your own published material, generic questions, drafts with no identifying detail, and anonymised descriptions. Most everyday use falls here.
Is removing the name enough?
Not always. In a small market a description can identify somebody as well as a name, and anonymised material can be re-identifiable in combination.
What should I check about the tool?
Whether input is used for training and can be turned off, retention and deletion, where it is processed, and whether a business tier has different terms.
West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.
Nobody has told your staff what not to paste in?
We write the half page that covers it, which is usually all that is missing.
Start a Conversation