Excessive Collection and Retention of Interaction Data
互動資料過度蒐集與保留
When employees use an external generative tool to process internal documents at work, and the content is retained by the service provider; due to unmitigated control gaps, a subsequent inventory reveals that substantial business information has left the organization's control, with no way to compel complete deletion or confirm whether it has been incorporated into training, triggering compliance exposure and operational reputational costs.
Framework Mappings
Risk Treatment & Implementation Guidance
Establish an AI tool-use policy specifying whether internal documents may enter external services and the exception-approval process; Contractually bind approved services on retention, training use and deletion; Provide enterprise editions or proxy gateways under data minimization to replace ad-hoc use of public services