AI tools and the NZ Privacy Act: a checklist

The checklist

1. What personal information goes in? Names, emails, notes about customers or staff. Use less where you can.
2. Why are you using it? Use personal information for the purpose you collected it for, and say so if that purpose is new.
3. Have you told people? Your privacy statement should say you use AI tools and what for.
4. Where does it go? Know which provider processes it and in which country, and whether that provider protects it to a standard comparable to New Zealand's.
5. Is it kept or used for training? Check whether the provider stores what you send, for how long, and whether it trains its models on it.
6. Is it secure? Use strong sign-in, give each person and tool only the access it needs, and remove access when someone leaves.
7. Does a person check the result? AI makes mistakes. Review anything before it goes to a customer or affects someone.
8. Can you correct it? If someone asks to see or correct information about them, you need to be able to find it.
9. Is there a record? A log of what the tool did, and who approved it, helps when something goes wrong.
10. Did you think it through first? For bigger projects the Commissioner suggests a privacy impact assessment before you start.

How JENA handles these

• A person approves: nothing is sent, posted or paid until you approve it.
• A record: every action is in the audit log, with who approved it.
• Least access: you choose which apps each AI employee can use.
• Where data is kept: JENA's database and online service run in Singapore. The JENA privacy policy lists every provider.

Mini NOVA takes one screenshot only when you send a question, and its server keeps no screenshot, question or answer. See Mini NOVA privacy and security.