An airport authority finds staff pasting case notes that include Social Security numbers into a public AI chat tool. Which privacy control best stops that exposure?
Select an answer to reveal the explanation.
Short Explanation
Public chatboxes are not locked filing cabinets. If the note has an SSN, it stays out of that tool—period. Policy beats hope when sensitive civic data is on the line.
Full Explanation
Airport staff pasting case notes that include Social Security numbers into a public AI chat tool create a clear privacy breach pathway: sensitive identifiers leave the agency boundary into a consumer system with opaque retention, training, and subprocessors. The best control is a firm ban on pasting SSN-bearing or similarly sensitive case notes into public AI chat tools, backed by policy, training, and preferably technical DLP on managed devices. Convenience never overrides protection of municipal case data and traveler or employee PII.
Encouraging pasting of full case files to speed answers accelerates leakage at scale. Storing SSN-bearing notes inside public chatbot history by default retains sensitive data outside approved systems of record. Publishing case notes with SSNs on the airport website for "transparency" is an extreme confidentiality failure, not a privacy control.
Exam caveat: a written ban without monitoring or approved private alternatives pushes work underground rather than securing it. Staff need a sanctioned redaction or private-tenant path for legitimate drafting needs.
Operational check: publish the ban, provide an approved workflow, spot-check DLP alerts or approved-tool logs for SSN patterns, remediate teams that still paste sensitive identifiers, and verify departing contractors lose access to any AI workspaces that might hold residual notes.