Data Protection

The Information and Privacy Commission (IPC) of New South Wales has taken a significant step in addressing the privacy risks associated with generative AI tools in Australia. Their newly released guidance aims to assist public sector agencies in navigating the complexities of privacy obligations under the Privacy and Personal Information Protection Act 1998 when utilizing tools like ChatGPT, Gemini, and others.

Generative AI has the potential to enhance workplace efficiency through tasks such as document analysis and process automation. However, the IPC warns that these tools can inadvertently expose personal or health information, leading to serious privacy risks. Agencies are urged to implement measures like privacy impact assessments and continuous monitoring to mitigate these risks effectively.

Recent regulatory developments highlight the increasing scrutiny surrounding the use of generative AI, particularly in the realm of image processing. On January 13, 2026, the Spanish Data Protection Authority (Spanish DPA) issued a formal notice regarding the legal and privacy risks associated with uploading, transforming, or generating images of individuals using AI tools. This warning serves as a crucial reminder for businesses and individuals alike about the importance of adhering to privacy regulations when utilizing advanced technologies.

The rapid advancements in artificial intelligence (AI) technologies, particularly in generative AI, have underscored the urgent need for regulatory frameworks that address data protection and cybersecurity. As the European Union moves forward with its AI Act, countries like Trkiye are also beginning to recognize the importance of establishing guidelines to safeguard personal data in the context of AI applications. The recent Generative Artificial Intelligence Guideline published by Trkiye’s Personal Data Protection Authority (DPA) serves as a crucial step in this direction, emphasizing the ethical and legal considerations that must be taken into account.