Council to ban use of residents’ personal data in AI tools like ChatGPT

Alec Doyle, Local Democracy Reporter

Residents’ personal data will not be entered into AI systems like ChatGPT or Microsoft Copilot under proposed council policy.

Flintshire County Council’s Corporate Resources Overview and Scrutiny Committee has recommended that Cabinet adopt an AI policy that protects residents by restricting how and in which situations AI can be used by the authority.

Personal data will not be input into AI systems and each individual will be responsible for ensuring AI is used appropriately. The authority will also put safeguards in place to ensure it can end agreements if serious data breaches arise.

The policy seeks to ensure that Flintshire residents’ data is safeguarded while the authority finds ways to use AI to improve services and reduce costs – although officers did assure councillors the policy was not seeking to reduce staff numbers within the authority.

AI is a tool like any other piece of software,” said Lisa Smith, Flintshire Council’s IT Business Services Manager. “We can use it to be more productive, more efficient and to improve the service we deliver to our residents.

“But AI is not going to replace a social worker; it is not going to replace many – or any – of the roles that we have in the council at present. What it can and should be used for is to improve service delivery.

“As a council, we want to be able to use technology to help us with our wide‑ranging ambitions in relation to service improvement and transformation.

“In order to do that, we need a policy to make sure that any AI that we use can be used safely, securely and ethically.

“We have developed and devised a draft policy whose key principles include ethics, transparency, security, compliance and responsibility. It is very explicit in terms of what is permitted and what is prohibited, and it covers all use of AI tools, whether those are personal tools that a council officer or member may have or tools that the council owns and authorises.

“The policy ensures users are accountable for the content created when they use AI. No AI will be used to make decisions without human oversight or input.”

The policy only allows AI to be used for research and information gathering, drafting, generating and improving text or images, summarising documents or emails, recording, transcribing and summarising meetings, presentations and communications and data analysis.

Specifically no-one within the authority is permitted to put residents’ personal data into AI and it will not be used to automate decision-making at any level.

While officers and members accepted that the policy was not perfect, it was agreed that a policy was needed as without one it was likely that AI tools could be used in an unregulated way, presenting greater risks to the authority’s data protection.

“We are drafting a policy that tries to make sure that we are going to be safe,” said Chief Officer (Governance) Gareth Owens. “This is intended to be a very broad policy, to cover the whole of the organisation. It is a much‑needed policy now.

“Even if it is not perfect, it might be better to get more regulation in place. We have a simple ban (on AI) at the moment but it does not provide enough clarity.

“As we know, everybody is shoving AI into their products. You cannot get away from it and we need to be regulating that.”

The committee recommended that Cabinet adopt the policy and review it every six months to ensure it is up-to-date as the technology continues to develop at pace.