Navigating the AI Frontier : Part 1: Art, Identity, and Fairness: AI in Our Creative and Daily Lives

In a nutshell (TL;DR)...

Artificial intelligence offers exciting creative possibilities, but it also poses serious risks to human creators, individual privacy, and societal fairness. Generative AI tools frequently scrape copyrighted artwork, books, and music without permission or compensation, threatening artist livelihoods and flooding digital markets. Meanwhile, voice cloning and digital replicas enable identity theft and likeness exploitation without clear legal protections. Additionally, AI systems can absorb and amplify historical human biases, leading to unfair decisions in hiring, healthcare, and law enforcement. To navigate this frontier responsibly, we must protect human creative rights, advocate for algorithmic transparency, and remain vigilant media consumers.

It’s been all over the news lately. AI is going to kill us all. So I decided to think about the different ways in which AI can negatively impact us and what we could possibly do about it. In this first blog, let’s look at a subject that concerns my arty pursuits and that’s how AI is encroaching on the creative efforts of humans by pretty much doing it for us….

Welcome to the AI Creative Era

Today, AI is everywhere, generating vibrant digital paintings, drafting essays, composing melodies, and answering complex questions in seconds. It is an extraordinarily exciting tool that expands what human imagination can achieve. At the same time, like any powerful breakthrough, it requires gentle care, clear understanding, and thoughtful guardrails. As we step into this new creative era, we must ask: how do we celebrate technological magic while respecting the human skill, dedication, and legal rights behind the data that makes it all possible?

However, while AI tools offer thrilling new capabilities, they also introduce a subtle tug-of-war between high-speed digital automation and fundamental human creative rights.

The Creative Dilemma: Art Scraping, Copyright, and Style Theft

Behind every generative AI model sits a massive mountain of training data. To teach these systems how to draw, write, or compose, automated software tools known as "web crawlers" scan publicly available websites, databases, and digital platforms. They harvest books, news articles, photographs, artwork, and sound recordings, storing multiple digital copies to train complex machine learning algorithms.

This process frequently occurs without asking for the creator's permission, without giving credit, and without paying a licensing fee. In the UK copyright framework, this creates a significant legal issue. Under the Copyright, Designs and Patents Act 1988 (CDPA), making digital copies of protected works engages the restricted act of reproduction. While Section 29A of the CDPA provides a specific exception allowing automated text and data mining (TDM), that exception applies strictly to non-commercial research. Commercial AI developers building models for market deployment cannot legally rely on Section 29A. Proposals to introduce a broad commercial TDM exception, or to allow unlicensed scraping under an "opt-out" scheme, threaten to strip creators of their primary lever for fair compensation.

For creative workers, this creates a profound dilemma. Human artists spend years, sometimes a lifetime, honing their craft, only to find that automated web crawlers ingest their catalog without consent, allowing software to imitate their work in seconds and flood the market.

To understand the contrast between human artistic effort and machine outputs, consider the following comparison:

Human Creative Value	AI-Generated Output Characteristics
Skill & Dedication: Built on years of personal effort, emotional experience, and deliberate practice.	Instant Pattern Assembly: Generated in seconds by synthesizing statistical patterns from massive datasets.
Unique Expression: Produces original, intent-driven works rooted in human culture and storytelling.	Style Imitation: Capable of generating close replications or "in the style of" imitations without personal understanding.
Economic Livelihood: Relies on paid commissions, royalties, and explicit licensing to sustain a career.	High-Volume Output: Produces vast quantities of low-cost content (sometimes called "AI slop") that can crowd out human work.

The financial and professional impact on human creators is backed by striking evidence:

• Economic Powerhouse at Risk: The UK creative industries contributed £124 billion in Gross Value Added (GVA) to the economy in 2023 (projected to reach £141 billion by 2030) and employ 2.4 million people. By comparison, dedicated UK AI firms generated £11.8 billion GVA in 2024. Sacrificing a proven creative sector for speculative AI gains risks undermining a vital economic engine.

• Loss of Artist Livelihoods: Sector surveys reveal that 58% of surveyed photographers have lost work to generative AI, while 86% of authors report decreased earnings, leading 57% of authors to feel that writing is no longer a sustainable career.

• Streaming Market Dilution: Music streaming platforms face an unprecedented surge of fully AI-generated tracks—rising from 30,000 to 60,000 AI tracks uploaded per day on platforms like Deezer (representing 39% of all daily uploads)—which dilutes royalty pools meant for human musicians.

As automated scraping captures the written and visual work of human creators, an even more personal question arises: what happens when technology captures our physical identity and voice?

The Digital Doppelgänger: Voice Cloning and Likeness Rights

Beyond taking written or visual works, generative AI can now capture the distinct characteristics of a human being, their physical appearance, facial expressions, and vocal tone. Using short audio snippets or a handful of photos, software can generate highly realistic "digital replicas" or "deepfakes" that make a person appear to say or do things they never actually did.

> What is a "Digital Replica"? A Digital Replica is an AI-generated copy of an individual's unique voice, face, or physical appearance. When deployed without permission, digital replicas strip individuals, from professional actors and voice artists to everyday citizens, of control over their identity and livelihood. Under current UK law, there is a distinct legal gap: there is no standalone "personality right" or "voice likeness right," leaving creators unable to easily stop others from commercializing their personal persona.

International policy offers clear models for closing this gap. For instance, Denmark has proposed Copyright Act amendments specifically creating statutory protections against unauthorized digital replicas of an individual's physical characteristics and artistic performances (while preserving traditional carve-outs for parody and political satire). Similarly, in the United States, proposed federal legislation like the NO FAKES Act, alongside state-level publicity rights, aims to give every individual explicit legal control over their voice and visual likeness.

For voice artists and performers, digital cloning means a single recording session can be scraped once and endlessly reused by software without further consent or payment. For everyday individuals, it opens the door to identity theft, harassment, and public misrepresentation.

Losing control over our creative style and personal likeness is deeply concerning; even more troubling is when hidden algorithms make automated, biased choices about our actual lives.

The Invisible Mirror: Algorithmic Bias and Real-World Impact

Artificial intelligence does not think or feel on its own; it learns by analyzing human data. If the data fed into an AI system contains historical unfairness, societal prejudice, or narrow representations of certain groups, the AI learns those exact patterns. When deployed, the software acts as an "invisible mirror," reflecting and amplifying human bias under the guise of neutral mathematical logic.

When algorithmic bias goes unchecked, it causes real-world harm across everyday society:

1. Applicant Tracking Systems (Employment): Automated hiring software trained on historical corporate resume data has been shown to discriminate based on gender, penalizing job candidates whose resumes include female-associated terms or institutions because historical tech hiring skewed heavily male.

2. Healthcare Diagnostic Tools (Medicine): Clinical decision models trained primarily on medical data from majority demographic groups return lower diagnostic accuracy for historically underserved populations, leading to misdiagnoses or inadequate treatment recommendations.

3. Predictive Policing Tools (Justice): Law enforcement algorithms trained on historical arrest statistics risk disproportionately targeting systemically marginalized communities, creating a self-fulfilling feedback loop that over-polices specific neighborhoods regardless of actual individual behavior.

Understanding how algorithms can reflect our past mistakes is the first step toward taking control of our digital future.

Reader’s Empowerment Guide: Spotting Signs & Taking Action

You don't need a degree in computer science to spot the presence of AI risks in your daily life. Use this simple two-section checklist to evaluate online media and take practical steps to protect human creativity and fairness.

Section A: Signs to Spot

• Generic 'In the Style of' Content: Artwork, illustrations, or music tracks that copy a specific living artist's distinctive style without citing or linking to the human creator.

• Unnatural Audio or Visual Glitches: Subtle unnatural lip movements, robotic cadence changes, or strange audio artifacts in video clips that might indicate a cloned voice or digital replica.

• Unexplained Automated Decisions: Receiving an instant rejection on a job application, loan request, or service evaluation without clear, understandable reasons or human review options.

Section B: Practical Mitigation Strategies

• Support Human Creators: Actively seek out, buy, and subscribe to original books, news publications, music, and artwork directly from human creators and artists. Don’t read this blog! Read something else!

• Verify Information Sources: Cross-check surprising, controversial, or striking digital images and voice recordings against established, primary news outlets before sharing them.

• Demand Organizational Transparency: Support platforms, institutions, and businesses that clearly label AI-generated content and publish ethical AI governance practices.

• Exercise Privacy Options: Utilize privacy controls on websites and social media platforms to opt out of having your personal posts, images, and data scraped for public model training.

In this first post, we've explored how AI touches our creative expressions, our individual identities, and our rights to fair treatment. But what happens when these powerful tools are turned directly toward our wallets, our private data, and our jobs? Join us in Part 2: Digital Safety, Deepfakes, and Data: Protecting Your Identity and Wallet , where we will unpack online scams, data scraping, workplace shifts, and how to build your personal cyber-detective toolkit!

The Great AI Memory Bank: How Your Data Gets Consumed (and How to Keep It Private)

In a nutshell (TL;DR)

To secure your data, consider these strategies:

• Anonymization Pipelines: Replace sensitive identifiers with placeholders (e.g., [NAME]) before data leaves your network.
• Zero Data Retention (ZDR): Mandate that providers process prompts in memory only, without saving logs or using data for training.
• Local Models & Secure Orchestration: Keep data within corporate firewalls by running local models or utilizing secure protocols like MCP.
• Targeted Encryption: Encrypt or mask sensitive prompt segments, such as using unique emoji sequences, to keep text unreadable to the provider.

It's been two weeks since I last posted! But I am back after the day job got in the way with a major project and a tight deadline. Last post I talked about the dangers of copy and paste and how easily information can end up in the hands of the LLMs

Whenever we type a prompt into an AI assistant, it is easy to imagine our words vanishing into the digital ether the moment we hit 'send'. But Large Language Models (LLMs) have incredibly sticky memories. While it is easy to accidentally slip sensitive data into an AI tool, it is equally important to understand what the AI actually *does* with that information once it has it. 

LLMs are designed to consume, process, and generate text, which means treating them like a private diary or a secure vault can lead to unintended, and highly public, consequences. Here is a look at how your confidential information gets consumed and redistributed by AI, and the best practices you can use to keep your private data safe.

The Consumption and Redistribution Cycle

When you feed Personally Identifiable Information (PII) or corporate secrets into an external LLM, you are exposing that data to several hidden risks:

Data Logging and Storage

Many AI providers log user prompts to monitor for abuse, debug their systems, or improve their overall services. Once your confidential data is stored on a third-party server, it becomes vulnerable to unauthorized access or potential data breaches on the provider's end.

Training Data Contamination

The prompt you submit today could inadvertently become the training data of tomorrow. Even though some enterprise providers have strict policies, there is always a baseline risk that PII from user prompts might be absorbed to further train or fine-tune future versions of the models.

Output Leakage and Regurgitation

LLMs are known to memorize information from their pre-training phases as well as from prompts processed during active inference. This can lead to a phenomenon where the model unintentionally regurgitates your sensitive information verbatim in its responses to completely different users. In fact, the OWASP Top 10 for LLMs lists "Sensitive Information Disclosure" as a critical vulnerability, noting that poor input handling can cause models to leak PII, business strategies, or system credentials directly into the public domain.

Defending Your Data: Precautions and Safe Methods

Fortunately, you do not have to unplug your routers and swear off AI entirely. There are several highly effective precautions and architectural strategies you can implement to interact with LLMs safely:

1. Build Anonymization and Mapping Pipelines

The most practical defense is to scrub the data before it ever leaves your network. By using tools like Named Entity Recognition (NER), you can automatically identify sensitive entities and replace them with generic placeholders—for example, swapping a real name and email for `[FIRSTNAME]` and `[EMAIL]`. This allows the LLM to understand the context of the prompt without ever seeing the raw data. On your end, you keep a secure, temporary map of these placeholders. When the LLM replies, a mapping-based de-anonymization module simply swaps the real information back in, ensuring 100% accuracy without exposing the data to the cloud.

2. Demand Zero Data Retention (ZDR)

If you rely on cloud-based AI vendors, mandate a "Zero Data Retention" agreement. Under ZDR, the provider processes your prompt and immediately returns the response without writing your request to any persistent storage, training queues, or logs. The data exists only in memory for the exact duration of the API call, effectively shifting your risk profile from uncertain to bounded.

3. Utilize Local Models and Secure Orchestration (e.g., MCP Servers)

For the highest level of control, organizations can run fine-tuned, smaller language models entirely within their own corporate firewalls, ensuring data never leaves the internal infrastructure. When connecting AI to internal databases, utilizing secure architectural patterns like the Model Context Protocol (MCP) can help safely orchestrate how context is provided to the AI without exposing raw data to public endpoints.

4. Targeted Encryption

For highly regulated environments, researchers are developing targeted encryption techniques. This involves encrypting only the sensitive sub-parts of a prompt, sometimes even translating them into unique sequences of emojis (like *EmojiCrypt*), so the text remains unreadable to humans and providers, but retains enough structure for the LLM to process. While computationally expensive and complex to implement, it represents the bleeding edge of prompt privacyLarge Language Models (LLMs) pose significant security risks because they can unintentionally memorize and redistribute sensitive information, such as PII and corporate secrets. Primary dangers include unauthorized data logging, training data contamination, and output leakage where models regurgitate your data to others.

AI models are incredibly eager to learn, which makes them fantastic assistants but terrible secret-keepers. By adopting smart anonymization pipelines, demanding strict retention policies, and securing your integrations, you can enjoy all the productivity benefits of generative AI without accidentally donating your private data to the world.

The Clipboard Crisis: Securing the Modern Data Leakage Vector

In a nutshell (tl;dr)

The modern copy-paste function has become a major, often overlooked, vector for data exfiltration. As employees frequently use unmanaged personal accounts for Generative AI and messaging apps, corporate data is regularly moved outside secure environments. Because traditional security tools were designed to monitor file uploads rather than "file-less" text transfers, organizations must shift toward action-centric security, monitor browser activity, and restrict the use of personal accounts to protect sensitive information.

I totally missed out on last week’s post thanks to the day job and nearly missed it this week too! This week I was worried about how safe my personal or proprietary data was when passing it over to an AI to work with. How likely is it that this information is somehow leaked or made public? Here’s what I found out…

The Copy-Paste Crisis

We all use the copy-paste function without a second thought and the clipboard is our biggest blind spot. It is the ultimate productivity shortcut, saving us countless hours of retyping information. However, this simple, everyday action has quietly become the primary channel for data exfiltration in the modern workplace, completely bypassing traditional file-based security measures.

As we increasingly rely on artificial intelligence and cloud-based applications, the clipboard has transformed into a massive vulnerability. Here is a detailed look at how the "copy-paste crisis" unfolds, why it is so dangerous, and what organizations can do to protect their confidential data.

The Generative AI Black Hole

Generative AI tools have seamlessly integrated into our daily routines, and we are eagerly feeding them information to summarize, rewrite, or analyze. In fact, a staggering 77% of enterprise employees now paste data directly into GenAI prompts.

The core issue is not necessarily the AI itself, but how users are accessing it. Approximately 82% of the data pasted into AI tools comes from unmanaged, personal accounts. When employees bypass official corporate logins, IT and security departments lose all visibility. This turns "Shadow AI" activity into a massive blind spot for data leakage. Today, GenAI alone accounts for 32% of all corporate-to-personal data exfiltration, making it the number one vector for corporate data moving outside sanctioned environments.

Beyond AI: The Instant Messaging Trap

While AI gets most of the spotlight, instant messaging (IM) and chat applications represent another enormous vulnerability. A remarkable 87% of all instant messaging activity occurs on unmanaged, non-corporate accounts .

Because chat feels informal and conversational, users often let their guard down. Consequently, Chat and IM apps have become a major hotspot for sensitive data exposure, with 62% of users pasting Personally Identifiable Information (PII) or Payment Card Industry (PCI) data directly into these platforms.

Death by a Thousand Clicks

It might seem like pasting a quick snippet of text is harmless, but the sheer volume of these actions adds up to a significant security threat. On an average day, an employee makes about 46 copy-paste actions. While many of these transfers stay safely within corporate boundaries, an average of 15 pastes per day go to non-corporate accounts. Out of those, roughly four pastes contain sensitive PII or PCI data.

An employee pasting a few sensitive entries into ChatGPT each day might not trigger massive security alarms or generate large file logs, but every single instance increases the risk of a breach. Furthermore, employees are pasting corporate data into a surprisingly diverse range of destinations. Beyond just ChatGPT, top destinations for pasted data include developer platforms like Databricks and Snowflake, as well as websites like LinkedIn and DeepL. Exfiltration is highly unpredictable, driven by everything from innocent productivity shortcuts to competitive moves.

Why Traditional Defenses Are Falling Behind

The reason this copy-paste crisis has grown so severe is that traditional Data Loss Prevention (DLP) solutions were fundamentally designed for a different era. Legacy DLP focuses heavily on monitoring file uploads and centralized servers . They simply are not equipped to track "file-less" data transfers, like copying text from an internal document and pasting it directly into a web browser.

Taking Back Control of the Clipboard

To secure the modern workflow, organizations need to evolve their security strategies to match employee behavior.

Shift to Action-Centric Security

Security teams must move away from purely file-centric policies and embrace "action-centric" controls. Monitoring copy-paste functions and text inputs into prompts must become a first-class security priority.

Focus on the Browser

Because nearly every business workflow, from email to GenAI, now runs through the web browser, this is the environment where visibility and enforcement must be focused.

Ban Unmanaged Accounts

Allowing employees to use personal accounts for business-critical apps creates active shadow IT. Organizations should restrict the use of personal accounts for high-risk categories like AI and Chat, and enforce Single Sign-On (SSO) across all corporate logins to ensure activity remains visible and governed.

The clipboard might be the most overlooked tool in our software arsenal, but it is currently one of the riskiest. By understanding the flow of copy-pasted data and upgrading our security frameworks to monitor file-less transfers, we can enjoy the productivity benefits of modern SaaS and AI tools while keeping our private data exactly where it belongs.

Fortifying the Digital Vault: A Wee Guide to AI Privacy

In a nutshell (TL;DR)...

The widespread use of generative AI tools introduces major security risks for private and confidential company information. Sensitive data can leak when prompts are retained for logging/training, employees paste data into unmanaged "Shadow AI" accounts (the "Copy/Paste Blind Spot"), or malicious "Prompt Injections" trick the model. Consequences are severe, including regulatory fines (GDPR/HIPAA), data breaches, and loss of competitive advantage. To stay secure, organizations must:

• Anonymize sensitive data (PII) before using external LLMs.

• Prioritize vendors offering Zero Data Retention (ZDR).

• Banish "Shadow AI" by enforcing Single Sign-On (SSO).

• Upgrade to action-centric Data Loss Prevention (DLP) that monitors copy/paste actions.

Apply the principle of least privilege and keep a human in the loop for critical actions.

The AI Privacy Guide: How to Keep Your Confidential Data Safe in the Age of LLMs

The company I work for has drummed into me the perils of letting slip any confidential information when working with AI applications, but just how important is it? My employer specifically lists the AI applications we are allowed to use when working with confidential information, so it’s a really important thing to bear in mind. Let’s have a look at what the problems are and how we can protect ourselves, our customers and our employers…

Everyone is officially living in the era of Artificial Intelligence. From drafting emails to analyzing complex datasets, generative AI and Large Language Models (LLMs) have seamlessly integrated into our daily workflows. In fact, nearly half of all enterprise employees are already using these tools. But amid all this newfound productivity, there is a crucial conversation we need to have: how are we protecting our private data and confidential company information?

While AI assistants are incredibly helpful, treating them like a private diary or a secure company vault can lead to serious risks. Let’s break down exactly how sensitive information can slip through the cracks, what the consequences are, and the best practices you should adopt to stay secure.

How Does Confidential Information Actually Go Public?

When you type a prompt into an external LLM, that data is processed by a third-party provider. If you aren't careful, sensitive information can be exposed in a few common ways:

Logging and Training Contamination

Many AI providers retain user prompts for a certain period to monitor for abuse, debug their systems, or even train future versions of their models. If you paste confidential data into a prompt, it could end up stored on the provider's servers or, worse, replicated in the model's future outputs.

The Copy/Paste Blind Spot

A staggering 77% of employees paste data directly into generative AI tools, and the vast majority of this activity happens on unmanaged personal accounts. Because this bypasses official corporate channels, IT and security teams have no visibility into what is being shared, creating a massive "Shadow AI" blind spot.

Prompt Injections

Malicious actors can use "prompt injections", carefully crafted inputs designed to manipulate the AI's behavior to trick the model into revealing sensitive information. This can lead to the AI accidentally exposing personally identifiable information (PII), confidential business strategies, or even system credentials. I’ve made a note to dig deeper on this subject for a later post…

The Uncomfortable Consequences of Data Leaks

The fallout from exposing sensitive data to an LLM is rarely a minor hiccup. When PII or corporate secrets leak, the consequences can be severe.

Regulatory Penalties

Mishandling personal data violates strict data protection regulations like GDPR and HIPAA. Failing to comply with these laws can result in massive legal and financial penalties.

Data Breaches and Loss of Trust

If a customer service chatbot or an internal AI tool inadvertently reveals private user details or passwords, it can lead to full-scale data breaches. This erodes user trust and severely damages your organization's reputation.

Loss of Competitive Advantage

Exposing proprietary business data or intellectual property can directly result in a loss of your competitive edge in the market.

Best Practices for Handling Sensitive Information with AI

Fortunately, you don't have to abandon AI to keep your data safe. By implementing a few strategic best practices, you can enjoy the benefits of LLMs while minimizing your risk.

1. Anonymize Before You Analyze

Before sending a prompt containing sensitive data to an external LLM, scrub the text of any PII. You can use automated tools to detect and replace names, emails, and phone numbers with generic placeholders (e.g., swapping a real name for [PERSON] or [EMAIL]). This allows the AI to understand the context of your prompt without ever seeing the raw, sensitive data.

2. Demand "Zero Data Retention" (ZDR)

If you are procuring AI tools for your company, prioritize vendors that offer "Zero Data Retention" agreements. Under a ZDR policy, the AI provider processes your prompt and immediately returns the response without writing your data to any persistent storage, logs, or training queues. This ensures your data exists only in memory for the duration of the request. I think this is what my employer might have in place for the applications I am allowed to use.

3. Banish "Shadow AI" and Enforce SSO

Employees often use unmanaged personal accounts to access AI tools, completely bypassing enterprise security. To regain control, organizations must restrict the use of personal accounts for business-critical apps and enforce Single Sign-On (SSO) across all corporate logins.

4. Upgrade Your Data Loss Prevention (DLP)

Traditional Data Loss Prevention tools are heavily focused on file uploads, but today's sensitive data usually leaks when employees copy and paste text directly into AI prompts. Organizations need to shift to "action-centric" DLP policies that monitor file-less data transfers and enforce controls directly at the web browser level.

5. Keep a Human in the Loop and Limit Privileges

Finally, never give an AI unchecked autonomy. Apply the principle of "least privilege" by ensuring your AI applications only have access to the specific data sources they absolutely need. For high-impact actions, like modifying files or handling highly sensitive records, always require human approval before the AI can proceed.

AI is a powerful collaborator, but it is ultimately up to us to set the boundaries. By treating generative AI platforms with the same security rigor as any other enterprise tool, we can innovate quickly without putting our most valuable data on the line.

Next week let’s take a shifty at this “prompt injection” malarky and see how we can protect ourselves from that…