Approved AI tools at SFU

To request a Privacy Impact Assessment (PIA) for an AI-enabled tool, please see the overview and forms here: Privacy Impact Assessments 

Concerns and considerations when using AI applications that do not have an SFU PIA 

When using an AI application that does not have an SFU PIA as indicated in the above table, always keep in mind these six considerations:

Unauthorized data collection

• BC’s Freedom of Information and Protection of Privacy Act (FIPPA) strictly prohibits unauthorized collection, use and disclosure of Personal information. The scope of “Personal information” is fairly broad, and includes information such as name, image, marital or family status, unique identifying numbers, demographic information (gender, race, ethnicity, religion), educational history,  employment history and job performance, personal contact information, financial history, medical history, disability status, an individual's recorded personal views or opinions, and anyone else's recorded views and opinions about an individual. The ease of accidentally using or disclosing personal data is a significant concern, especially if the data is used for purposes beyond what the user initially agreed to at the original point of collection, such as unwanted targeted advertising or profile generation.

Surveillance and tracking

• AI applications can be used for monitoring individuals online and in the physical world, raising significant concerns about mass surveillance and loss of privacy. Data that you enter into GenAI-enabled software applications can be used to deliver highly targeted advertisements, influence decision-making (e.g., what content you see), or even predict future behaviour. In some cases, this tracking extends beyond the application itself, following users across websites and devices using tracking pixels, cookies, and device fingerprints.

Data breaches and leaks

• AI systems often store and analyze large datasets. Therefore, they are attractive targets for hackers and cybercriminals. If an AI system containing medical, educational, or financial information is breached, Personal or Confidential information could be exposed. This threatens individual privacy and can lead to identity theft and financial fraud. Report such breaches to Information Security Services via SFU ServiceHub and the Privacy Management Program.

Automated decision-making and loss of human oversight

• AI can improve efficiency and decision-making, but excessive reliance on AI without human oversight can have serious consequences. AI can potentially be used to support business activities such as hiring employees, or assessing student university admissions, by making decisions based on data patterns. However, these decisions may lack transparency, making it difficult for individuals to understand the outcome or question the results of the analyses, or to recognize any biases that may have influenced the decision. This leads to unfair or discriminatory outcomes, particularly if AI is trained on biased data. If you are going to use AI to make a decision, you need to be prepared to defend the decision and the decision-making process.

Threats to Information Security

• Ensure the use of generative AI complies with other SFU Policies such as Information Systems Policy GP24: Acceptable Use and Security of Digital Information and Electronic Systems, including the Information Security Standards. To keep SFU’s electronic information secure, anyone doing university work on non-SFU systems must follow the Privacy and Information Security Standards and Procedures. Generative AI could be used in harmful ways, and there is a real risk of more cyber and fraud attacks — like deepfakes used by attackers to trick or target people.

Copyright infringement

• GenAI applications may use content provided to them as training data to further refine their performance.  You should be aware that uploading or pasting parts, or all, of a document into this type of GenAI application may violate copyright. Also remember that even if you or SFU owns the copyright to a document, always check that it does not contain Personal or Confidential information as outlined above. Additionally, many third party copyrighted works are made available to SFU users under license. In many cases these licenses prohibit the use of the content with GenAI applications, so always check the license terms for this content before using them with GenAI applications.

Subject-specific contacts

Privacy Queries can be sent to privacy@sfu.ca.

Information Security Queries can be sent to information-security@sfu.ca.

Risk Queries can be sent to risk_srs@sfu.ca.

Copyright Queries can be sent to copy@sfu.ca.

Definitions

Personal Information: recorded data about an identifiable individual other than business contact information.  Examples include name, image, marital or family status, unique identifying numbers, demographic information (gender, race, ethnicity, religion), educational history, employment history and job performance, personal contact information, financial history, medical history, disability status, an individual's recorded personal views or opinions, and anyone else's recorded views and opinions about an individual.

Confidential information: includes trade secrets and proprietary data.