 Docusign just admitted that they use customer data (i.e., all those contracts, affidavits, and other confidential documents we send them) to train AI: They state that customers "contractually consent" to such use, but good luck finding it in their Terms of Service. There also doesn't appear to be a way to withdraw consent, but I may have missed that. 29 comments
 @gvwilson @kataclyst Lots of banks use docusign. I’ve had to complain repeatedly about my ssn being sent to them without my consent and about the default “we’ll email this document full of highly sensitive data to you and us at the end, where it’s subject to more use by Google or Microsoft “   I’m furious because my husband’s SNF uses DocuSign for all of their paperwork.  @gvwilson Well now we know how confidential documents ended up in ChatGPT's training set.  @gvwilson zero percent endorsing this practice. Highlighting this in case prevents other enterprise IT types from having the sheer “oh shit” moment I did. This is for “CLM, CLM AI Extension, and eSignature (for select eSignature customers). It is also relevant for AI Labs services.” Doesn’t make it better, and doesn’t do a thing to protect end users. @gvwilson If you live in Europe immediately file a GDPR complaint If you live in Switzerland file a FADP complaint Canadians file a complaint with the federal privacy commissioner in regards to PIPEDA right here: https://www.priv.gc.ca/en/contact-the-opc/   @gvwilson if it’s not stated in their T&Cs then I don’t see how that would be legal in any court.  @gvwilson ah. we have experience with this specific contractual provision from our privacy work. the wording that does this is: "Without limitation of any term in the Terms, DocuSign may analyze Customer Data and Customer usage patterns using techniques such as machine learning in order to improve and develop DocuSign’s current and future products, services, methods, and processes. " @gvwilson many companies abbreviate that whole thing to just "to improve our products and services" in the middle of a longer sentence yes, it's sneaky. yes, people are right to be furious. yes, you'd have to be an expert, or just cynical, to guess that they already gave themselves the right to do that, so people are right to feel deceived. yes, it's likely to be legally binding. there's no rule that says boring boilerplate isn't binding. :/  Yep. Speaking of which have you seen the Threads supplemental privacy policy which covers data that federates there? "We use the information we collect for Threads for the purposes described in the Meta Privacy Policy, including to provide, personalize, and improve #Threads and other #Meta Products." Huh. What could possibly go wrong? EDIT: added hashtags 😎 Also including #privacy   @gvwilson  @gvwilson So the only really truly secure one way hash we have is *maybe* black holes. Physicists are still trying to sort that out. And just right before this, people figured out how to extract the images text processing neural networks were trained on. So this could be exciting. @gvwilson@mastodon.social FFS. If you're not, say, OpenAI, and you need a full-blown "AI FAQs" page, you should probably rethink a lot of things.  @gvwilson oof. Couple of thoughts: 1 this seems likely to result in significant court activity from other large organisations who use them 2 is there a market for an end-to-end encrypted alternative? @gvwilson oh my. I can just imagine the conversation with an uncomprehending potential employer or landlord of "I'm happy to sign, but not via this platform". Probably as futile as my attempts to get various HR departments to stop requiring me to send all my passport info in email. |
Gregory's Server
@gvwilson oh goddamnit i might have known