Panasonic Operational Excellence says a project member uploaded HR data on about 334,000 employees, former employees and family contacts to a prohibited external AI service. Its October 23 notice describes a rule breach, not an intrusion.

The big change

  • What changed: The upload breached a service ban.
  • Why it matters: A training setting governs one use after entry. The decision to submit personal information, and the provider's retention of it, need separate scrutiny.
  • What to watch: A provider's stated retention deadline calls for evidence of disposal. NIST recommends documenting retention and vendor responsibilities before an incident.

The records and response

Japan-region group HR records held employee numbers and contact details without names; family emergency contacts had names. Panasonic says it reported to the privacy regulator September 29. Upload and discovery dates remain undisclosed.

The member deleted chat history and work-PC data after discovery. Panasonic says the unnamed provider reported training off and 30-day retention after user deletion for security and compliance, to end after October 25. Disposal remains independently unverified.

On October 23, Panasonic reported no confirmed public disclosure or concrete harm from misuse.

A training setting does not govern the initial transfer

In a 2023 advisory, Japan's Personal Information Protection Commission told businesses to confirm that entering personal information into an AI service stays within the necessary scope of its specified purpose. Where personal data is entered without prior consent and may be handled beyond producing the requested response, the advisory says businesses should confirm that the provider will not use it for machine learning. The guidance treats permission to submit data and the provider's later use as separate questions.

The advisory is general guidance, with no finding about this incident or legal conclusion. A training exclusion addresses the risk of material entering model development. It does not answer whether the upload itself was within the data's intended use. This is why a service approved for a task and the particular information a user submits require separate decisions.

Retention and vendor responsibilities

The NIST generative AI risk profile recommends data-retention policies, diligence on AI vendors and incident response tied to existing data governance. These are suggested general practices; NIST does not assess this provider. They give organizations distinct matters to document before use and verify after an incident, including a provider's retention terms and the evidence available when those terms expire.

An organizational AI guide hosted by Japan's Information-technology Promotion Agency covers written use rules, day-to-day operation and security risk management. The hosting page says the guide reflects its project authors' views, not IPA's official position. A rule on service choice sets one boundary; reviewing the actual input applies a separate boundary to the material being sent.