THE WORLD IS NOT STANDING STILL.RSS
BIG CHANGE.
BIG CHANGE, one tap away
BIG CHANGE, one tap away

Make room for the big picture.

Add BIG CHANGE to your home screen or desktop. It opens in its own window, with the latest stories when you’re online.

iPhone & iPad
Open bigchange.ai in Safari. Tap Share, then Add to Home Screen. Turn on Open as Web App if shown, then tap Add.
Android
Open bigchange.ai in Chrome. In the browser menu, choose Install app or Add to Home screen.
Desktop
In Chrome or Edge, use the install icon in the address bar or the browser’s app menu. In Safari on Mac, choose File → Add to Dock.

Markdown edition

# Panasonic says data on about 334,000 people went to an AI service it had banned

> Panasonic says HR records entered a banned AI service; disposal unconfirmed.

By BIGCHANGE.AI Editorial

Published: 2026-10-27T08:50:38.004Z
Updated: 2026-10-27T08:50:38.004Z
Canonical: https://bigchange.ai/blog/panasonic-hr-data-prohibited-ai-service-upload

![Blank staff badges beside an unbranded laptop.](https://bigchange.ai/api/media/file/panasonic-hr-ai-hero-v1.png)
AI-generated conceptual illustration by BIG CHANGE.

Panasonic Operational Excellence says a project member uploaded HR data on about 334,000 employees, former employees and family contacts to a prohibited external AI service. Its [October 23 notice](https://holdings.panasonic/jp/information/topics/20261023.html) describes a rule breach, not an intrusion.

## The big change

- **What changed:** The upload breached a service ban.
- **Why it matters:** A training setting governs one use after entry. The decision to submit personal information, and the provider's retention of it, need separate scrutiny.
- **What to watch:** A provider's stated retention deadline calls for evidence of disposal. NIST recommends documenting retention and vendor responsibilities before an incident.

## The records and response

Japan-region group HR records held employee numbers and contact details without names; family emergency contacts had names. Panasonic says it reported to the privacy regulator September 29. Upload and discovery dates remain undisclosed.

The member deleted chat history and work-PC data after discovery. Panasonic says the unnamed provider reported training off and 30-day retention after user deletion for security and compliance, to end after October 25. Disposal remains independently unverified.

On October 23, Panasonic reported no confirmed public disclosure or concrete harm from misuse.

## A training setting does not govern the initial transfer

In a [2023 advisory](https://www.ppc.go.jp/files/pdf/230602_alert_generative_AI_service.pdf), Japan's Personal Information Protection Commission told businesses to confirm that entering personal information into an AI service stays within the necessary scope of its specified purpose. Where personal data is entered without prior consent and may be handled beyond producing the requested response, the advisory says businesses should confirm that the provider will not use it for machine learning. The guidance treats permission to submit data and the provider's later use as separate questions.

The advisory is general guidance, with no finding about this incident or legal conclusion. A training exclusion addresses the risk of material entering model development. It does not answer whether the upload itself was within the data's intended use. This is why a service approved for a task and the particular information a user submits require separate decisions.

## Retention and vendor responsibilities

The [NIST generative AI risk profile](https://doi.org/10.6028/NIST.AI.600-1) recommends data-retention policies, diligence on AI vendors and incident response tied to existing data governance. These are suggested general practices; NIST does not assess this provider. They give organizations distinct matters to document before use and verify after an incident, including a provider's retention terms and the evidence available when those terms expire.

An [organizational AI guide hosted by Japan's Information-technology Promotion Agency](https://www.ipa.go.jp/jinzai/ics/core_human_resource/final_project/2024/generative-ai-guideline.html) covers written use rules, day-to-day operation and security risk management. The hosting page says the guide reflects its project authors' views, not IPA's official position. A rule on service choice sets one boundary; reviewing the actual input applies a separate boundary to the material being sent.

## Sources

- [Panasonic notice](https://holdings.panasonic/jp/information/topics/20261023.html) — Company account; disposal unconfirmed.
- [Personal Information Protection Commission advisory, June 2023](https://www.ppc.go.jp/files/pdf/230602_alert_generative_AI_service.pdf) — General AI data-entry guidance; no finding about this Panasonic incident.
- [IPA-hosted organizational AI-use guide, July 2024](https://www.ipa.go.jp/jinzai/ics/core_human_resource/final_project/2024/generative-ai-guideline.html) — Background on usage rules and risk management; authors' views, not an official IPA position.
- [NIST generative AI risk profile, July 2024](https://doi.org/10.6028/NIST.AI.600-1) — General suggested data-retention, vendor and incident-response practices; no Panasonic finding.