Privacy Impact Assessments for GenerativeAI Instructional Use

This page outlines the current state of Privacy Impact Assessments (PIA) and any recommendations for Instructors with regards to teaching and learning uses for GenerativeAI Tools at UBC, currently the PRISM Interim Report on guidelines for Generative AI Tool Use. A PIA is a risk management and compliance review process used to identify and address potential information privacy and security issues, thus avoiding costly program, service, or process redesign and minimizing exposure to potential privacy breaches.

Note: This guidance only addresses whether you can require tool use for your class. It does not cover situations where students use the tools by choice. For academic integrity cautions, or guidelines for tool use in your class, please visit the Academic Integrity at UBC Chat GPT FAQ page. For further instructional guidance around optional use for students, please visit the FAQ item on whether you can require GenAI in your course.

ToolDoes it require personal information for signup?Does it protect personal information?Can it be required for use by students in your course?
Bing Chat (Consumer) aka CopilotStudents can use it without authentication.No, it will share information entered into the tool outside Canada.With caution: students should be reminded not to enter personal information or intellectual property into the tool.
ChatGPTStudents would need to sign up using a phone number and email address.No, it will share information entered into the tool outside Canada.No, students cannot be required to use this tool.

GenAI Tools you can require with cautions in your course

Note: This guidance does not cover situations where students use the tools by choice – this page only addresses whether instructors may require tool use. For academic integrity cautions, or guidelines for tool use in your class, please visit the Academic Integrity at UBC Chat GPT FAQ page.

Bing Chat (Consumer) also called Copilot

The version of Bing Chat (Copilot) that students have access to is different from that available to faculty and staff – this PIA advice only refers to the currently student-available version.

Can you require Bing Chat (Consumer)/Copilt for use in your class? Yes, but with restrictions and cautions.

  • Students can be required to use the Bing Chat (Consumer)/Copilot.
  • Students cannot be required to enter personal information or intellectual property into Bing Chat (Consumer)/Copilot, and should be cautioned against doing so.

When students access Bing Chat, even through their UBC-assigned M365 accounts, they are limited to the Consumer version of Bing Chat/Copilot rather than the Enterprise version that faculty or staff have access to. Here are some items you should be aware of when requiring the use of Bing Chat/Copilot within your course.

Data Collection

  • Anything entered will be likely shared outside UBC.
  • Bing Chat (Consumer)/Copilot collects user data, including search queries and chat interactions.
  • In the Edge browser’s sidebar, it gathers data from content loaded in the browser, such as PDFs.
  • Data is shared with Microsoft affiliates and subsidiaries.
  • It is unclear whether this data is shared with 3rd parties such as OpenAI.
  • Data is possibly processed and stored outside Canada.

Privacy

  • IP Addresses are stored for 6 months, other identifiers for up to 18 months.
  • It is unclear if users can delete this data.
  • Authentication is not needed, so users can use this without logging in.

Recommendations

  • You may ask students to use this tool, but caution them in its use.
  • Do not require students to enter any information they would not share publicly on the internet.
  • Remind them to be cautious about sharing any information they would not share publicly on the internet.

Sample Syllabus Language

Usage of Bing Chat in this course

Bing Chat (Consumer)/Copilot can collect basic information about you such as your IP address, what you search or prompt, and documents you upload or view in your browser. It can store information for up to 18 months and you may not be able to delete this information. Do not enter personal or private information, or any information you would not share publicly on the internet, into Bing Chat (Consumer)/Copilot.

Note: This guidance does not cover situations where students use the tools by choice – this page only addresses whether instructors may require tool use. For academic integrity cautions, or guidelines for tool use in your class, please see: https://academicintegrity.ubc.ca/chatgpt-faq/

ChatGPT by OpenAI

Can you require ChatGPT by OpenAI for use in your class? No. Students must not be required to sign up for or use ChatGPT.

  • Users must create accounts to use ChatGPT, requiring a valid email address and phone number.
  • This information is stored, used, and copied outside of Canada.
  • Due to the information requested as part of the sign-up process that is required to use ChatGPT, and privacy concerns around that data, it is not recommended that you use ChatGPT as part of your course and, presently, you are unable to require the use of it within a course at UBC.