GenAI Data Privacy and Governance: Risk Tiering and Ethics Councils
In a 2024 AI Connect webinar sponsored by Daugherty Business Solutions, leaders from Meta, ADP, Verizon, BBDO and Daugherty discussed generative AI privacy, bias and governance. They described privacy by design, cross-functional ethics councils, risk tiering of use cases and continuous monitoring.
By The AI Enterprise Magazine Team4 min read
Key takeaways
- Design for privacy from day zero. Meta's Anshul Jain urged data minimization, transparency, encryption and retention limits before launch.
- Layer policy, transparency and tools. ADP's Gil Geresti described gen firewalls that keep personal information from reaching models.
- Tier use cases by risk. Controls should match whether a use case is customer facing and uses sensitive data.
- Govern across functions. Ethics councils spanning legal, privacy, security and compliance review use cases, with sandboxes for safe experimentation.
- Keep monitoring. Models can drift and costs can climb, so teams need continuous checks on accuracy, fairness and spend.
In a 2024 AI Connect webinar sponsored by Daugherty Business Solutions, five data and AI leaders discussed how companies can use generative AI without exposing sensitive data or amplifying bias. The panel, titled "Navigating GenAI Minefields: Safeguarding Data Privacy and Strengthening Governance," included Nathan Orwig of Daugherty Business Solutions, Anshul Jain of Meta, Gil Geresti of ADP, Supriya Bhatis of BBDO and Donald Spaulding of Verizon. Brian Mink, co-founder and president of AI Connect, moderated.
What are the biggest ethical risks of generative AI?
Panelists named misuse of generated content, data breaches, bias and weak regulation. Spaulding, who works with finance companies on fraud, pointed to synthetic fraud and to intellectual property concerns. He also warned that the more data an organization relies on, the greater its exposure to breaches.
Bhatis described how data entered into public chat tools can become part of training data, citing an example from the previous year in which a consumer electronics company's employees accidentally leaked sensitive information. She also said no overarching standards yet held AI vendors accountable, and that the EU AI Act was expected to be published that summer, with some provisions taking up to three years to become enforceable.
Orwig described a healthcare client whose model, trained on its own population data, began recommending lower-quality care to lower-income patients. "The big dilemma," he said, was whether to train a model to make money or to distribute care equitably.
How does bias creep into AI systems?
Geresti said models are only as good as their training data, and that even a very large sample can reflect existing bias. He gave compensation benchmarking and candidate screening as areas where historical patterns could be repeated if teams did not control for them.
Spaulding added that bias can be subtle and that access is itself a form of bias. As a carrier and network provider, he said, Verizon considers who can reach and benefit from AI capabilities.
How can organizations balance innovation with privacy and ethics?
Jain argued that privacy and safety need to be built in at the design stage rather than considered after launch. He listed data minimization, transparency with users, encryption, access controls and data retention as questions teams should ask from day zero.
Geresti proposed three layers: transparency, robust policies and tools. People should know when they are engaging with an AI application, employees should know what may and may not be put into an AI tool, and technical guardrails such as gen firewalls should keep personal information from reaching a model.
Orwig said that across the ethical frameworks his firm reviewed with clients, shared themes included human agency, accountability, transparency and fairness. In his view, "implementing a governing board that then implements a framework is very important." He said such boards should also weigh human impact, including reskilling and liability when AI output is wrong.
What does AI governance look like in practice?
Geresti said ADP established a data and AI ethics council roughly six years before the webinar, and that generative AI forced a rethink of how it operates. The governing body spans compliance, privacy, legal, ethics and security, and is led by the chief data office. ADP offers a sandbox where teams can experiment before real data is shared with models, and use cases then go through further approvals. He described the result as "a layered human and machine driven governance" approach.
Bhatis recommended an AI code of conduct built into the full lifecycle, from data collection to training, deployment and monitoring, plus continuous checks for fairness and accuracy and recurring employee training. Spaulding stressed monitoring and feedback loops as use cases move from idea to wider adoption.
Orwig added that models can drift as more data is added, so governance teams must keep monitoring accuracy. He also flagged cost, noting that many vendors charge per transaction and bills can climb quickly.
How should companies mitigate generative AI risk?
Jain's first suggestion was to exclude or anonymize personal information, and to be transparent about collection, retention and consent where it cannot be avoided. Bhatis recommended secure infrastructure, continuous improvement from audits and feedback, and clear redress mechanisms for people harmed by an AI decision.
Geresti said risk tiering is the starting point. Teams ask whether a use case is customer facing, what data it needs and whether that data is sensitive, then set controls to match. He called the exercise ever-evolving. Spaulding said the best assessments draw on legal, data protection, business and marketing perspectives.
Orwig said some pharmaceutical clients were generating synthetic internal data to avoid exposing intellectual property to public models.
Where is enterprise generative AI headed?
Panelists agreed the technology would not be rolled back. Geresti said there is "a level of literacy that we all have to get to" across the workforce, and that companies cannot ignore operational benefits but should avoid chasing every new tool. Spaulding tied adoption to trust in outputs. Orwig said a banking customer's executive told his firm the bank now views every vendor as a security risk.
Where can you hear more from AI and data leaders?
AI Connect continues the conversation with 24 free live webinars on the 2027 schedule across four series: the AI × Enterprise Panel Series, AI Demo Days, Agentic AI Showcases and the Plug & Play Series. Details are at /webinars/, and registration for 2027 events is coming soon.
Frequently asked questions
What are the main ethical risks of generative AI?
Panelists cited data leakage into training data, bias, intellectual property concerns, breaches and limited regulatory safeguards.
What is risk tiering for AI use cases?
ADP's Gil Geresti said teams assess how a use case interacts with customers and whether it needs sensitive data, then set controls to match.
How can companies reduce privacy risk in GenAI?
Panelists recommended excluding or anonymizing personal data, being transparent about use and retention, and filtering sensitive data with guardrail tools.
Who should be on an AI governance board?
ADP's council spans compliance, privacy, legal, ethics and security, led by the chief data office.
This article is based on remarks by Nathan Orwig, VP of Innovation and Strategy, Daugherty Business Solutions; Anshul Jain, Head of Data Science for Safety, Meta; Gil Geresti, VP of Data Products Governance and Ops, Chief Data Office, ADP; Supriya Bhatis, VP and Head of Data Science and Advanced Analytics, BBDO; Donald Spaulding, Director of Technology Innovation, Verizon; moderator Brian Mink, Co-founder and President, AI Connect at AI Connect webinar, 2024 on September 5, 2024. More coverage: Webinars.
Filed under: AI Governance & Trust, Security & Fraud, People, Culture & Leadership
