Before You Click Accept: How to Decide What Privacy Risks to Inherit

Every AI tool comes with a license agreement, and every license agreement is a privacy decision. The terms buried in that click determine where data gets processed, whether inputs train models, and what happens when something goes wrong. For researchers using AI for grant drafts, correspondence, and administrative work, the terms they accept is often the single biggest privacy risk factor and most never read it.

This session takes a practical, risk-based approach to AI adoption in research environments. It starts with what researchers are actually agreeing to when they sign up for AI tools breaking down terms of service patterns across free-tier, institutional, and enterprise licenses, and showing how the same tool can carry fundamentally different risk profiles depending on which version you're using. A paid personal ChatGPT account and an Bedrock API agreement have substantially different privacy implications.

The session then covers the inherent risks that follow from those agreements: data ingestion and retention, secondary use of inputs for model training, cross-border processing under foreign jurisdiction, hallucinated outputs, and the gap between marketing promises and contractual commitments. From there, attendees work through a practical decision matrix built for how research labs actually work. It weighs the sensitivity of the task drafting a grant versus handling ethics board data against what the tool's license actually allows: where processing happens, whether inputs are retained or used for training, and what commitments are contractual versus marketing. The result is a clear call for each use case: use with guardrails, or consider alternatives.

About the Speaker
Taylor Bohn is a Senior Privacy and Information Security Risk Advisor at the University of British Columbia (UBC), where he supports the evaluation and adoption of emerging technologies, including artificial intelligence, cloud services, and research platforms. His work centers on translating privacy, security, and governance requirements into practical decision-making guidance for institutional project teams. Taylor regularly conducts Privacy Impact Assessments, advises on AI governance, and presents on privacy, cybersecurity, and responsible technology adoption within higher education and the research community.

This event is organized by the Digital Research Alliance of Canada.