The PPC notice on generative AI and AI Mask
On 2 June 2023, Japan's Personal Information Protection Commission (PPC) published a notice on the use of generative AI services (in Japanese). Beside each of its points for businesses and for users, this page sets out what AI Mask does and what it does not do.
| What the notice says | What AI Mask does | What it does not do / what the company decides |
|---|---|---|
| (1) ① Before putting a text (prompt) that holds personal information into an AI, check carefully that it stays within the purpose of use set for that information. | Before you send, names, companies, phone numbers, emails, addresses and amounts become placeholders such as 【Person 1】 【Company A】, so personal information the task does not need never reaches the outside AI. | It does not judge the purpose of use. The company decides what may go into an AI (the Business page has an AI-use policy to start from). |
| (1) ② Putting in personal data without the person's consent may break the law if the data is used for anything other than the answer (machine learning, for instance). Check carefully that the AI provider does not use it for machine learning. | The original values of the masked places do not reach the outside AI. The key between placeholders and values stays in this browser on this computer (orihako.com's storage) for 30 days and is not uploaded to a server. | It does not check the AI's terms or training settings. A place can be missed (check the coloured places before you send). Masking does not replace the check needed before personal data goes in. |
| (3) ① Personal information put in may be used for machine learning, linked with other information and come out, correct or wrong. | Sent as placeholders, the original names and numbers do not reach the AI. It points out places that together may identify a person (a team, a job title and a year) and masks one with a press. | It cannot stop every guess from the context. The combination hints come from short word lists and miss things. |
| (3) ② An AI's answer may hold wrong content, wrong personal information included. | When the answer is put back, it points out unknown placeholders, and numbers and names that were not in the original. | It does not check that the answer is right. A person reads it. |
| (3) ③ Read the AI provider's terms and privacy policy carefully and decide, given what you put in, whether to use it. | With any AI (ChatGPT, Claude, Copilot, Gemini), the same steps cut down what you hand over. | It does not read terms or privacy policies. The company and the user choose which AI to use. |
The points for public bodies, (2) (use only what is strictly needed; check that it is not used for machine learning), read like (1) above. Attachment 2 is the notice to OpenAI, the provider of ChatGPT; it asks nothing of users.
Showing that it is used
The AI Mask usage record counts, month by month, how often it was used in this browser (where, how many places of each kind, how many answers put back; no text or names). Save it as a CSV. AI Mask usage record →
About this page
It sets AI Mask beside each point of the notice; it is not legal advice, and using AI Mask does not mean the notice or the law is met. The company decides, with a professional where needed.