Panasonic unit says staff data uploaded to banned external AI

Panasonic Operational Excellence said on October 23 that personal data covering employees, former employees and their families had been uploaded to an external generative AI service that is banned for internal use, according to japan.cnet.com.

The company said the incident occurred in a project to introduce a human resources information system run by the company and its subsidiary Panasonic Digital. A project member violated internal rules and uploaded part of the data registered in the system as of April 2026 to the external service. The company said the upload was not caused by unauthorized external access.

The affected group includes about 75,000 employees of companies using the shared HR system within the Panasonic Group in Japan, about 178,000 people who left the company between 1978 and fiscal 2026, about 55,000 family members of employees and about 26,000 family members of former employees, the last group limited to families of people who left since 2016.

Uploaded employee and former employee data included employee numbers, addresses, phone numbers and email addresses, but not names. Family data included names, addresses, phone numbers and email addresses. The company said it has confirmed no public disclosure of the data and no concrete harm from misuse so far.

After discovering the issue, the member who uploaded the data deleted the chat history and the data stored on the work PC. The company reported the matter to the Personal Information Protection Commission on September 29. The AI service operator said its training feature was disabled when the data was uploaded and that the data would not be used in answers to other users, and said deleted data is retained for 30 days for security and legal compliance, with the retention period ending on October 25.

The company said the announcement was made as an alternative to individual notification under the Act on the Protection of Personal Information, and that affected people do not need to take action at this time. It said it will continue investigating the impact while reviewing its personal information handling rules and generative AI usage management and strengthening education for those involved. An inquiry form and a dedicated contact point have been set up for former employees and their families.