Introduction
Careers Wales supports young people and adults across Wales to create brighter futures through access to high quality, impartial careers support that makes a positive impact on individuals, education, economic and wellbeing outcomes. We ensure individuals are equipped to make informed choices, develop the right skills, and move into fair and sustainable employment that meets the needs of the labour market.
Technology is highlighted as a key part of Goal Four in Careers Wales’ Brighter Futures vision to develop personalised, customer-centred services that are responsive to user needs and accessible to all. Careers Wales plan to optimise the use of technology to transform ways of working and develop the digital skills and capabilities of all Careers Wales employees. This document explains how we use protect your personal data in our use of AI products we develop.
Data Controller
Career Choices Dewis Gyrfa Ltd, trading as Careers Wales, is the data controller for the personal data we process. We are registered as a data controller with the ICO, registration number: Z276256.
Purpose
According to UK Government Guidance “Artificial intelligence (AI) refers to systems and technologies that perform tasks normally requiring human intelligence, such as learning, reasoning, problem solving, perception, or decision making. These systems apply algorithms to data to make predictions, recommendations, or decisions, and may operate with varying degrees of autonomy”. The ICO further defines AI systems as “Algorithm based technologies that solve complex tasks by carrying out functions that previously required human thinking”.
When developing AI products, we will adhere to the following principles:
- Ethical, trustworthy, and aligned with the values and interests of the people of Wales
- Inclusive, accessible, and beneficial for all segments of society, especially the most vulnerable and disadvantaged
- Innovative, collaborative, and supportive of the research and development ecosystem in Wales; and,
- Transparent, accountable, and subject to appropriate governance and oversight
- All our AI systems will be trained, tested and deployed on trustworthy data – data quality, suitability, security, privacy and compliance will be assured
- We will not use AI for automated decision-making; All our products will have a level of human oversight or review in place
- We will clearly inform individuals when they are interacting with an AI system
- We will ensure AI-generated or manipulated content is clearly identified as such
- We will design our AI products to take into account a customer’s rights of access to their data
- We will demonstrate reasonable and risk-based mitigation rather than technological perfection in our AI products
- We will take steps to monitor our AI products for accuracy, fairness and potential misuse
- Although we cannot eliminate bias entirely within our AI products we will actively identify, monitor and mitigate, and make appropriate adjustments, throughout the lifecycle of our AI products
We are implementing AI products to improve the efficiency, quality and speed of our business processes. This includes the creation of AI chatbots, which are AI enabled software systems that communicate with users in natural language, interpret their inputs, and generate automated responses, often to provide information, assistance, or guidance. Our AI products will not involve the generation of predictions, scores, risk profiles or behavioural inferences.
It is recognised that AI outputs are inferences or probabilities, rather than factual records. Therefore, in terms of rectification, there are practical limits which cannot always be corrected in the same way as factual data. The AI generated outcomes of all our products will therefore have a level of human oversight or review in place by our members of staff.
Data erasure is complex in AI products, particularly where personal data is used to train or influence a model. Therefore, we are unable to delete or retrain our entire model if this would be disproportionate or technically infeasible.
| Title | Purpose | Data sets |
|---|---|---|
| "Cari" - Triage bot for post-16 learners | To enable post-16 learners to identify their support needs and point them to sources of information and support on our website, or indicate where guidance might be helpful and so direct them to our booking app |
|
| Pre-guidance notes project | Summary of interactions to date with a client, to save an Adviser or Employability Coach having to trawl through their complete record in our CRM. These are reviewed by the Careers Adviser or Employability Coach |
|
| Post-guidance project | Summarising transcripts of guidance interviews to produce notes for our CRM (and, as a spin off, summary emails and action plans for customers). These are reviewed by the Careers Adviser or Employability Coach |
|
| CV Tailoring project | Tailoring generic customer CVs to match a specific job description (and, as a spin off, cover letters, model interview answers and suggested opportunities to fill skills and experience gaps) |
|
| Microsoft Dynamics 365 Contact Centre | AI features within the new contact centre:
|
|
1. Our lawful basis for processing personal data
Our lawful basis for processing personal information is:
- Public Task, Article 6 (e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
- We rely on an additional lawful basis to process your Special Categories of Personal Data. The lawful basis is "Reasons of substantial public interest (with a basis in law)" meeting the condition in Schedule 1, Part 2 of the Data Protection Act 2018 as below:
- (6) Statutory etc and government purposes
2. Who and where we get the personal data from
For our AI products we collect the data directly from our customers.
3. The categories of personal data we process
The personal data we process includes but is not exhaustive to below:
- Name
- Contact details
- Any details entered by customers into AI products on our website or personal data collected during discussions with our staff members
4. Who we share personal data with
We will not share your data from AI products with other organisations:
- We do not share personal data with our suppliers, and we will not be creating cloud-based AI platforms
- We will use ChatGPT in the form of Microsoft Copilot and our AI developments will not include a learning element
- Our AI products leverage Microsoft Azure’s cloud platform and its suite of AI products. No data will leave our Microsoft tenancy, Microsoft cannot access the data that is processed by our AI products, ensuring your data is secure and can only be accessed by Careers Wales
5. How personal data is used to train or improve our AI Products
Personal data is not used for AI training.
6. How do we keep your personal data safe?
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those of our employees who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
7. How long do we keep your personal data?
We will only keep your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. Details of retention periods for different aspects of your personal data are available in our retention policy which you can request from us by contacting our data privacy team using the contact details set out below in the further information section.
8. Individual rights
Under GDPR, you have the following rights in relation to the personal information you provide through any of the research conducted through the Employee Research Programme, specifically you have the right:
- To access a copy of your own data
- For us to rectify inaccuracies in that data
- To object to or restrict processing (in certain circumstances)
- For your data to be ‘erased’ (in certain circumstances); and
- To lodge a complaint with the Information Commissioner’s Office (ICO) who is our independent regulator for data protection
The contact details for the Information Commissioner’s Office are Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Phone: 01625 545 745 or 0303 123 1113. Website: www.ico.gov.uk
9. Further information
Careers Wales Data Protection Officer can be contacted in relation to data protection matters, by post at: Unit 4 Churchill House, 17 Churchill Way Cardiff CF10 2HH, or email: personal.data@careerswales.gov.wales