alt Hacker NewsEmail addresses are PII. The GDPR also has higher protections for AI processing, like here.
If you’re in the EU, send a complaint to your data protection authority.
I imagine quite a few would be very interested in following up and investigating here, and getting Anthropic to drop the email from the system prompt.
Replies
No objection to your assertion; but it seems much harder to fix than just that. Doing `git log -n 1` will pull up an email 99% of the time. It may not be the same email, but it's just as PII anyway.
I suspect the privacy plugin method is a more sane fix -- ideally, plain old code should be inspecting any web request my agent makes and let me decide if that outbound request should contain certain sensitive strings. I'd also want to put a few bytes of my SSH private key and of any other sensitive keys in the 'do not leak' watchlist as well.
I'm going to send the complaint. They've been sharing my PII without my consent and knowledge.
Nice that this time we get the company to admit it in public, and that they've been aware of that earlier but only acted now.