Privacy opt-in for Semantic Data Search

[SVinchi]

• Adding a group on Copilot and AI settings page to define privacy notice for Semantic Data Search
• Register Semantic Data Search privacy notice in SystemPrivacyNoticeReg
• Add UI toggle and privacy notice integration on Copilot AI Capabilities page

Porting changes from Platform-Core PR #233155

Fixes AB#623789

[msft-sam]

Does the data apply to across companies? We have some logic where we enable the privacy notice for evaluation companies, but if we build the metadata across all companies this could be an issue, as switching company would then mark the notice as disabled. As this is the object metadata and is across companies, we probably need to leave it disabled, even for eval companies.

edit: alternatively, what is the difference between this and the AOAI privacy notice -- aren't we sending the data to the same place?

[SVinchi]

Does the data apply to across companies? We have some logic where we enable the privacy notice for evaluation companies, but if we build the metadata across all companies this could be an issue, as switching company would then mark the notice as disabled. As this is the object metadata and is across companies, we probably need to leave it disabled, even for eval companies.

When privacy notice is enabled, the approval is stored without any company identifier. This means privacy approval is applied across companies

edit: alternatively, what is the difference between this and the AOAI privacy notice -- aren't we sending the data to the same place?

AOAI privacy notice is conditional and only shown when AOAI services are not present in the region. The privacy notice for semantic search needs to be shown in all regions and hence we could not re-purpose AOAI privacy notice

[msft-sam]

When privacy notice is enabled, the approval is stored without any company identifier. This means privacy approval is applied across companies

There is an edge case where the privacy notice is not set. When validated through Copilot capabilities the SkipCheckInEval parameter is set to true. We probably need to include additional metadata to indicate whether we can do this for scenarios such as this one, so the notice is consistently respected in eval and non-eval companies in the event we send data that is not per company.

AOAI privacy notice is conditional and only shown when AOAI services are not present in the region.

I assume you will be able to follow the same logic, consent is only needed if you leave the current geo. Admins can still control the consent via the privacy notices page in any case.

[SVinchi]

When privacy notice is enabled, the approval is stored without any company identifier. This means privacy approval is applied across companies

There is an edge case where the privacy notice is not set. When validated through Copilot capabilities the SkipCheckInEval parameter is set to true. We probably need to include additional metadata to indicate whether we can do this for scenarios such as this one, so the notice is consistently respected in eval and non-eval companies in the event we send data that is not per company.

For now we're not using this codeunit to evaluate consent but yes, this needs to be fixed.