OpenAI’s ChatGPT Faces EU Privacy Investigation: Compliance with GDPR Under Scrutiny
OpenAI, the artificial intelligence (AI) company, is now facing an investigation into whether its generative AI chatbot, ChatGPT, complies with the European Union’s privacy laws. The investigation comes after a complaint was filed in Poland last month, accusing OpenAI of multiple breaches of the General Data Protection Regulation (GDPR). The Polish authority, known as the Office for Personal Data Protection (UODO), confirmed that it has opened an inquiry into the matter.
In its press release, the UODO stated that the investigation focuses on the complainant’s accusations that OpenAI processes data in an unlawful and unreliable manner, with opaque rules governing the process. Due to the nature of generative AI chatbot technology and OpenAI’s location outside the EU, the investigation is expected to be challenging.
Jan Nowak, President of the UODO, announced that the case involves the violation of numerous provisions of personal data protection. To conduct a thorough administrative proceeding, the UODO will be requesting OpenAI to provide answers to several questions. Jakub Groszkowski, Deputy President, emphasized that new technologies must adhere to the GDPR’s privacy by design principle and raised concerns about OpenAI’s systemic approach to European data protection principles.
The complaint, filed by Lukasz Olejnik, a local privacy and security researcher, accuses OpenAI of breaching several aspects of the GDPR, including data access rights, transparency, fairness, and privacy by design. Olejnik’s complaint primarily centers around OpenAI’s response to his request to correct incorrect personal data that ChatGPT generated about him. OpenAI claimed that it was unable to make the corrections. He also accuses the company of providing evasive and contradictory answers when trying to exercise his legal right to data access.
The use of large language models (LLMs) such as ChatGPT, which are trained on vast amounts of natural language data, is one of the major factors leading to regulatory scrutiny in the EU. OpenAI’s scraping of public internet data without individuals’ knowledge or consent raises concerns about how personal data is processed, as GDPR requires a lawful basis and transparency for collecting and using people’s information. Additionally, EU individuals have the right to rectify incorrect data about themselves.
Olejnik believes that focusing on privacy by design and data protection is critical. He expressed his hope that the investigation will shed light on the processes involved in AI and LLM systems. The speed and transparency with which the Polish authority is conducting the investigation are notable, adding to the growing regulatory issues faced by OpenAI in the EU. Italy’s Data Protection Authority (DPA) previously intervened, leading to the temporary suspension of ChatGPT in the country, and Spain’s DPA has also opened a probe.
While a task force established by the European Data Protection Board is examining how data protection authorities should regulate AI chatbot technology, the investigations by individual authorities continue. The UODO’s openness and deliberate pace indicate its commitment to addressing privacy concerns and reconciling digital progress with individual rights.
OpenAI has recently opened an office in Dublin, Ireland, potentially aiming to streamline its data protection regulatory situation and route GDPR complaints through Ireland. However, for now, OpenAI’s main decisions regarding local users are still made at its US headquarters in California. Therefore, data protection authorities across the EU maintain jurisdiction to investigate ChatGPT-related concerns. Further investigations may follow, as complainants can file pre-existing complaints anywhere in the EU.
