OpenAI is facing another privacy complaint in Europe over its viral AI chatbot\u2019s tendency to hallucinate false information \u2014 and this one might prove tricky for regulators to ignore.<\/p>\n
Privacy rights advocacy group Noyb<\/a> is supporting an individual in Norway who was horrified to find ChatGPT<\/a> returning made-up information that claimed he\u2019d been convicted for murdering two of his children and attempting to kill the third.<\/p>\n Earlier privacy complaints about ChatGPT generating incorrect personal data have involved issues such as an incorrect birth date<\/a> or biographical details that are wrong<\/a>. One concern is that OpenAI does not offer a way for individuals to correct incorrect information the AI generates about them. Typically OpenAI has offered to block responses for such prompts. But under the European Union\u2019s General Data Protection Regulation (GDPR), Europeans have a suite of data access rights that include a right to rectification of personal data.<\/p>\n Another component of this data protection law requires data controllers to make sure that the personal data they produce about individuals is accurate \u2014 and that\u2019s a concern Noyb is flagging with its latest ChatGPT complaint.<\/p>\n \u201cThe GDPR is clear. Personal data has to be accurate,\u201d said Joakim S\u00f6derberg, data protection lawyer at\u00a0Noyb, in a statement. \u201cIf it\u2019s not, users have the right to have it changed to reflect the truth. Showing ChatGPT users a tiny disclaimer that the chatbot can make mistakes clearly isn\u2019t enough. You can\u2019t just spread false information and in the end add a small disclaimer saying that everything you said may just not be true.\u201d<\/p>\n Confirmed breaches of the GDPR can lead to penalties of up to 4% of global annual turnover. <\/p>\n Enforcement could also force changes to AI products. Notably, an early GDPR intervention by Italy\u2019s data protection watchdog that saw ChatGPT access temporarily blocked in the country in spring 2023<\/a> led OpenAI to make changes to the information it discloses to users, for example. The watchdog subsequently went on to fine OpenAI \u20ac15 million<\/a> for processing people\u2019s data without a proper legal basis.<\/p>\n Since then, though, it\u2019s fair to say that privacy watchdogs around Europe have adopted a more cautious approach to GenAI as they try to figure out how best to apply the GDPR to these buzzy AI tools<\/a>. <\/p>\n Two years ago, Ireland\u2019s Data Protection Commission (DPC) \u2014 which has a lead GDPR enforcement role on a previous Noyb ChatGPT complaint \u2014 urged against rushing to ban<\/a> GenAI tools, for example. This suggests that regulators should instead take time to work out how the law applies.<\/p>\n And it\u2019s notable that a privacy complaint against ChatGPT that\u2019s been under investigation by Poland\u2019s data protection watchdog since September 2023<\/a> still hasn\u2019t yielded a decision. <\/p>\n Noyb\u2019s new ChatGPT complaint looks intended to shake privacy regulators awake when it comes to the dangers of hallucinating AIs.<\/p>\n The nonprofit shared the (below) screenshot with TechCrunch, which shows an interaction with ChatGPT in which the AI responds to a question asking \u201cwho is Arve Hjalmar Holmen?\u201d \u2014 the name of the individual bringing the complaint \u2014 by producing a tragic fiction that falsely states he was convicted for child murder and sentenced to 21 years in prison for slaying two of his own sons.<\/p>\n While the defamatory claim that Hjalmar Holmen is a child murderer is entirely false, Noyb notes that ChatGPT\u2019s response does include some truths, since the individual in question does have three children. The chatbot also got the genders of his children right. And his home town is correctly named. But that just it makes it all the more bizarre and unsettling that the AI hallucinated such gruesome falsehoods on top.<\/p>\n A spokesperson for Noyb said they were unable to determine why the chatbot produced such a specific yet false history for this individual. \u201cWe did research to make sure that this wasn\u2019t just a mix-up with another person,\u201d the spokesperson said, noting they\u2019d looked into newspaper archives but hadn\u2019t been able to find an explanation for why the AI fabricated child slaying.<\/p>\n Large language models<\/a> such as the one underlying ChatGPT essentially do next word prediction on a vast scale, so we could speculate that datasets used to train the tool contained lots of stories of filicide that influenced the word choices in response to a query about a named man.<\/p>\n Whatever the explanation, it\u2019s clear that such outputs are entirely unacceptable. <\/p>\n Noyb\u2019s contention is also that they are unlawful under EU data protection rules. And while OpenAI does display a tiny disclaimer at the bottom of the screen that says \u201cChatGPT can make mistakes. Check important info,\u201d it says this cannot absolve the AI developer of its duty under GDPR not to produce egregious falsehoods about people in the first place.<\/p>\n OpenAI has been contacted for a response to the complaint. <\/p>\n While this GDPR complaint pertains to one named individual, Noyb points to other instances of ChatGPT fabricating legally compromising information \u2014 such as the Australian major who said he was implicated in a bribery and corruption scandal<\/a> or a German journalist who was falsely named as a child abuser<\/a> \u2014 saying it\u2019s clear that this isn\u2019t an isolated issue for the AI tool.<\/p>\n One important thing to note is that, following an update to the underlying AI model powering ChatGPT, Noyb says the chatbot stopped producing the dangerous falsehoods about Hjalmar Holmen \u2014 a change that it links to the tool now searching the internet for information about people when asked who they are (whereas previously, a blank in its data set could, presumably, have encouraged it to hallucinate such a wildly wrong response).<\/p>\n In our own tests asking ChatGPT \u201cwho is Arve Hjalmar Holmen?\u201d the ChatGPT initially responded with a slightly odd combo by displaying some photos of different people, apparently sourced from sites including Instagram, SoundCloud, and Discogs, alongside text that claimed it \u201ccouldn\u2019t find any information\u201d on an individual of that name (see our screenshot below). A second attempt turned up a response that identified Arve Hjalmar Holmen as \u201ca Norwegian musician and songwriter\u201d whose albums include \u201cHonky Tonk Inferno.\u201d<\/p>\n While ChatGPT-generated dangerous falsehoods about Hjalmar Holmen appear to have stopped, both Noyb and Hjalmar Holmen remain concerned that incorrect and defamatory information about him could have been retained within the AI model.<\/p>\n \u201cAdding a disclaimer that you do not comply with the law does not make the law go away,\u201d noted Kleanthi Sardeli, another data protection lawyer at\u00a0Noyb, in a statement. \u201cAI companies can also not just \u2018hide\u2019 false information from users while they internally still process false information.\u201d<\/p>\n \u201cAI companies should stop acting as if the GDPR does not apply to them, when it clearly does,\u201d she added. \u201cIf hallucinations are not stopped, people can easily suffer reputational damage.\u201d<\/p>\n Noyb has filed the complaint against OpenAI with the Norwegian data protection authority \u2014 and it\u2019s hoping the watchdog will decide it is competent to investigate, since oyb is targeting the complaint at OpenAI\u2019s U.S. entity, arguing its Ireland office is not solely responsible for product decisions impacting Europeans.<\/p>\n However an earlier Noyb-backed GDPR complaint against OpenAI, which was filed in Austria in April 2024<\/a>, was referred by the regulator to Ireland\u2019s DPC on account of a change made by OpenAI earlier that year<\/a> to name its Irish division as the provider of the ChatGPT service to regional users.<\/p>\n Where is that complaint now? Still sitting on a desk in Ireland.<\/p>\n \u201cHaving received the complaint from the Austrian Supervisory Authority in September 2024, the DPC commenced the formal handling of the complaint and it is still ongoing,\u201d Risteard Byrne, assistant principal officer communications for the DPC told TechCrunch when asked for an update. <\/p>\n He did not offer any steer on when the DPC\u2019s investigation of ChatGPT\u2019s hallucinations is expected to conclude. <\/p>\n<\/div>\n![\"\"](\"https:\/\/techcrunch.com\/wp-content\/uploads\/2025\/03\/Screenshot-2025-03-19-at-18.19.42.png?w=680\")