\n<\/p>\n
OpenAI is facing another investigation into whether its generative AI chatbot, ChatGPT, complies with European Union privacy laws.<\/p>\n
Last month<\/a> a complaint was filed against ChatGPT and OpenAI in Poland, accusing the company of a string of breaches of the EU\u2019s General Data Protection Regulation (GDPR). Yesterday the Polish authority took the unusual step of making a public announcement<\/a> to confirm it has opened an investigation.<\/p>\n \u201cThe Office for Personal Data Protection [UODO] is investigating a complaint about ChatGPT, in which the complainant accuses the tool\u2019s creator, OpenAI, of, among other things, processing data in an unlawful, unreliable manner, and the rules under which this is done are opaque,\u201d the UODO wrote in a press release [translated from Polish to English using DeepL<\/a>].<\/p>\n The authority said it\u2019s anticipating a \u201cdifficult\u201d investigation \u2014 noting OpenAI is located outside the EU and flagging the novelty of the generative AI chatbot technology whose compliance it will be examining.<\/p>\n \u201cThe case concerns the violation of many provisions of the protection of personal data, so we will ask OpenAI to answer a number of questions in order to thoroughly conduct the administrative proceedings,\u201d said Jan Nowak, president of the UODO, in a statement.<\/p>\n Deputy president, Jakub Groszkowski, added a warning to the authority\u2019s press release<\/a> \u2014 writing that new technologies do not operate outside the legal framework and must respect the GDPR. He said the complaint contains allegations that raise doubts about OpenAI\u2019s systemic approach to European data protection principles, adding that the authority would \u201cclarify these doubts, in particular against the background of the fundamental principle of privacy by design contained in the GDPR\u201d.<\/p>\n The complaint, which was filed by local privacy and security researcher Lukasz Olejnik<\/a>, accuses OpenAI of a string of breaches of the pan-EU regulation \u2014 spanning lawful basis, transparency, fairness, data access rights, and privacy by design.<\/p>\n It focuses on OpenAI\u2019s response to a request by Olejnik to correct incorrect personal data in a biography ChatGPT generated about him \u2014 but which OpenAI told him it was unable to do. He also accuses the AI giant of failing to properly respond to his subject access request \u2014 and of providing evasive, misleading and internally contradictory answers when he sought to exercise his legal rights to data access.<\/p>\n The tech underlying ChatGPT is a so-called large language model (LLM) \u2014 a type of generative AI model that\u2019s trained on masses of natural language data so it can both respond in a human like manner. But also, given the general purpose utility of the tool, it\u2019s evidently been trained on all sorts of types of information so it can respond to different questions and asks \u2014 including, in many cases, being fed data about living people.<\/p>\n OpenAI\u2019s scraping of the public Internet for training data, without people\u2019s knowledge or consent, is one of the big factors that\u2019s landed ChatGPT in regulatory hot water in the EU. Its apparent inability to articulate exactly how it\u2019s processing personal data; or to correct mistakes when its AI \u201challucinates\u201d and produces false information about named individuals are others.<\/p>\n The bloc regulates how personal data is processed, requiring a processor has a lawful basis to collect and use people\u2019s information. Processors must also meet transparency and fairness requirements. Plus a suite of data access rights are afforded to people in the EU \u2014 meaning EU individuals have (among other things) a right to ask for incorrect data about them to be rectified.<\/p>\n Olejnik\u2019s complaint tests OpenAI\u2019s GDPR compliance across a number of those dimensions. So any enforcement could be significant in shaping how generative AI develops.<\/p>\n Reacting to the UODO\u2019s confirmation it\u2019s investigating the ChatGPT complaint, Olejnik told TechCrunch: \u201cFocusing on privacy by design\/data protection by design is absolutely critical and I expected this to be the main aspect. So this sounds reasonable. It would concern the design and deployment aspects of LLM systems.\u201d<\/p>\n He previously described the experience of trying to get answers from OpenAI about its processing of his information as feeling like Josef K, in Kafka\u2019s book The Trial. <\/em>\u201cIf this may be the Josef K. moment for AI\/LLM, let\u2019s hope that it may shed light on the processes involved,\u201d he added now.<\/p>\n The relative speed with which the Polish authority is moving in response to the complaint, as well as its openness about the investigation, does look notable.<\/p>\n It adds to growing regulatory issues OpenAI is facing the European Union. The Polish investigation follows an intervention by Italy\u2019s DPA earlier this year<\/a> \u2014 which led to a temporary suspension of ChatGPT in the country. The scrutiny by the Garante<\/em> continues, also looking into GDPR compliance concerns attached to factors like lawful basis and data access rights.<\/p>\n Elsewhere, Spain\u2019s DPA has opened a probe<\/a>. While a taskforce set up via the European Data Protection Board earlier this year is looking at how data protection authorities should respond to the AI chatbot tech with the goal of pushing to find some consensus among the bloc\u2019s privacy watchdogs on how to regulate such novel tech.<\/p>\n The taskforce does not supplant investigations by individual authorities. But, in the future, it may lead to some harmonization in how DPAs approach regulating cutting edge AI. That said, divergence is also possible if there are strong and varied views among DPAs. And it remains to be seen what further enforcement actions the bloc\u2019s watchdogs could take on tools like ChatGPT. (Or, indeed, how quickly they may act.)<\/span><\/p>\n In the UODO\u2019s press release \u2014 which nods to the existence of the taskforce \u2014 its president says the authority is taking the ChatGPT investigation \u201cvery seriously\u201d. He also notes the complaint\u2019s allegations are not the first doubts vis-a-vis ChatGPT\u2019s compliance with European data protection and privacy rules.<\/p>\n Discussing the authority\u2019s openness and pace, Maciej Gawronski of law firm GP Partners, which is representing Olejnik for the complaint, told TechCrunch:\u00a0\u201cUODO is becoming more and more vocal about privacy, data protection, technology and human rights. So, I think, our complaint creates an opportunity for [it] to work on reconciling digital and societal progress with individual agency and human rights.<\/p>\n \u201cMind that Poland is a very advanced country regarding IT. I would expect UODO to be very reasonable in their approach and proceedings. Of course, as long as OpenAI remains open, for discussion.\u201d<\/p>\n Asked if he\u2019s expecting a quick decision on the complaint, Gawronski added: \u201cThe authority is monitoring technology advancements pretty closely. I am at UODO\u2019s conference on new technologies at the moment. UODO has already been approached re AI by various actors. However, I do not expect a fast decision. Nor it is my intention to conclude the proceedings prematurely. I would prefer to have an honest and insightful discussion with OpenAI on what, when, how, and how much, regarding ChatGPT\u2019s GDPR compliance, and in particular how to satisfy rights of the data subject.\u201d<\/p>\n OpenAI was contacted for comment on the Polish DPA\u2019s investigation but did not send any response.<\/p>\n The AI giant is not sitting still in response to an increasingly complex regulatory picture in the EU. It recently announced<\/a> opening an office in Dublin, Ireland \u2014 likely with an eye on building towards streamlining its regulatory situation for data protection if it can funnel any GDPR complaints via Ireland.<\/p>\n However, for now, the US company is not considered \u201cmain established\u201d in any EU Member State (including Ireland) for GDPR purposes, since decisions affecting local users continue to be taken at its US HQ in California. So far, the Dublin office is just a tiny satellite. This means data protection authorities across the bloc remain competent to investigate concerns about ChatGPT that arise on their patch. So more investigations could follow.<\/p>\n Complaints which predate any future main establishment status change for OpenAI could also still be filed anywhere in the EU.<\/p>\n<\/p><\/div>\n