Privacy Group Complained Against ChatGPT's GDPR Violations
A complaint lodged by privacy advocacy group Noyb with the Austrian data protection authority DSB alleged that ChatGPT’s generation of inaccurate information violates the European Union’s privacy regulations.
The Vienna-based digital rights group Noyb, founded by known activist Max Schrems, said in its complaint that ChatGPT’s failure to provide accurate personal data and instead guessing it, violates the GDPR requirements.
Violation of GDPR Provisions
Under GDPR, an individual’s personal details, including date of birth, are considered personal data and are subject to stringent handling requirements. The complaint contends that ChatGPT breaches GDPR provisions on privacy, data accuracy, and the right to rectify inaccurate information.
Noyb claimed that OpenAI, the company behind ChatGPT, refused to correct or delete erroneous responses and has withheld information about its data processing, sources, and recipients.
Legal Compliance and Transparency
Noyb’s data protection lawyer, Maartje de Graaf said, “If a system cannot produce accurate and transparent results, it cannot be used to generate data about individuals. The technology has to follow the legal requirements, not the other way around.”
Citing a report from The New York Times, which found that “chatbots invent information at least 3% of the time – and as high as 27%,” Noyb emphasized the prevalence of inaccurate responses generated by AI systems like ChatGPT.
Privacy by Pressure Approach
Luiza Jarovsky, chief executive officer of Implement Privacy, has previously said that artificial intelligence-based large language models follow a “privacy by pressure” approach, only acting when something goes wrong, when there is a public backlash, or when legally required.
She argued that if ChatGPT has “hallucinations,” then prompts about individuals should come back empty, and there should be no output containing personal data.
GDPR Compliance and Consequences
Jarovsky highlighted the importance of adhering to GDPR rights such as the right of access, right to rectification, and right to erasure, which may not be feasible in the context of generative AI/LLMs due to the way these systems are trained.
The complaint urges the Austrian authority to investigate OpenAI’s handling of personal data to ensure compliance with GDPR. It also demands that OpenAI disclose individuals’ personal data upon request and seeks imposition of an “effective, proportionate, dissuasive, administrative fine.
Regulatory Scrutiny and Potential Penalties
The potential consequences of GDPR violations are significant, with penalties amounting to up to 4% of a company’s global revenue.
OpenAI’s response to the allegations remains pending, and the company faces scrutiny from other European regulators as well. Italy’s data protection authority had previously banned ChatGPT’s operations in the country over similar GDPR concerns, leading to coordinated efforts among national privacy regulators regarding ChatGPT.
