EU Privacy Watchdog Releases Findings on ChatGPT

The European Data Protection Board (EDPB) has released the preliminary findings of its investigation into whether OpenAI’s ChatGPT complies with the EU’s General Data Protection Regulation (GDPR). Regulators are concerned about the accuracy of such AI tools and the use of personal data to train large language models (LLMs) like ChatGPT.

The report was published by a ChatGPT Taskforce established in April 2023. The group, composed of representatives from multiple countries, coordinated investigations into ChatGPT, which were launched by EU member states last year and are still ongoing.

This initial report provides preliminary findings related to the lawfulness, fairness, and transparency of the processing of personal data in the scope of ChatGPT, as well as the accuracy of ChatGPT’s output and the rights of the data subjects. The task force said: “It has to be noted that OpenAI already implemented measures to comply with, among other things, Italy’s temporary ban on ChatGPT in March 2023”. Italy lifted the suspension a few weeks later in response.

The report said the assessment of ChatGPT’s lawfulness is still subject to ongoing investigations, but it described adequate safeguards, such as deleting or anonymizing personal data when it is collected before the training stage.

The report also highlights the need for OpenAI to ensure that personal data inputted by users for prompts does not appear in the results of other users. It said that OpenAI cannot avoid this by adding a clause to its Terms and Conditions that states that users are responsible for inputs.

The study emphasized the level of accountability OpenAI offers over the accuracy of ChatGPT models’ output. The report notes that OpenAI must ensure users know the limits of ChatGPT’s output. It said that OpenAI’s newer safeguards “are beneficial” but “not sufficient” to comply with the data accuracy principle of the GDPR.

The GDPR came into effect in May 2018 in all European Union member states. It is the set of regulations that “harmonize data privacy laws across Europe.” It was designed around the key principle that personal data shall be “processed lawfully, fairly, and in a transparent manner in relation to the data subject.”

It remains to be seen whether the release of the new multimodal GPT-4o will address any of these issues or raise even more alarms.