ChatGPT under threat of sanction in Europe for non-compliance with GDPR

ChatGPT would be in the process of being caught up by Brussels. On the other side, in the Alps, the personal data policeman has filed a formal complaint against the conversational robot.

Can we create the most sophisticated chatbot in the world without absorbing some personal data? If we are to believe the setbacks that ChatGPT is experiencing in Italy, the answer is no. The GPDP, the transalpine CNIL, has officially criticized OpenAI for breaches of the GDPR which could cost the company dearly.

ChatGPT, too greedy for personal data

This warning comes after a first widespread blocking of the service at the end of March 2023 and the opening of an investigation in France. And if the authority does not publicly specify what ChatGPT is accused of, between the lines, we understand that it is the robot’s insatiable appetite for data, often personal, that makes people cringe.

The intensive training of ChatGPT on the billions of texts, images and other videos available on the web would have irremediably allowed the machine to absorb personal data belonging to Internet users on the old continent.

Remember that, according to the CNIL (ours this time), surnames, first names, pseudonyms, dates of birth, photos, sound recordings of voices, landline or mobile telephone numbers, as well as postal addresses and email addresses constitute personal data . The probability that the OpenAI robot will have, during its learning phase, ingested data like this on European users is therefore high.

Wobbly legal bases

Except that, as the Italian data policeman clarified last March, this was done in “the absence of a suitable legal basis» and therefore, in clear violation of the GDPR. The efforts made by the company last year therefore do not seem to have been enough since the GPDP considers that OpenAI would have contravened 5 articles of the text (5, 6, 8, 13 and 25). The authority gave the company 30 days to provide a response and details of a compliance plan.

Unfortunately, this looks complicated. The legal bases on which OpenAI can rely are limited to prior consent (unthinkable, given the quantity of data ingested) and “legitimate interest“. While this second path may seem viable, it has its own difficulties. Even based on this, OpenAI should offer the possibility for any Internet user to request the deletion of data collected on their person. A complex job given the number of European citizens potentially concerned and the volume of data (not always well identified) absorbed by ChatGPT.

ChatGPT future threatened?

And this is without even counting on the voice of the European Court of Justice which has already ruled, in a case concerning Facebook, that the intensive processing of personal data for the purpose of serving targeted advertising does not fall within the scope of the law. “legitimate interest”. If the goal of ChatGPT is a little different from that of Facebook, building a huge commercial machine on petabytes of personal data generally seems frowned upon by the Brussels authorities.

Technically therefore, bringing ChatGPT into compliance with European laws promises to be complex. And if OpenAI does not make an effort, the Italian complaint could snowball across the entire old continent and lead to very large fines, or even the suspension of the service in Europe. The future of ChatGPT on the continent therefore depends on a complex legal battle.

Source : GPDP via Techchrunch