EU’s ChatGPT taskforce offers first take a look at detangling the AI chatbot’s privacy compliance

An information protection taskforce that’s spent over a 12 months considering how the European Union’s data protection rulebook applies to OpenAI’s viral chatbot, ChatGPT, reported preliminary conclusions Friday. The highest-line takeaway is that the working group of privacy enforcers stays undecided on crux legal issues, akin to the lawfulness and fairness of OpenAI’s processing.

The difficulty is vital as penalties for confirmed violations of the bloc’s privacy regime can reach as much as 4% of world annual turnover. Watchdogs can even order non-compliant processing to stop. So — in theory — OpenAI is facing considerable regulatory risk within the region at a time when dedicated laws for AI are thin on the bottom (and, even within the EU’s case, years away from being fully operational).

But without clarity from EU data protection enforcers on how current data protection laws apply to ChatGPT, it’s a secure bet that OpenAI will feel empowered to proceed business as usual — despite the existence of a growing variety of complaints its technology violates various facets of the bloc’s General Data Protection Regulation (GDPR).

For instance, this investigation from Poland’s data protection authority (DPA) was opened following a criticism in regards to the chatbot making up details about a person and refusing to correct the errors. An analogous criticism was recently lodged in Austria.

A number of GDPR complaints, lots less enforcement

On paper, the GDPR applies at any time when personal data is collected and processed — something large language models (LLMs) like OpenAI’s GPT, the AI model behind ChatGPT, are demonstrably doing at vast scale after they scrape data off the general public web to coach their models, including by syphoning people’s posts off social media platforms.

The EU regulation also empowers DPAs to order any non-compliant processing to stop. This could possibly be a really powerful lever for shaping how the AI giant behind ChatGPT can operate within the region if GDPR enforcers select to drag it.

Indeed, we saw a glimpse of this last 12 months when Italy’s privacy watchdog hit OpenAI with a short lived ban on processing the info of local users of ChatGPT. The motion, taken using emergency powers contained within the GDPR, led to the AI giant briefly shutting down the service within the country.

ChatGPT only resumed in Italy after OpenAI made changes to the data and controls it provides to users in response to an inventory of demands by the DPA. However the Italian investigation into the chatbot, including crux issues just like the legal basis OpenAI claims for processing people’s data to coach its AI models in the primary place, continues. So the tool stays under a legal cloud within the EU.

Under the GDPR, any entity that wishes to process data about people should have a legal basis for the operation. The regulation sets out six possible bases — though most are usually not available in OpenAI’s context. And the Italian DPA already instructed the AI giant it cannot depend on claiming a contractual necessity to process people’s data to coach its AIs — leaving it with just two possible legal bases: either consent (i.e. asking users for permission to make use of their data); or a wide-ranging basis called legitimate interests (LI), which demands a balancing test and requires the controller to permit users to object to the processing.

Since Italy’s intervention, OpenAI appears to have switched to claiming it has a LI for processing personal data used for model training. Nevertheless, in January, the DPA’s draft decision on its investigation found OpenAI had violated the GDPR. Although no details of the draft findings were published so now we have yet to see the authority’s full assessment on the legal basis point. A final decision on the criticism stays pending.

A precision ‘fix’ for ChatGPT’s lawfulness?

The taskforce’s report discusses this knotty lawfulness issue, declaring ChatGPT needs a legitimate legal basis for all stages of non-public data processing — including collection of coaching data; pre-processing of the info (akin to filtering); training itself; prompts and ChatGPT outputs; and any training on ChatGPT prompts.

The primary three of the listed stages carry what the taskforce couches as “peculiar risks” for people’s fundamental rights — with the report highlighting how the dimensions and automation of web scraping can result in large volumes of non-public data being ingested, covering many facets of individuals’s lives. It also notes scraped data may include essentially the most sensitive sorts of personal data (which the GDPR refers to as “special category data”), akin to health info, sexuality, political opinions etc, which requires an excellent higher legal bar for processing than general personal data.

On special category data, the taskforce also asserts that simply because it’s public doesn’t mean it may possibly be considered to have been made “manifestly” public — which might trigger an exemption from the GDPR requirement for explicit consent to process this kind of data. (“In an effort to depend on the exception laid down in Article 9(2)(e) GDPR, it is vital to establish whether the info subject had intended, explicitly and by a transparent affirmative motion, to make the non-public data in query accessible to most people,” it writes on this.)

To depend on LI as its legal basis usually, OpenAI must show it must process the info; the processing must also be limited to what’s needed for this need; and it must undertake a balancing test, weighing its legitimate interests within the processing against the rights and freedoms of the info subjects (i.e. people the info is about).

Here, the taskforce has one other suggestion, writing that “adequate safeguards” — akin to “technical measures”, defining “precise collection criteria” and/or blocking out certain data categories or sources (like social media profiles), to permit for less data to be collected in the primary place to scale back impacts on individuals — could “change the balancing test in favor of the controller”, because it puts it.

This approach could force AI firms to take more care about how and what data they collect to limit privacy risks.

“Moreover, measures needs to be in place to delete or anonymise personal data that has been collected via web scraping before the training stage,” the taskforce also suggests.

OpenAI can also be in search of to depend on LI for processing ChatGPT users’ prompt data for model training. On this, the report emphasizes the necessity for users to be “clearly and demonstrably informed” such content could also be used for training purposes — noting that is one in every of the aspects that will be considered within the balancing test for LI.

It can be as much as the person DPAs assessing complaints to come to a decision if the AI giant has fulfilled the necessities to truly give you the chance to depend on LI. If it may possibly’t, ChatGPT’s maker can be left with just one legal option within the EU: asking residents for consent. And given how many individuals’s data is probably going contained in training data-sets it’s unclear how workable that will be. (Deals the AI giant is fast cutting with news publishers to license their journalism, meanwhile, wouldn’t translate right into a template for licensing European’s personal data because the law doesn’t allow people to sell their consent; consent should be freely given.)

Fairness & transparency aren’t optional

Elsewhere, on the GDPR’s fairness principle, the taskforce’s report stresses that privacy risk can’t be transferred to the user, akin to by embedding a clause in T&Cs that “data subjects are liable for their chat inputs”.

“OpenAI stays liable for complying with the GDPR and mustn’t argue that the input of certain personal data was prohibited in first place,” it adds.

On transparency obligations, the taskforce appears to just accept OpenAI could make use of an exemption (GDPR Article 14(5)(b)) to notify individuals about data collected about them, given the dimensions of the net scraping involved in acquiring data-sets to coach LLMs. But its report reiterates the “particular importance” of informing users their inputs could also be used for training purposes.

The report also touches on the difficulty of ChatGPT ‘hallucinating’ (making information up), warning that the GDPR “principle of information accuracy should be complied with” — and emphasizing the necessity for OpenAI to due to this fact provide “proper information” on the “probabilistic output” of the chatbot and its “limited level of reliability”.

The taskforce also suggests OpenAI provides users with an “explicit reference” that generated text “could also be biased or made up”.

On data subject rights, akin to the suitable to rectification of non-public data — which has been the main focus of quite a few GDPR complaints about ChatGPT — the report describes it as “imperative” persons are capable of easily exercise their rights. It also observes limitations in OpenAI’s current approach, including the very fact it doesn’t let users have incorrect personal information generated about them corrected, but only offers to dam the generation.

Nevertheless the taskforce doesn’t offer clear guidance on how OpenAI can improve the “modalities” it offers users to exercise their data rights — it just makes a generic suggestion the corporate applies “appropriate measures designed to implement data protection principles in an efficient manner” and “needed safeguards” to fulfill the necessities of the GDPR and protect the rights of information subjects”. Which sounds lots like ‘we don’t know find out how to fix this either’.

ChatGPT GDPR enforcement on ice?

The ChatGPT taskforce was arrange, back in April 2023, on the heels of Italy’s headline-grabbing intervention on OpenAI, with the aim of streamlining enforcement of the bloc’s privacy rules on the nascent technology. The taskforce operates inside a regulatory body called the European Data Protection Board (EDPB), which steers application of EU law on this area. Even though it’s vital to notice DPAs remain independent and are competent to implement the law on their very own patch where GDPR enforcement is decentralized.

Despite the indelible independence of DPAs to implement locally, there may be clearly some nervousness/risk aversion amongst watchdogs about find out how to reply to a nascent tech like ChatGPT.

Earlier this 12 months, when the Italian DPA announced its draft decision, it made some extent of noting its proceeding would “take note of” the work of the EDPB taskforce. And there other signs watchdogs could also be more inclined to attend for the working group to weigh in with a final report — perhaps in one other 12 months’s time — before wading in with their very own enforcements. So the taskforce’s mere existence may already be influencing GDPR enforcements on OpenAI’s chatbot by delaying decisions and putting investigations of complaints into the slow lane.

For instance, in a recent interview in local media, Poland’s data protection authority suggested its investigation into OpenAI would want to attend for the taskforce to finish its work.

The watchdog didn’t respond once we asked whether it’s delaying enforcement due to ChatGPT taskforce’s parallel workstream. While a spokesperson for the EDPB told us the taskforce’s work “doesn’t prejudge the evaluation that will probably be made by each DPA of their respective, ongoing investigations”. But they added: “While DPAs are competent to implement, the EDPB has a vital role to play in promoting cooperation between DPAs on enforcement.”

Because it stands, there looks to be a substantial spectrum of views amongst DPAs on how urgently they need to act on concerns about ChatGPT. So, while Italy’s watchdog made headlines for its swift interventions last 12 months, Ireland’s (now former) data protection commissioner, Helen Dixon, told a Bloomberg conference in 2023 that DPAs shouldn’t rush to ban ChatGPT — arguing they needed to take time to determine “find out how to regulate it properly”.

It is probably going no accident that OpenAI moved to establish an EU operation in Ireland last fall. The move was quietly followed, in December, by a change to its T&Cs — naming its recent Irish entity, OpenAI Ireland Limited, because the regional provider of services akin to ChatGPT — establishing a structure whereby the AI giant was capable of apply for Ireland’s Data Protection Commission (DPC) to turn into its lead supervisor for GDPR oversight.

This regulatory-risk-focused legal restructuring appears to have paid off for OpenAI because the EDPB ChatGPT taskforce’s report suggests the corporate was granted predominant establishment status as of February 15 this 12 months — allowing it to reap the benefits of a mechanism within the GDPR called the One-Stop Shop (OSS), which implies any cross border complaints arising since then will get funnelled via a lead DPA within the country of predominant establishment (i.e., in OpenAI’s case, Ireland).

While all this will sound pretty wonky it mainly means the AI company can now dodge the danger of further decentralized GDPR enforcement — like we’ve seen in Italy and Poland — as it should be Ireland’s DPC that gets to take decisions on which complaints get investigated, how and when going forward.

The Irish watchdog has gained a repute for taking a business-friendly approach to enforcing the GDPR on Big Tech. In other words, ‘Big AI’ could also be next in line to learn from Dublin’s largess in interpreting the bloc’s data protection rulebook.

OpenAI was contacted for a response to the EDPB taskforce’s preliminary report but at press time it had not responded.