On April 29 2024, the activist group None of Your Business (NOYB) filed a complaint against OpenAI with the Austrian data protection authority (DSB). The complaint alleged that the processing of personal information by OpenAI, through its AI model ChatGPT, violates the General Data Protection Regulation (GDPR).

Who should care about the complaint against OpenAI

  • People in the EU. Because the GDPR applies to them and their personal data. ChatGPT can generate inaccurate information which can damage reputations or be used for other malicious purposes.
  • Users of ChatGPT. Anyone who uses ChatGPT to get information should be aware that it may not be accurate, especially for sensitive topics like personal information about individuals.
  • Developers of large language models. The complaint and subsequent investigation can set a precedent for how these models need to be designed and implemented to comply with data protection regulations.
  • Companies using ChatGPT APIs can face potential reputational risks if inaccurate information is generated about individuals, and their API access or functionality could be impacted by regulatory decisions.

Overview of the complaint against OpenAI

The crux of the complaint against OpenAI lies in two main issues.

1. Inaccurate personal information

NOYB’s complaint against OpenAI argues that ChatGPT generates inaccurate personal information about individuals. This violates Article 5 of the GDPR, which requires personal data to be accurate and promptly corrected if incorrect. NOYB highlights that while ChatGPT is trained on a massive dataset, it can’t guarantee factual information. They call this tendency to create responses without factual grounding “hallucinations.” Therefore, NOYB argues such hallucinations are unacceptable, especially when it comes to personal data.

2. Limited access to Data

NOYB’s complaint against OpenAI claims OpenAI violates Articles 12(3) and 15 of the GDPR. These articles grant individuals the right to access their personal data and request its correction or erasure. According to NOYB, OpenAI refused to correct or erase inaccurate information and failed to disclose details about the data it processes or its sources.

Seeking Accountability: Investigation and Action

NOYB have requested an investigation into OpenAI’s data processing practices, focusing on measures taken to ensure the accuracy of personal data handled by ChatGPT. Additionally, NOYB have demanded that the DSB order OpenAI to comply with GDPR by:

  • fixing how ChatGPT works to guarantee accurate personal information;
  • responding to requests to access and correct personal data.

Impact of the complaint on generative AI users and providers

We won’t know the outcome of the investigation for some time. Below are some key takeaways we can gain from NOYB’s complaint against OpenAI.

  1. It is possible for ChatGPT to have ‘hallucinations’. These outputs can contain personal data and can have damaging reputational consequences. It is important that users are aware that ChatGPT and other AI models can output inaccurate personal data.
  2. Open AI could potentially face penalties for breaching the GDPR and authorities could force it to temporarily shut down ChatGPT in order to make the necessary changes
  3. Consequently, the result of the investigation by the DSB could have consequences for other provider’s of generative AI tools that similarly have to comply with the GDPR.

Actions to take next

  1. Ensure your generative AI system complies with privacy laws and best practices by joining our Data Protection Programme and working through the Conducting privacy impact assessments module and the module on Managing the data protection risks of AI projects.
  2. Worry less about Privacy Impact Assessments by asking us to do one for you.
  3. Understand the impact of data protection on your AI systems by filling in our quick and free organisational impact assessment.
  4. Empower yourself to know your rights as a user of generative AI by reading about the GDPR at the European Commission’s website.
  5. Educate yourself by reading about the complaint filed by NYOB.