{"id":23794,"date":"2023-04-13T01:24:56","date_gmt":"2023-04-13T08:24:56","guid":{"rendered":"https:\/\/www.privateinternetaccess.com\/blog\/?p=23794"},"modified":"2023-04-14T11:12:00","modified_gmt":"2023-04-14T11:12:00","slug":"chatgpt-data-privacy-scrutiny","status":"publish","type":"post","link":"https:\/\/www.privateinternetaccess.com\/blog\/chatgpt-data-privacy-scrutiny\/","title":{"rendered":"Data Protection Authorities Around the World Investigate ChatGPT Over Privacy Concerns"},"content":{"rendered":"\n

At the beginning of February, when the excitement over generative AI systems like ChatGPT was starting to build, I warned on the PIA blog<\/a> \u201cit seems certain that much of the data ChatGPT has ingested is subject to the EU\u2019s General Data Protection Regulation (GDPR)\u201d. Now Italy\u2019s data protection agency, \u201cIl Garante per la protezione dei dati personali\u201d, has shut down the use of ChatGPT<\/a> in the country precisely because of concerns that it violates the GDPR. As BBC News reports, the Italian authorities see multiple reasons why ChatGPT should be blocked<\/a>:<\/p>\n\n\n\n

\n

The watchdog said on 20 March that the app had experienced a data breach involving user conversations and payment information.<\/p>\n\n\n\n

It said there was no legal basis to justify \u201cthe mass collection and storage of personal data for the purpose of \u2018training\u2019 the algorithms underlying the operation of the platform\u201d.<\/p>\n\n\n\n

It also said that since there was no way to verify the age of users, the app \u201cexposes minors to absolutely unsuitable answers compared to their degree of development and awareness\u201d.<\/p>\n<\/blockquote>\n\n\n\n

It\u2019s not just Italy. According to a report by Reuters<\/a>, privacy regulators in France have contacted the relevant authorities in Italy for more details about the ban, and Ireland\u2019s Data Protection Commissioner has said it will do the same. <\/p>\n\n\n\n

ChatGPT\u2019s Problems with EU Data Privacy Are Just Starting<\/h2>\n\n\n\n

Meanwhile, the German commissioner for data protection has said that it may also block ChatGPT because of GDPR issues. A report in Der Spiegel<\/a> explains (translation by DeepL<\/a>):<\/p>\n\n\n\n

\n

the German data protection authority supports the approach of its Italian colleagues. \u201cTraining data from an AI is subject to the GDPR, just like other data, if it is personal data,\u201d a spokeswoman explains. Since OpenAI is based in the U.S., any European supervisory authority could take action.<\/p>\n\n\n\n

At the same time, they are very interested in the results of their Italian colleagues: \u201cWe have already asked them for further information on the blocking of ChatGPT and will then pass this on to the competent state data protection supervisory authorities and state media authorities,\u201d explains the authority spokeswoman.<\/p>\n<\/blockquote>\n\n\n\n

The UK\u2019s data protection authority, the Information Commissioner\u2019s Office<\/a>, has published a blog post listing eight questions that companies working in this area need to ask themselves, noting that protecting privacy \u201cisn\u2019t optional \u2013 if you\u2019re processing personal data, it\u2019s the law.\u201d<\/p>\n\n\n\n

The Italian Garante has given ChatGPTuntil April 30 to comply with its privacy requirements<\/a>. Failure to resolve the issues mentioned above could lead to a fine of 20 million euros, or 4% of the total worlwide annual turnover of OpenAI, the company behind ChatGPT, whichever is higher. <\/p>\n\n\n\n

It is unlikely that such a large fine would be levied so soon in a field that didn\u2019t exist a few months ago, but nonetheless the threat is real, and could be used at any time if the Italian authorities decide that ChatGPT or any other AI system has indeed infringed on the GDPR.<\/p>\n\n\n\n

The demand by the Garante raises a new and important issue: how exactly can these new \u201clarge language models\u201d (LLMs) \u2013 which are not so much large as enormous \u2013 be updated? Given the interdependence of the key elements of LLMs, it seems unlikely that it will be possible to remove specific items from the input data so as to satisfy the privacy problems outlined by the Italian data protection authority.<\/p>\n\n\n

\n
\"\"
Your data is instrumental to transformer LLMs, credit<\/em> https:\/\/lena-voita.github.io<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n

ChatGPT Issues Are Bigger Than Data Privacy <\/h2>\n\n\n\n

ChatGPT has some other very specific problems under the GDPR, for example the right to correct erroneous data held by a company. When ChatGPT and other LLMs start \u201challucinating\u201d, that is generating false information, about individuals, what recourse will the latter have to \u201ccorrect\u201d those hallucinations? <\/p>\n\n\n\n

It seems that false statements in LLM output can arise even if the underlying data is true. In these circumstances, the model itself is the problem. And how can that be reconciled with the rights granted to EU citizens under the GDPR?<\/p>\n\n\n\n

This is not just about the GDPR and the EU, even though the problems there are particularly acute. Countries outside that region are also starting look at the privacy implications of LLMs. For example, the Office of the Privacy Commissioner of Canada<\/a> has just launched an investigation into ChatGPT:<\/p>\n\n\n\n

\n

\u201cAI technology and its effects on privacy is a priority for my Office,\u201d Privacy Commissioner Philippe Dufresne says. \u201cWe need to keep up with \u2013 and stay ahead of \u2013 fast-moving technological advances, and that is one of my key focus areas as Commissioner.\u201d<\/p>\n\n\n\n

The investigation into OpenAI, the operator of ChatGPT, was launched in response to a complaint alleging the collection, use and disclosure of personal information without consent.<\/p>\n<\/blockquote>\n\n\n\n

What the US Is Doing About ChatGPT<\/h2>\n\n\n\n

In the US, which lacks a federal privacy law comparable to the EU\u2019s GDPR, there are still concerns about the new generative AI systems. The Center for AI and Digital Policy, an AI think-tank, has made a formal complaint<\/a> to the Federal Trade Commission (FTC). It asks for an investigation into OpenAI and a halt on further commercial releases of the company\u2019s new GPT-4, because of fears that it is \u201cbiased, deceptive, and a risk to privacy and public safety.\u201d<\/p>\n\n\n\n

Things are moving so fast in this sector that it is hard to keep up with them. But it seems clear that after an initial phase of wide-eyed excitement about generative AI systems like ChatGPT, people are now waking up to the extremely serious privacy issues they raise. The question now is to what extent those issues can be addressed, and whether they will lead to the field of LLMs being stifled in some parts of the world if data protection authorities slam on the regulatory brakes.<\/p>\n\n\n\n