{"id":25281,"date":"2023-09-29T01:36:55","date_gmt":"2023-09-29T08:36:55","guid":{"rendered":"https:\/\/www.privateinternetaccess.com\/blog\/?p=25281"},"modified":"2024-01-24T03:25:51","modified_gmt":"2024-01-24T11:25:51","slug":"poland-opens-gdpr-investigation","status":"publish","type":"post","link":"https:\/\/www.privateinternetaccess.com\/blog\/poland-opens-gdpr-investigation\/","title":{"rendered":"Poland Opens GDPR Investigation into ChatGPT and OpenAI amid Mounting Privacy Concerns"},"content":{"rendered":"\n

Poland\u2019s Personal Data Protection Office is investigating a GDPR complaint against ChatGPT and the company behind it, OpenAI. According to the Polish data protection agency:<\/p>\n\n\n\n

\n

the complainant turned to the Polish supervisory authority after his requests relating to the exercise of his rights under GDPR were not completed by OpenAI. As it turns out, ChatGPT generated inaccurate information about the complainant in response to his request. In turn, the request for its rectification was not fulfilled by OpenAI, despite the fact that every controller is obliged to process accurate data. It was also not possible for the complainant to find out what data ChatGPT was processing about him at all.<\/p>\n<\/blockquote>\n\n\n\n

It\u2019s not surprising that ChatGPT has been accused of breaching the EU\u2019s main privacy law \u2013 PIA blog noted that ChatGPT was a privacy disaster waiting to happen<\/a> back in February. As the first complaint to be taken up by an EU data protection agency, this case will be watched closely by other EU Member States, and around the world. The Polish inquiry is likely to investigate many of the key GDPR issues that arise for AI programs and be used as a benchmark in future legal cases.<\/p>\n\n\n\n

The Polish Personal Data Protection Office is the first formal inquiry, but not the first time an EU data protection agency has expressed concerns. Italy\u2019s data protection agency, Il Garante per la protezione dei dati personali, blocked access to ChatGPT<\/a> in the country precisely because of concerns that it violates the GDPR. A few weeks later, the Italian data protection authority allowed OpenAI to offer ChatGPT once more, following the implementation of a number of changes designed to address privacy concerns. However, that swift approval meant that the core GDPR issues were not explored in full detail \u2013 something the new Polish investigation now has a chance to do.<\/p>\n\n\n\n

Italy was not the only EU country to begin exploring whether ChatGPT and OpenAI complied with the GDPR. The Spanish Data Protection Agency began preliminary investigatory proceedings against OpenAI for possible non-compliance with the regulations. Although no more information has been released, it is significant that one month later, the authorities of the Ibero-American Network for the Protection of Personal Data, a group of 16 data protection authorities from 12 countries, mostly from Latin America, began their own joint investigation of the following aspects<\/a> of ChatGPT (translation via DeepL):<\/p>\n\n\n\n

\n

the legal bases for such processing, the information provided to the user on the processing, the exercise of the rights recognised in the data protection regulations, the possible transfer of personal data to third parties without the consent of the owners, the lack of age control measures to prevent minors from accessing its technology, and not knowing whether it has adequate security measures for the protection and confidentiality of the personal data collected.<\/p>\n<\/blockquote>\n\n\n\n

In France, the data protection agency CNIL issued what it calls an AI \u201caction plan<\/a>\u201d based on four main strands:<\/p>\n\n\n\n