Poland’s Office for Personal Data Protection (UODO) has opened an investigation into OpenAI over a General Data Protection Regulation (GDPR) complaint filed against its AI chatbot, ChatGPT. The complaint accuses OpenAI of multiple breaches of the EU privacy regulation. The UODO highlighted concerns about OpenAI’s processing of data and transparency in its announcement. The investigation is expected to focus on whether OpenAI’s ChatGPT complies with GDPR principles, such as privacy by design and data access rights.
Key Takeaway
Poland’s Office for Personal Data Protection is conducting a formal investigation into OpenAI’s ChatGPT following a GDPR complaint. The complaint alleges various breaches of EU privacy regulations, including processing data unlawfully and lacking transparency. This adds to the regulatory challenges OpenAI is facing in Europe, with other countries also scrutinizing ChatGPT’s compliance. OpenAI’s response and engagement with European regulators will help shape the future of AI regulation in the region.
The Complaint Allegations
The GDPR complaint, filed by privacy and security researcher Lukasz Olejnik, centers around OpenAI’s response to a request to correct personal data generated by ChatGPT. Olejnik alleges that the AI company provided evasive, misleading, and contradictory answers when he sought to exercise his data access rights. The complaint also questions OpenAI’s processing of personal data without consent and its failure to adhere to privacy by design principles.
Regulatory Scrutiny and OpenAI’s Response
This investigation in Poland adds to the regulatory issues OpenAI is facing in Europe. Italy’s Data Protection Authority led to a temporary suspension of ChatGPT in the country, and an ongoing scrutiny is being conducted by the Garante. Spain’s Data Protection Authority has also opened a probe. Additionally, a taskforce established by the European Data Protection Board is exploring how to regulate AI chatbot technology, aiming for consensus among privacy watchdogs. OpenAI recently opened an office in Dublin, Ireland, in an attempt to streamline its regulatory situation and handle GDPR complaints more effectively.
Opportunity for Reconciling Progress and Human Rights
The UODO’s investigation highlights Poland’s commitment to privacy, data protection, and technological advancements. The authority aims to strike a balance between digital progress and individual rights. While an expeditious decision on the complaint is not anticipated, the UODO aims to engage in meaningful discussions with OpenAI regarding GDPR compliance and the protection of data subjects’ rights.
