Everyone has probably, even partially, succumbed to the innovative technical convenience that is ChatGPT and tried what it is like to "talk to a robot". But how does OpenAI correlate with data protection and how can you defend yourself against the use of your personal data, for example, to teach this artificial intelligence? Let's take a look together at how this mechanism works and take a peek under the hood of OpenAI.
To start, it is important to mention that as members of the EU, we are protected by the General Data Protection Regulation ("GDPR"), which is also applicable in the context of AI data processing and seeks to protect the personal data of EU citizens. However, this has not always been the case in relation to OpenAI. The issue has attracted attention across the EU mainly because ChatGPT did not ask for permission in relation to the processing of personal data or its use for AI training.
As a result, the Italian Data Protection Authority intervened, suspending ChatGPT and pointing out very serious problems. The main issue it raised is whether OpenAI used people's data lawfully when developing the technology, and it also raised concerns about the quality of information the company provides about how it uses people's data. Without proper disclosure, there are questions about whether it also meets the requirements of the GDPR. In addition, the safety of minors has also been pointed out, and it has called for age verification technology to be put in place.
Following this, OpenAI has launched several new privacy tools such as the ability to turn off chat history. It has also introduced additional control mechanisms specifically aimed at GDPR compliance.
OpenAI said that individuals can object to the processing of their personal data by its artificial intelligence models by filling out an online form. This includes the option to submit a request to have the data generated about you by the AI deleted. At the same time, however, the company warns that it may not comply with every request, citing the relativity of data protection rights. This means that if the company has a legitimate reason to do so, it may limit your right to data protection and thus not comply with your request to erase your personal data.
This tool essentially replicates the right to be forgotten as set out in Article 17 of the GDPR, which is one of the fundamental rights under data protection. Google, for example, also uses this tool in a similar way. Of course, this is not the only right regulated by the GDPR, for example, the right to request the rectification of your data, the restriction or the transfer of your personal data.
OpenAI has also advised that you can claim these other rights via email communication, however, at the moment all requests for data restriction or correction are likely to be redirected to complete data erasure, mainly due to technical impracticability.
Following the intervention of the Italian Data Protection Authority, OpenAI has modified its privacy policy to state that the legal basis for processing people's data for AI training purposes is something referred to as "legitimate interest" in the GDPR.
OpenAI states in its privacy policy that the legal bases for processing "your personal data" include legitimate interests in protecting our services from misuse, fraud or security risks, or in developing, improving or promoting our services, including training our models. This may include processing account information, content, social information and technical information.
In the meantime, while further investigations are ongoing regarding ChatGPT's compliance with the GDPR, or the lawfulness of the use of the legitimate interest test for processing personal data, the company is required to provide users with certain rights, in particular the right to object to processing.
OpenAI has thus offered the possibility to omit user data from AI training, which is basically similar to the option of not tracking your data, i.e. filling in an electronic form or choosing this setting directly in your account. However, the path to this tool is a thorny one, and the company tries to discourage you from taking advantage of this option through all sorts of click-throughs.
After you prevent the company from training new technologies using your data, your chat history will also disappear, which is definitely another element that discourages many people from using this tool.
So whatever the reason for your data concerns, OpenAI now gives you the option to delete your data. However, the journey of data protection and artificial intelligence is far from over. You can also read articles focusing on artificial intelligence, for example here or here. Should you have any questions about AI or any other topic, please do not hesitate to contact us. We would be happy to help you on your journey through modern technology.
Responsible Attorney: JUDr. Jakub Dohnal, Ph.D., LL.M., Kateřina Chaloupková collaborated on the article.
