OpenAI's ChatGPT Faces Another EU Privacy Complaint Over Misinformation Issue

The GDPR complaint against ChatGPT, filed by the privacy rights nonprofit noyb, is centered on the AI chatbot's inability to correct misinformation it generates about individuals. Specifically, the complaint targets ChatGPT's production of incorrect personal data, such as birth dates, and OpenAI's refusal to rectify this information, claiming it is technically impossible. Instead, OpenAI has offered to filter or block the data on certain prompts. This inability to correct misinformation puts ChatGPT at odds with the GDPR, which requires the rectification of erroneous data.

GDPR enforcement could have significant implications for generative AI tools like ChatGPT in the EU. The GDPR governs how personal data of EU users can be processed, including the right to have incorrect data corrected. If AI tools fail to comply with these regulations, data protection regulators can impose penalties and order changes to how information is processed. This means that GDPR enforcement could force generative AI tools to adapt their operations to meet the strict requirements of the GDPR, potentially reshaping their functionality within the EU.

Consequences of GDPR compliance failures for companies like OpenAI can be severe. Penalties for non-compliance can reach up to 4% of a company's global annual turnover. More critically, data protection regulators have the authority to mandate changes in how companies process information, which could lead to significant operational adjustments. For a company like OpenAI, this could mean having to modify the way their generative AI tools function to align with GDPR standards.

In response to correction requests under GDPR, OpenAI's privacy policy states that users can submit a 'correction request' if the AI chatbot generates 'factually inaccurate information' about them. However, OpenAI has admitted that due to the technical complexity of their models, they may not be able to correct the inaccuracy in every instance. As an alternative, OpenAI suggests that users can request the removal of their personal information from ChatGPT's output entirely by filling out a web form. This approach has been criticized for not fully complying with the GDPR's requirement for rectification.

OpenAI's handling of GDPR rights is considered problematic because the GDPR stipulates that individuals have a suite of rights regarding their personal data, including the right to have erroneous data corrected and the right to request deletion of their data. OpenAI's approach of offering to filter or block data, or remove personal information entirely, rather than correcting it, is seen as them choosing which rights to honor. This selective compliance does not align with the GDPR, which does not allow for rights to be offered à la carte.