OpenAI’s large language model (LLM) ChatGPT has been hit with a GDPR complaint from Austria’s Data Protection Agency (DPA) and privacy activist group NOYB

The complaint stated that ChatGPT breaks GDPR by providing false information about public figures and not allowing those figures to access or erase the data it has harvested about them. 

LLMs are able to generate text from prompts by ingesting swathes of training data to replicate human-like language. From this training data, they can anticipate the next word in a sentence. 

However, LLMs can hallucinate by generating responses that are factually incorrect. 

NOYB stated that it had contacted OpenAI about inaccurate responses regarding personal data but stated that the startup answered it was unable to correct ChatGPT’s false responses. 

NOYB and DPA’s complaint centres around the case of an unnamed public figure who stated that ChatGPT provided inaccurate information on his birthdate. The complaint stated that no information on his birthdate is available online. 

How well do you really know your competitors?

Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.

Company Profile – free sample

Thank you!

Your download email will arrive shortly

Not ready to buy yet? Download a free sample

We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form

By GlobalData
Visit our Privacy Policy for more information about our services, how we may use, process and share your personal data, including information of your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.

Following ChatGPT’s inaccurate response, the public figure sent an access and erasure request to OpenAI. 

The complaint stated that OpenAI’s response to this request only applied to the user data stored on the public figure on his ChatGPT account, not the data that was ingested by ChatGPT. 

OpenAI stated that ChatGPT had an option to block displaying all the figure’s personal details, but that it could not solely remove the ingested birthdate. 

Data protection lawyer at NOYB Maartje de Graaf stated that AI hallucinations about personal data could have serious consequences. 

“It’s clear that companies are currently unable to make chatbots like ChatGPT comply with EU law, when processing data about individuals. If a system cannot produce accurate and transparent results, it cannot be used to generate data about individuals. The technology has to follow the legal requirements, not the other way around,” said de Graaf. 

De Graaf stated that GDPR compliance must pertain to all companies. 

“It is clearly possible to keep records of training data that was used at least have an idea about the sources of information. It seems that with each ‘innovation’, another group of companies thinks that its products don’t have to comply with the law,” she said.