"Poland opens privacy probe of ChatGPT following GDPR complaint" 21 September 2023

OpenAI is facing another investigation into whether its generative AI chatbot, ChatGPT, complies with European Union privacy laws.

Last month a complaint was filed against ChatGPT and OpenAI in Poland, accusing the company of a string of breaches of the EU’s General Data Protection Regulation (GDPR). Yesterday the Polish authority took the unusual step of making a public announcement to confirm it has opened an investigation.

“The Office for Personal Data Protection [UODO] is investigating a complaint about ChatGPT, in which the complainant accuses the tool’s creator, OpenAI, of, among other things, processing data in an unlawful, unreliable manner, and the rules under which this is done are opaque,” the UODO wrote in a press release [translated from Polish to English using DeepL]...

...The complaint, which was filed by local privacy and security researcher Lukasz Olejnik, accuses OpenAI of a string of breaches of the pan-EU regulation — spanning lawful basis, transparency, fairness, data access rights, and privacy by design.

It focuses on OpenAI’s response to a request by Olejnik to correct incorrect personal data in a biography ChatGPT generated about him — but which OpenAI told him it was unable to do. He also accuses the AI giant of failing to properly respond to his subject access request — and of providing evasive, misleading and internally contradictory answers when he sought to exercise his legal rights to data access...

...OpenAI was contacted for comment on the Polish DPA’s investigation but did not send any response...