Because of false information

Data protection complaint against the ChatGPT makers

Max Schrems founded the data protection NGO Noyb.(Bild: APA/HANS PUNZ)

The data protection organization Noyb, together with a concerned citizen, has filed a complaint against the ChatGPT provider OpenAI for violating the General Data Protection Regulation (GDPR). The organization, co-founded by activist Max Schrems, accused OpenAI on Monday of making false statements about personal data in the case of a "public figure" without giving the legally prescribed option of correction or deletion.

Schrems had previously taught the Facebook group Meta to fear in two lawsuits, twice overturning important data agreements between the USA and Europe before the European Court of Justice.

In the dispute with ChatGPT developer OpenAI, Noyb accuses the US company of denying people in Europe their rights under the GDPR. In the specific case, which also involved an incorrect date of birth, OpenAI argued that it was not possible to correct the data. Data could be blocked for certain requests, such as the name of the celebrity. However, ChatGPT could not be prevented from filtering all information about the complainant.

Noyb also accused OpenAI of failing to respond appropriately to the complainant's request for information. Although the GDPR gives users the right to request a copy of all personal data, OpenAI failed to disclose the processed data, its sources or recipients.

Obligation to provide information applies to all
Maartje de Graaf, data protection lawyer at Noyb, said that the obligation to comply with a request for information applies to all companies. "It is of course possible to log the training data used to at least get an idea of the sources of information. It seems that with every 'innovation' another group of companies thinks that their products don't have to comply with the law."

Noyb and the data subject have now called on the Austrian Data Protection Authority (DPA) to investigate OpenAI's data processing practices. Of particular interest is the question of what measures the start-up has taken to ensure the accuracy of personal data. A fine should be imposed on OpenAI to ensure future compliance.