OpenAI Hit With New Lawsuit Over ChatGPT Training Data – Forbes
Photo by Leon Neal/Getty Images
OpenAI is facing a new, broad-ranging lawsuit alleging that its ChatGPT large language model violates European privacy law.
In a complaint filed in Poland, independent cybersecurity researcher Lukasz Olejnik claims that the tool violates numerous provisions of the EU’s General Data Protection Regulation. These include lawful basis, transparency, fairness, data access rights and privacy by design.
“In my opinion [the violations] may be systemic,” he says. “I hope that some of the flaws are not injected into the very design.”
The case was sparked when, earlier this year, Olejnik created a biography of himself using ChatGPT and noticed that it contained several errors.
Under GDPR, data subjects can use a Subject Access Request to access the data held on them by a company and how it’s been processed. But when Olejnik did this, he says, significant information was missing, and OpenAI refused to correct its errors.
“From the facts of the case, it appears that OpenAI systemically ignores the provisions of the GDPR regarding the processing of data for the purposes of training models within ChatGPT, a result of which, among other things, was that Mr Lukasz Olejnik was not properly informed about the processing of his personal data,” reads the complaint.
While the alleged breaches are extremely wide-ranging, Olejnik says he does believe it possible to reconcile the technology with data protection and human rights principles.
But, he says, “I am afraid that the industry of AI/LLM may struggle with proper risk assessments and design. To be fair, there are no design guidelines indicating how to do LLM plus data protection, for example LLM plus GDPR. This is a song of the future. But we must start the conversation now.”
This isn’t the first time that OpenAI has been accused of playing fast and loose with the provisions of GDPR. Earlier this year, ChatGPT was temporarily banned in Italy over similar concerns. Germany, France and Spain, meanwhile, have launched their own investigations, while Canada is examining potential infringements of its own data protection laws.
And in the U.S., authors including Sarah Silverman, Christopher Golden, and Richard Kadrey are also suing the company over training data, claiming that ChatGPT was trained on their copyrighted work without permission.
Olejnik’s case has been filed by law firm GB Partners, and partner Maciej Gawroński says he is confident that it will be successfully resolved.
“What we would like the Polish, European or whatever data protection authorities to achieve is to get OpenAI into demonstrating how it is compliant, and if at all they were thinking about that compliance,” he says.
“And finally — or maybe firstly — what to do to achieve that compliance.”
OpenAI has been approached for comment.
