fbpx

Evaluating ChatGPT and AI Applications from the Personal Data Protection Perspective

AI Applications Under the Radar of Data Protection Authorities

Concerns about how artificial intelligence (AI) systems use and store data collected from users have been frequently debated by data protection authorities and professionals dealing with data security and privacy issues lately. These discussions are kept in the public eye through decisions, publications, and press releases related to the subject.

The Italian Data Protection Authority, Garante per la Protezione dei dati personali (“Garante”), has placed ChatGPT at the center of these discussions by temporarily restricting it and later announcing the waiving of this decision on restriction. ChatGPT, a large language model developed by US-based OpenAI, is described as an AI-based chatbot capable of generating human-like language using deep learning algorithms and uses large data sets to produce meaningful responses through natural language processing technology.

There are concerns about the lack of sufficient transparency in how applications like ChatGPT use and store data collected from users during interactions. The basis of these discussions is the thought that ChatGPT's privacy policy is not clear enough, it doesn't provide sufficient information about the use of collected data, it doesn't give users enough control over their data, there's no clear and transparent disclosure about whether sufficient security measures are taken for data protection, and it's uncertain whether user data will be shared with third parties in the event of integration with other applications or services.

Garante's Evaluation of ChatGPT

With the rapid growth trend of ChatGPT recently and its increasing use by everyone, we are going through a period where data protection authorities in the Netherlands, France, Spain, Italy, and the United Kingdom are increasing their oversight of AI-based applications and publishing materials in this field. The most significant step in this regard came first from Italy. On March 20, 2023, in response to a data breach notification affecting ChatGPT user conversations and subscriber payment information, Garante decided to temporarily halt the processing of data of users residing in Italy by the US-based company until the outcome of an investigation into ChatGPT's privacy practices was awaited. The violations that stood out in Garante's decision were the lack of clear and transparent disclosure to users and other data owners about the processing of personal data by ChatGPT, the lack of a legal basis for the collection and storage of personal data in bulk to train the algorithms that form the basis of the platform's operation, incorrect data processing due to provided information not always matching accurate data, and the absence of a filter system for age detection for children, leading to children being exposed to inappropriate responses. Notably, Garante did not find it sufficient for ChatGPT to announce in its privacy policy that its target audience is individuals over the age of 13, particularly child users. Garante's decision is also significant as it does not distinguish between using personal data to create or train an algorithmic model and entering personal data into a developed specific algorithmic model by the user.

Following Garante's temporary restriction decision, ChatGPT was reopened for use in Italy after OpenAI made a series of changes to address data security concerns, including improved transparency and data owner rights. The platform now provides many rights to users, including the right to disable the option for their conversations to be used to train ChatGPT's algorithms. In terms of children's data, controls have been implemented to protect children under the age of 13, and age verification tools have been introduced for users accessing ChatGPT from Italy. Concerning the incorrect processing of data and the fact that accurate data cannot always be provided, a notification was published on the site stating that ChatGPT may generate incorrect information about "people, places, or facts," and several updates were made to the privacy policy.

ChatGPT Turkey Privacy Policy

The Privacy Policy, last updated on April 27, 2023, and published on the site, explains how user data is processed for users accessing ChatGPT from Turkey. It serves as an essential reference for evaluating the status of ChatGPT's data processing processes in light of Personal Data Protection Law No. 6698 Data ("DPL") and secondary legislation.

In its Privacy Policy, ChatGPT notes that the personal data it collects from users, such as chat history, search history, user search queries, browser information, device information, and location information, are processed to provide, manage, maintain, and/or to analyze services, improving user experience through natural language processing and artificial intelligence technologies, enhancing services, communicating with users, preventing misuse of services, securing IT systems and network security, developing new programs and services, fulfilling legal obligations, and protecting the company's legitimate interests. The legal reasons for data processing appear to be based on the establishment and execution of the contract as per DPL, the necessity of data processing to protect legitimate interests, and compliance with legal obligations. It is stated that the terms of use and privacy policy will be assumed to have been accepted when the continue button is clicked after entering the information requested during registration.

ChatGPT provides users with control over the use of their chat history data for the application's development. It is noted that the chat histories of users who do not permit this will be deleted from the systems within 30 days. The absence of an active age verification system during registration is a critical detail expected to be addressed by the Personal Data Protection Board ("Board") for users accessing Turkey.

The Privacy Policy shows that additional information within the scope of GDPR is provided for users in the EU, the United Kingdom, and Switzerland. Evaluating the equivalence of the data processing conditions specified in the Privacy Policy in terms of DPL, it is seen that the data processing conditions in DPL show parallelism with GDPR, including the necessity of processing personal data of the parties to the contract directly related to the establishment or execution of a contract, the necessity of processing data for the data controller to fulfill its legal obligation, and the necessity of processing data for the legitimate interests of the data controller, other than explicit consent. Furthermore, the fact that the Terms of Use and Privacy Policy are only published in English may result in the content not being presented in an easily understandable manner for users accessing from Turkey and users accepting the terms of use without fully understanding them. As for the transfer of data abroad, we anticipate that the current practice will violate DPL for users accessing Turkey. Additionally, registering in the data controllers' registry (VERBIS) is another legal obligation to be considered. It is also necessary to say that AI applications, in general, should pay utmost attention to the right to object to the emergence of a result against the person through the analysis of processed data solely by automatic systems, which is among the rights that must be provided to the relevant persons under DPL. The processing of data in this way may potentially result in adverse outcomes for individuals, which is a reason for objection under DPL. This issue is very detailed under GDPR, and EU countries are not satisfied with this and are preparing separate legislation for artificial intelligence.

On the other hand, countries like the United Kingdom, which approach the subject with a focus on innovation, indicate the necessity of regulating producer artificial intelligence through adopting common principles with a multidisciplinary attitude, addressing opportunities and risks related to artificial intelligence.

Undoubtedly, AI applications like ChatGPT and the automatic processing of personal data in this way will stay on the agenda for a long time, with all its aspects being discussed extensively. For example, AI-based applications like ChatGPT must provide clear and transparent information about their privacy policies and take the necessary steps to protect users' data. Furthermore, data protection authorities are also anticipated to audit these systems to ensure they operate correctly regularly. Generally, all next-generation applications and solutions must undergo a preliminary audit for personal data protection and privacy, and compliance checks and analyses should be conducted before products and applications are made available for use.

Special thanks to Aslı Naz Güzel’ for her contributions.


Stay Informed

Subscribe to stay up to date on the latest legal insights and events of your choice.