The Right to Information in the Age of AI: noyb Challenges OpenAI’s Data Practices

Privacy advocates accuse OpenAI of violating GDPR with its AI’s “hallucination” issue

A data privacy watchdog group has filed a complaint against OpenAI, the creators of the popular chatbot ChatGPT, alleging the company’s failure to address the AI’s bias to fabricate information about individuals. This move puts pressure on tech companies to find solutions for the well-documented “hallucination” problem plaguing large language models (LLMs) as they race to market these AI tools.

Complaint Filed in Austria

Vienna-based nonprofit None of Your Business (noyb) filed a data protection complaint with Austria’s data protection authority. The complaint accuses OpenAI of violating the General Data Protection Regulation (GDPR), Europe’s stringent data privacy and security law.

For example, noyb claims that ChatGPT provided incorrect details when asked about the public figure’s date of birth. The complaint further alleges that OpenAI admitted there’s no way to stop its systems from displaying this fabricated information.

According to the lawsuit, OpenAI’s proposed solution was to simply block or filter results based on prompts containing the individual’s name. However, noyb argues this approach would essentially hide all information about the person, while the inaccurate data would still exist within OpenAI’s systems.

The lawsuit additionally accuses OpenAI of failing to disclose relevant details about the data it processes, including where it came from and who it was shared with. A lawyer for noyb (Maartje de Graaf) emphasizes this legal obligation applies to “all companies” and asserts that tracking information sources during AI system training is “definitely achievable.”

OpenAI, which has previously acknowledged the difficulties posed by AI inaccuracies in tools like ChatGPT, has not yet commented on the lawsuit.

Potential Consequences

The complaint significantly raises the stakes for OpenAI regarding its use and training methods for the models powering ChatGPT. The company, similar to many leading generative AI developers, already faces copyright lawsuits concerning the data used to train its models and additional legal issues surrounding data privacy. These “hallucinations,” where the AI system produces misleading or false outputs presented as factual, are also emerging as a legal concern, as evidenced by a defamation lawsuit filed by a radio host in Georgia.

This is not OpenAI’s first brush with Europe’s robust data protection authorities. In 2023, Italy’s data protection authority compelled the company to implement changes.

What to Watch For

GDPR carries significant weight, potentially forcing companies to make substantial operational changes to maintain operations within the European Union, the world’s largest trading bloc. The regulation empowers regulators to impose fines of up to 4% of a company’s global turnover. Data complaints can expand to encompass the entire EU if the issue transcends national borders, with investigations coordinated by collaborating watchdogs. noyb anticipates the complaint to be handled in this manner, potentially raising the stakes for OpenAI, though investigations can take years to resolve. AI companies will be closely monitoring the outcome of this case.

noyb’s Track Record

noyb has emerged as a powerful force in European data protection since its founding in 2017. The organization has initiated a total of 839 cases, resulting in €1.74 billion ($1.86 billion) in fines. Max Schrems, noyb’s co-founder and lawyer, is a prominent activist who has spearheaded some of the most impactful challenges against data sharing agreements between the U.S. and EU for major corporations like Meta. Schrems’ efforts ultimately led to the invalidation of two significant data transfer agreements: the Privacy Shield and the EU-U.S. Safe Harbor, forcing companies to fundamentally reassess their online business practices.

Key Points of the Complaint

• noyb accuses OpenAI of violating GDPR by failing to address ChatGPT’s generation of misinformation about individuals.
• The complaint highlights OpenAI’s alleged refusal to correct or erase demonstrably false information.
• noyb criticizes OpenAI’s proposed solution of filtering all information about individuals as insufficient.
• The complaint further accuses OpenAI of failing to disclose details about data processing upon request.

Key Entities Involved