Another Privacy Complaint Filed Against ChatGPT in the EU for ‘Hallucination’ Issue

OpenAI, the renowned artificial intelligence research lab, is once again under scrutiny in the European Union for privacy violations. A complaint has been filed by the privacy rights nonprofit noyb on behalf of an individual complainant, highlighting the AI chatbot ChatGPT’s inability to correct misinformation it generates about individuals.

The issue of AI tools producing inaccurate information has been a known concern, but it now clashes with the EU’s General Data Protection Regulation (GDPR), which governs the processing of personal data of regional users. The penalties for GDPR non-compliance can be severe, reaching up to 4% of global annual turnover.

OpenAI had previously faced intervention from Italy’s data protection authority, resulting in a temporary shutdown of ChatGPT in 2023. The current complaint filed by noyb with the Austrian data protection authority focuses on an incorrect birth date generated by the AI chatbot for an unnamed complainant.

Under the GDPR, individuals in the EU have the right to request corrections to erroneous data about them. noyb alleges that OpenAI failed to comply with this obligation by claiming it was technically impossible to correct the misinformation. Instead, the company offered to filter or block certain data prompts.

The complaint also raises transparency concerns, as OpenAI is unable to disclose the sources of data generated by ChatGPT or the information stored about individuals. noyb emphasizes that companies must ensure compliance with EU law when processing data about individuals.

With multiple GDPR complaints looming over OpenAI in different EU Member States, the company faces the risk of significant fines and enforcement actions. The establishment of a regional office in Dublin may indicate a strategic move to streamline regulatory oversight and address privacy complaints effectively. The outcome of these investigations will determine the future of AI technology in the EU and the extent to which companies must adhere to data protection regulations.