Legal Crossroads: OpenAI's GDPR Dilemma

0:00The first thing I want to talk about here is the fact that OpenAI, this is an American tech company behind ChadGPTBt is American, it is still subject to laws in other countries, notably in GDPRTB.com. some renewed scrutiny over compliance with European data protection laws. So a comprehensive complaint was recently filed with Poland's data protection authority, DPA, alleging multiple violations of this GDPR. So this development kind of adds another layer of complexity to OpenAI's regulatory challenges in Europe that they're going through right now. And the complaint essentially suggests that OpenAI's operational approach to ChadCBT, its generative AI technology, breaches various different GDPR provisions, including lawful basis, transparency, fairness, and data access rights.

1:00So the complaint argues that OpenAI has essentially neglected GDPR's article 36, which requires prior consultation with regulators for high-risk technologies. And it seems OpenAI ruled out ChatGPT in Europe without adequate local regulatory engagement. And, you know, some people are like, well, you know, what's the implication of this? Well, I mean, essentially, this would mean that they are potentially violating the EU's data protection framework. And this does have some big implications. So OpenAI's GDPR issues, I think, aren't anything very new. Earlier, Italy's privacy watchdog, which is called Garante, essentially directed the company to stop data processing in Italy due to identified issues such as lawful basis and child safety.

1:48So while Chechiput resumed its service in Italy after making a bunch of changes, investigations are still ongoing there as well as a bunch of other EU DDPAs. So I think at the moment, you know, OpenAI is going to have to kind of navigate a lot of this regulatory environment. I'm sure they're spending heavily on lawyers and other things in that area. and it's kind of interesting because in america we have a bit more of approach in my opinion of like just let the technology go and then once you like let it out there then you deal with the repercussions and the fallout afterwards whereas i feel like in europe i'm not sure if that's the strategy for software companies as well maybe they follow the same thing but it would appear that regulators do not like that approach they would prefer for you to you know go and contact them.

2:33It's so tricky though, because as anyone knows that has worked in software and technology, like so much of your product depends on product market fit. So it's like, first off, there's no way chat GP open AI could have predicted the success of chat GPT. Sam Altman himself said, like everyone thought this was kind of a silly little gimmicky tool. They thought maybe when GPT four came out, that was going to be the big moment. But they're like, you know, when GPT three came out, they're like, yeah, whatever, this is a gimmicky tool. It's not going to do that much. And when it exploded, it actually shocked everyone.

3:02And so it's really hard to predict, like, there's no way they could have known that this was going to be so big. And if it had just been a tiny little product, maybe it was absolutely hated, no one liked it, it was a bit of a dud. And they decided, okay, well, maybe we're going to move on to something different. Like, and, you know, imagine before that, going through all of this regulatory work with all of these different countries in the EU that want to sue them. In my opinion, it's outrageous. I mean, that's my opinion. And I know other people have different opinions. I know open AI isn't great with their data, like sucking up all the data from the internet and not compensating everyone for it.

3:34But, you know, I think they should build in some models to help people in the future. But then again, like if they were like, okay, we're going to build in all of these, you know, these monetization models where everyone's going to get paid for this tool. And the tool was a total flop and they scrapped it. Like what would be the point of all that? So in my opinion, I'm kind of on the side of just like build it, launch it, ship it. if it gets massive market adoption, then figure out how to make it better, improve it, you know, fix it, let it be monetized, let users monetize their own data or opt in or out or all these different things.

4:05But at the end of the day, I think that people that are not in tech definitely over or they underestimate product market fit. They're just like, oh, yeah, duh, ChatGPT was going to work out and be a smashing success. Like you guys should have like gotten all of these like compliance things done first and consulted everyone and like paid for all the data and like all this different stuff. I know people disagree with me on that. I'm okay. I guess I'm the devil's advocate for some, and maybe some people agree, but in my opinion, and if you've ever done software, like I've done so many software, different companies where you build it, you launch it, there's no product market fit, you move on.

4:40And one thing I will say is that right now, you know, as the regulatory landscape for AI chatbots, like ChatGPT and TherapixClaw, there's a bunch of them, right? It's still under development and GDPR remains enforceable. So individuals in the EU can continue to raise their data privacy concerns with local DPAs. And OpenAI's regulatory risks are augmented by the fact that it doesn't have a primary establishment in any EU member state for GDPR oversight purposes. And the thing to know is that I think the complaint security and privacy researcher Lazowski-Olench claims that his interaction with chat gpt led to erroneous content generated about him so when he sought correction open ai was unable to apply comply on direct contradiction to gdpr's right to rectification and i think that the complaint goes further stating that open ai's systemically ignores gdpr provisions when it comes to processing data for trained models within chat gpt okay so that complaint there in particular i think is i mean it's silly right and the guy probably knew it was silly, but he thought like, hey, maybe I could win a court case and get some money out of this.

5:49But essentially, because of GDPR, if you, for example, if you search something on Google, and there's like some sort of false information about you, GDPR says you go and tell Google, remove that from the search engine. And so then Google can go and remove the article from the search index about you. Great, right? The problem is, of course, these AI models are trained on data, everything's input ahead of time that it takes millions of dollars to run these models and train them. And then by the time you're asking questions, if it says something wrong, you know, you can't just go and remove that question or answer from there.

6:21It's an algorithm. And the funny thing is, you could definitely say, like, I could go on to Chatshubut and say, is Jaden Schaefer a bank robber? And then, you know, get it to say yes. Or maybe I'd say, like, act like an AI model detective and Jaden's a bank robber. Now I'm going to ask you, was jaden schaefer a bank robber then it could say like yes right like you can do all sorts of weird things to get chad chapti to say something and then like say oh it's making false claims about me like go fix that or i mean maybe it just literally says false claims about you because you have a similar name to someone else i don't know honestly it's so anyways that's a little ridiculous but that guy that's what that lawsuit is about so in email exchanges between olench and open ai the company provided some information in response to his subject access request it's called an sar but allegedly failed to provide a complete set of data particularly concerning how his personal data was used for ai model training i'm not sure what his specific like problem was there but you know apparently it had some sort of information about him he did not like the complaint states quote from the facts of the case it appears that open ai systemically ignores the provisions of the GDPR regarding the process of data for the purposes of training models with ChatGPT, a result of which, among other things, was that Mr.

7:42Lukatsk Olensk was not properly informed about the processing of his personal data, right? So I guess it might not even be fake information. Maybe they just want their information completely removed from ChatGPT and it was unable to do that. And so they're, you know, suing ChatGPT. Another interesting aspect is OpenAI's transparency problem in its privacy policy about processing personal data for training language models. So despite the fact that OpenAI claims that it doesn't use training data to identify individuals, the complaint argues that such data processing still falls under GDPR scrutiny.

8:18That was kind of a gray area, so I don't know if they're going to win on that. But in any case, violations of GDPR could result in fines as high as 4 % of OpenAI's global annual turnover. and that's not to mention you know potential orders to modify its technology for eu compliance so if they lose these cases it's sort of a big deal it's kind of crazy how gdpr just like charges you like if you make a violation it's like your fine is it's like not a specific number amount it's like four percent of your annual turnover global annual turnover i'll mention so that's insane um in any case you know i think the complaint filed with the polish dpa was you know orchestrated by uh olensh and his uh warsaw-based law firm gp partners so this guy's got a law firm and he he probably knows what's he knows what's going on and knows he'll probably win some money so he's gonna try this lawsuit um in any case he aims to accept uh essentially exercise his gdpr rights fully something he has found impossible so far he likened his experience to joseph k a character and friends, Kafka's, the trial, but remains hopeful that the EU's data protection process will deliver justice.

9:31In any case, while OpenAI has yet to publicly respond to these allegations, the case brings up fundamental questions about how AI tech, particularly those that generate content like ChatGPT, can align with stringent data protection regulations. As this complaint, I think, progresses, I think it could set important precedents for how generative AI technologies are regulated, not just in the EU, but globally, right? Because if they're giving you a 4 % fine of your global annual turnover, then you're going to want to appease them or not be in their market at all. I think this is interesting because this isn't just chat GBT.

10:06Like if you think about it, you know, mid-journey taking your images into its model to train or every other, every other like AI model is trained on a lot of people's data. and some of them they have all the rights to, some of them they don't. But really, if this became precedent and this one wins, it would have some massive implications for AI and probably do a lot of damage to a lot of different AI companies. So definitely an interesting area we're going to keep following.