OpenAI violated Canadian law by training ChatGPT with personal data

Toronto.- Canada's privacy regulators said on Wednesday that OpenAI violated Canadian personal data protection laws in the development and deployment of ChatGPT, by collecting personal information from individuals such as medical conditions, ideology, and data about minors.

These findings are contained in a report presented today by Canada's Privacy Commissioner, Philippe Dufresne, along with his counterparts from the provinces of Quebec, British Columbia and Alberta. Canadian privacy regulators examined in an investigation the collection, use, and disclosure of personal information by OpenAI to train and operate ChatGPT, and concluded that the initial training of the chatbot did not comply with federal and provincial privacy standards.

Among these reasons, they cited the excessive collection of personal data, the lack of valid consent, insufficient transparency, responses with inaccurate or fabricated personal information, problems for individuals to access, correct or delete their data, and the lack of responsibility for the information under the company's control.

OpenAI's Commitments

According to the report, OpenAI collected large amounts of personal information through public sources, social media, forums, and other internet sites. Dufresne stated in a statement that OpenAI launched ChatGPT "without having fully addressed" the known privacy risks. "This exposed Canadians to potential harms such as data breaches and discrimination based on information about them," he added.

We recommend reading: OpenAI's phone would already have a date: this is how the smartphone with integrated AI would be

Dufresne also said that after the investigation, OpenAI improved privacy protections and has agreed to take more measures to address the concerns of the Office of the Privacy Commissioner of Canada.

Among the measures cited by regulators are tools to detect and mask personal data, such as names or phone numbers, in datasets used for training, improvements in access and information correction mechanisms, formal data retention and deletion policies, as well as new notices to inform users that their conversations may be reviewed or used to train models. "These measures will significantly limit the personal information that is used to train new ChatGPT models," explained the Canadian commissioner. OpenAI will have to submit quarterly reports to Canadian regulators to demonstrate compliance with the commitments made.

The controversy surrounding a recent shooting

Dufresne stated that research demonstrates the need to modernize Canadian privacy laws in the face of advances in artificial intelligence, although he emphasized that current regulations already apply to these technologies. "Appropriate safeguards are the cornerstone of responsible innovation," he declared. The presentation of the report comes shortly after  OpenAI CEO Sam Altman apologized to the Canadian town of Tumbler Ridge for not alerting authorities about one of its users, who later killed eight people in the community. In a letter addressed to the community, Altman expressed in April his "deepest condolences" to the victims' families and acknowledged that the company did not inform law enforcement when it detected alarming activity on the account of the shooter. The shooting occurred on February 10th, when an 18-year-old suffering from mental disorders killed five children, a teacher, and two family members before committing suicide. After it was revealed that OpenAI had detected worrying interactions through the author's conversations with ChatGPT, but decided not to communicate that information to the Police, the Canadian authorities criticized the American company and asked for explanations about what happened. At the end of April, several families of the Tumbler Ridge massacre filed a lawsuit in San Francisco (USA) against OpenAI, in which they are claiming compensation of up to $1 billion from the company.