EDPB ChatGPT Taskforce Report

From Data Bytes 47

Key findings of the EDPB's ChatGPT Taskforce Report include:

• OpenAI relies on legitimate interests as the legal basis for collecting and processing personal data from various publicly available sources on the Internet (such as websites) via web scraping, to train and improve ChatGPT. The SAs stresses that this legal basis requires a careful balancing of interests between the controller and the data subjects, taking into account the reasonable expectations of the data subjects and the safeguards implemented by the controller.
• OpenAI also relies on legitimate interests as the legal basis in order to use the input and uploaded files from data subjects who interacted with ChatGPT (referred to as "Content") for training purposes. The SAs emphasizes that data subjects should be clearly and demonstrably informed that their Content may be used for such purposes and that they have the option to opt-out.
• OpenAI faces challenges in ensuring data accuracy, as ChatGPT may produce biased or made up outputs that are not factually accurate, especially when relating to individuals. The SAs emphasizes that the controller should provide proper information on the probabilistic output creation mechanisms and on limited level of reliability, and implement technical measures to prevent or correct inaccurate outputs.
• OpenAI provides information on how data subjects can exercise their rights under the GDPR, such as access, erasure, rectification, restriction, objection and automated decision-making. However, the SAs note that data subjects may face factual limits to intervene in the complex processing operations of ChatGPT and that OpenAI should continue improving the modalities so that data subjects can easily exercise their rights.