The Hessen data protection authority ('HBDI') issued, on 13 April 2023, a press release in which it stated that the Hessian data protection officer ('DPO'), Prof. Alexander Roßnagel, has asked OpenAI L.L.C. to answer a questionnaire on data processing at ChatGPT. In particular, the HBDI stated that the questions sent relate to whether the data processing complies with the basic principles of data protection law, whether such processing is based on valid legal bases, and whether it is sufficiently transparent for data subjects involved. In this regard, Roßnagel explained that there is a lack of clarity behind ChatGPT's purposes for processing personal data, as well as the data pool behind the service that feeds the artificial intelligence ('AI') system's knowledge.

Furthermore, Roßnagel highlighted that the questionnaire also includes questions on the following:

• the age limit set for the use of ChatGPT, how compliance with the age limit is checked, and whether the consent of a legal guardian is obtained for all users under the age of 16; and
• whether usage data is used as training data in the context of machine learning, which sources are used to obtain information about individuals, and for what purposes (e.g. profiling and advertising) the usage data is stored.

Notably, Roßnagel noted that the questionnaire is a product of a coordinated effort with the other German supervisory authorities that form the German Data Protection Conference ('DSK'), and that once answers are received from OpenAI, Roßnagel will coordinate with the other supervisory authorities in Germany and Europe in evaluating the answers.

You can read the press release, only available in German, here.