Poland: UODO launches investigation into ChatGPT for unlawful processing of personal data
On September 20, 2023, the Polish data protection authority (UODO) announced that it initiated an investigation into ChatGPT for unlawful processing of personal data following a complaint.
In particular, the complainant alleged that ChatGPT generated false information about the complainant in response to a query. Subsequently, the complainant stated that OpenAI L.L.C., the operator of ChatGPT, violated the General Data Protection Regulation (GDPR) and unlawfully processed their personal data by:
- failing to comply with a request to correct the complainant's personal data;
- failing to inform the complainant of the data about them that ChatGPT processes;
- not being transparent regarding how ChatGPT processes personal data contrary to Articles 5(1) and 12 of the GDPR; and
- failing to inform the complainant of the source of the personal data ChatGPT processes or the recipients or categories of recipients of the personal data.
UODO stated the complaint raised several GDPR compliance concerns and that in conducting its investigation, UODO would require OpenAI to answer a number of queries.
You can read the press release, only available in Polish, here.