Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Rhineland-Palatinate: LfDI Rheinland-Pfalz requests comments from OpenAI on data processing practices

The Rhineland-Palatinate data protection authority ('LfDI Rheinland-Pfalz') announced, on 24 April 2023, that it had reached out to OpenAI, L.L.C., which manages ChatGPT, with questions regarding its processing activities, in line with the request for comments from the Baden-Württemberg data protection authority. In particular, the LfDI Rheinland-Pfalz highlighted that its questions to OpenAI concerned the legal basis for data processing, the protection of children's data, and information about data processing. To this end, the LfDI Rheinland-Pfalz outlined that the questions were sent in accordance with the other German data protection supervisory authorities and in coordination with the new ChatGPT TaskForce at the European level, noting that since OpenAI has its office in the USA, all European data protection supervisory authorities are affected. Finally, the LfDI Rheinland-Pfalz noted that the response from OpenAI will inform further action by supervisory authorities.

You can read the press release, only available in German, here.

UPDATE (27 October 2023)

LfDI Rheinland-Pfalz requests additional comments from OpenAI regarding ChatGPT data processing

The LfDI Rheinland-Pfalz announced, on 26 October 2023, that it had sent additional questions to OpenAI following its initial request for information regarding its processing activities. In particular, the LfDI Rheinland-Pfalz noted that while OpenAI answered the first questionnaire cooperatively and comprehensively, the analysis of the information showed a need for more questions. More specifically, the LfDI Rheinland-Pfalz stated, among other things, that the new questions examine whether ChatGPT processes personal data lawfully, with a particular focus on special categories of personal data, and critically examine the realization of the rights of the data subjects to information, correction, and deletion of personal data. Lastly, the LfDI Rheinland-Pfalz specified that it must be clarified whether and in what way personal data is reliably recognized and sorted out during training and using ChatGPT, or how data protection-compliant processing should otherwise be ensured.

Finally, the LfDI Rheinland-Pfalz noted that the emerging establishment of OpenAI in Ireland would not end the LfDI Rheinland-Pfalz's review process and further added that the German supervisory authorities would remain responsible with regard to the future status of ChatGPT services offered in Germany. However, according to the LfDI Rheinland-Pfalz, the responsibility would then be exercised in cooperation with the supervisory authority at the place of headquarters in the EU, i.e., the Irish Data Protection Commission ('DPC').

You can read the press release, only available in German, here.