The Schleswig-Holstein data protection authority (ULD) published, on April 19, 2023, the questionnaire that German data protection supervisory authorities, including Hesse and Rhineland-Palatinate, have sent in connection with their examination of OpenAI, L.L.C., requesting answers regarding data processing in connection with ChatGPT, following a freedom of information request submitted to the ULD. In particular, the questionnaire highlights the areas that give rise to data protection problems in connection with the use of artificial intelligence (AI) applications from the perspective of the data protection supervisory authorities, and includes questions around:

• how ChaptGPT complies with the principles of data processing under the General Data Protection Regulation (GDPR);
• how long personal data is stored;
• the legal bases of processing personal data relied upon;
• how ChaptGPT observes data subject rights and transparency obligations towards the same;
• the data security measures implemented by ChatGPT to safeguard against risks to personal data;
• the protection of children and young people in connection with ChatGPT;
• clarification on third-country transfers involved; and
• further use of the data by other services or companies.

Moreover, the questionnaire specifies that the questions apply to ChatGPT's collection of personal data from publicly accessible common sources, the use of this personal data as training data in the context of machine learning, the storage of personal data, and the processing of personal data of ChatGPT users.

You can read the questionnaire, only available in German, here.