In order for a digital company to operate, it must have a transparent privacy policy, with consent as its central axis. Is OpenAI, owner of ChatGPT, compliant with the regulations? Do users know how their data is used? Experts doubt it; indeed, there are reasons for uncertainty.
In just a few months, the artificial intelligence ChatGPT, capable of generating texts, images or music from existing data, has gone from being a minority tool, closer to a laboratory experiment, to a boom, and it is precisely the speed of its development, intellectual property, its use to misinform, cybersecurity or its data protection policy.
The first to sound the alarm about the possible lack of privacy was Italy. On March 31st, this country announced the blocking of the use of ChatGPT for not respecting the consumer data protection law, and the opening of an investigation into OpenAI, to which it also requested a series of specific measures.
The matter is already in Europe; The European Data Protection Committee has created a working group to promote cooperation and exchange information on the actions of the data protection authorities of the different member countries, of Iceland, Liechtenstein and Norway, which also have doubts about it.
Performances in Spain
From Spain, concern has also been expressed about a possible breach of the regulations. The Spanish Agency for Data Protection (Aepd) announced on April 13th that it was ex officio beginning preliminary investigation proceedings against the American company.
The measure taken by the Aepd “is within the normal range but it is something exceptional”, because “it does not usually open investigations like this”, Sergio de Juan-Creix, a lawyer at Croma Legal and a professor at the UniversitatOberta de Catalunya(UOC), told EFE, who recalled that the General Data Protection Regulation (GDPR) applies throughout the European Union but the states remain sovereign in the matter.
What the Aepd is doing now, explained this lawyer, is requesting information from OpenAI to assess it and establish whether the data processing of this company is in accordance with European and Spanish standards.
Is the data being transferred to the United States?
It would be necessary to find out, for example, if OpenAI is transferring user data to the United States; “Europe considers that the sending of data to that country is not safe”, he said, because there is no equivalent protection there, “the minimum requirements required by the EU are not met”.
BorjaAdsuara, an expert in digital law and professor at the Complutense University of Madrid, is of the same opinion: “what the AEPD has said is to give us information because it is what the European regulation requires”. It is necessary to know what data it collects, what it does with it, if it is transferred to third parties or if there is an international transfer.
With the explosion of ChatGPT and other tools of this type of AI, “what is happening is that people are dumping a lot of information, not only their own but also that of others”, explained De Juan-Creix.
Adsuara gave an example from his own profession: there are law firms that are “fiddling” with this AI, they write and enter data from their clients, but do they know where that data goes and how it is used? “I do not mean by this that OpenAI collects or uses them”, but the European regulation contemplates the obligation to inform.
For the UOC professor, “apparently OpenAI is not reporting the legal basis that it applies and whether it sends data to the United States. At least there is uncertainty in all this. I am not saying that it ends in a sanction, but it has to be investigated.
What is particular about the European regulation is that it applies to any entity that processes the data of European citizens, it does not matter if it is in Japan or the United States, so it obliges companies to appoint a representative in European territory. If they do not have it, they can receive a strong sanction.
Adsuara opined that OpenAI will end up opening a delegation in Europe, “no company is going to want to give up the European market”, and will then have “to go through the hoop and comply with the regulation, which is clear”.
Disinformation and intellectual property
Both agree that beyond this matter there is concern about misinformation or intellectual property. In the first case, the ease and “perfection” with which false news can be created; will we be able to contrast everything? And in the second, who owns, for example, a painting “painted” by this tool? Is it from ChatGPT, from OpenAI or from the user asking the AI to do it?
And since for this purpose this artificial intelligence has been nourished by previous creations and those may have their copyrights, is it legal? Then, they have to regulate it.
