Germany: Issued Hessian Data Protection Authority order requesting OpenAI ChatGPT's information on its data processing practices

On 19 April 2023, the Commissioner for Data Protection and Freedom of Information in the German state of Hessen announced that it issued an order requiring OpenAI, the operator of the ChatGPT, to provide information on its data processing practices. In particular, the Commissioner requested information on the legal basis for collecting and processing personal data and the information provided to users regarding the data collected. Furthermore, OpenAI is required to provide the age limit set for the use of the ChatGPT, the measures established for age verification and whether it obtained consent from a guardian for users under 16 years old. Finally, the Commissioner requested information about the data used as training data in the context of machine learning, profiling and advertising. The Commissioner stated that the investigation is being carried out in coordination with the data protection authorities of other German federal and state governments and in parallel with the work of the EU ChatGPT task force created by the European Data Protection Board.