On 24 May 2024, the European Data Protection Board (EDPB) published a report on the work undertaken by the ChatGPT Taskforce. It details the context of OpenAI's operations, noting that prior to 15 February 2024, OpenAI did not have an establishment in the EU, complicating General Data Protection Regulation (GDPR) compliance under the one-stop-shop mechanism. After the establishment, in contrast, OpenAI will fall under this mechanism, simplifying regulatory interactions. The document highlights ongoing efforts to promote a coordinated approach among EU Supervisory Authorities (SAs), including the development of a common questionnaire by the Task Force. Investigations by the SAs are still ongoing, and therefore, the considerations in the report should be considered as preliminary views on certain aspects of the investigations. The preliminary views include an assessment of the lawfulness, fairness and transparency of OpenAI's data processing practices. In particular, to ensure the lawfulness of the processing of personal data, from collection and pre-processing to training and user interaction with ChatGPT, specific conditions must be met under Article 6(1) and, where applicable, Article 9(2) GDPR, with a thorough assessment of legitimate interest and necessary safeguards to protect the rights of data subjects. The principle of fairness under Article 5(1)(a) GDPR requires that OpenAI, as the data controller, cannot shift the responsibility for GDPR compliance to data subjects by making them liable for the data they enter into ChatGPT, ensuring that the risks associated with data processing remain with OpenAI. When web-scraping involves the collection of personal data from publicly accessible sources, the requirements of Article 14 GDPR apply, often leading to the application of an exemption due to the impracticality of informing each data subject, however, the report notes that when data is collected directly through interactions with ChatGPT, OpenAI must comply with Article 13 GDPR and explicitly inform users that their inputs may be used to train the model. The questionnaire is included as an annexe to the report.
Original source