Canadian regulators find OpenAI violated privacy

Canadian privacy regulators said on May 6 that OpenAI’s early development and training of ChatGPT broke federal and provincial privacy laws in Canada. The findings came from a joint investigation by the Office of the Privacy Commissioner of Canada and counterparts in Quebec, British Columbia and Alberta. The probe examined how OpenAI collected, used and disclosed Canadians’ personal information in building and operating ChatGPT. Regulators said the company has since taken steps to improve protections and committed to additional changes in the coming months. ### Which regulators investigated OpenAI, and what did they actually decide? The Office of the Privacy Commissioner of Canada said it worked with the Commission d’accès à l’information du Québec, the Office of the Information and Privacy Commissioner for British Columbia and the Office of the Information and Privacy Commissioner of Alberta. Their joint report assessed OpenAI under Canada’s federal private-sector privacy law, PIPEDA, and parallel provincial laws in Quebec, British Columbia and Alberta. (priv.gc.ca) The regulators concluded that “the way that OpenAI had initially trained ChatGPT was not compliant” with those laws. The federal commissioner said the complaint was “well-founded and conditionally resolved” because OpenAI had implemented measures and committed to more steps that, in his view, would address the federal concerns. The agencies said outcomes differed somewhat by jurisdiction because each office applies different statutes. ### What conduct did the investigation focus on? (priv.gc.ca) The investigation focused on ChatGPT’s early models and on the data sources used to train them, including publicly scraped content, licensed datasets and user interactions. Regulators examined whether OpenAI had complied with core privacy principles including consent, transparency and accuracy. The report said OpenAI collected “vast amounts” of personal information without adequate safeguards to prevent that information from being used in model training. (priv.gc.ca) Regulators said that information could include sensitive details such as health conditions, political views and information about children. They also said many people were unaware their personal information could be collected from social media, discussion forums and similar websites and then used in ChatGPT training. (priv.gc.ca) ### What privacy failures did the commissioners identify? The May 6 findings listed five main problem areas: overcollection of personal information, lack of valid consent and transparency, factual inaccuracies involving personal information, weak access-correction-deletion mechanisms, and lack of accountability. The report also said OpenAI had not established data-retention and disposal rules before releasing ChatGPT. Privacy Commissioner Philippe Dufresne said OpenAI’s data collection for training was “overly broad,” and that the company launched ChatGPT “without having fully addressed known privacy issues.” He said that exposed Canadians to risks including breaches and discrimination based on information about them. (priv.gc.ca) Regulators also said OpenAI had not, until recently, conducted an assessment to validate the accuracy of personal information that could appear in ChatGPT responses. (priv.gc.ca) ### Did regulators order penalties or force a shutdown? The federal regulator did not announce a fine or a shutdown in the materials published on May 6. Instead, the Office of the Privacy Commissioner of Canada said OpenAI had already implemented measures during the investigation and agreed to further commitments. Those steps included significantly limiting the personal and sensitive information used to train new ChatGPT models and taking steps to better inform Canadians about the implications of using the service. (priv.gc.ca) Alberta’s privacy commissioner said the joint report included recommendations to improve privacy protections within ChatGPT models. The federal office said it would monitor OpenAI’s actions to ensure the company continued to limit the privacy impact of its AI tools. ### How does this fit into OpenAI’s broader legal and regulatory picture? The Canadian findings add to a wider set of legal and regulatory challenges facing OpenAI in multiple jurisdictions. Recent reports have also described U.S. litigation over alleged disclosure of ChatGPT query information to Meta and Google, alongside other court fights over OpenAI’s business and product practices. (priv.gc.ca) May 6 is now the key date in Canada’s case. (oipc.ab.ca) The next concrete step is oversight: the federal privacy commissioner said his office will watch whether OpenAI follows through on the measures it has implemented and the commitments it made for the coming months. (priv.gc.ca) (letsdatascience.com)