European Data Protection Board – EDPB announces adoption of the report on the work of the ChatGPT taskforce.

The European Data Protection Board – EDPB adopted a report on the work of the ChatGPT taskforce. This taskforce was created by the EDPB to promote cooperation between Data Protection Authorities (DPA) investigating the chatbot developed by OpenAI. The report provides preliminary views on certain aspects discussed between DPAs and does not prejudge the analysis that will be made by each DPA in their respective, ongoing investigation.

The report analyses several aspects concerning common interpretation of the applicable GDPR provisions relevant for the various ongoing investigations, such as:

• lawfulness of collecting training data (“web scraping”), as well as processing of data for input, output and training of ChatGPT.
• fairness: ensuring compliance with the GDPR is a responsibility of OpenAI and not of the data subjects, even when individuals input personal data.
• transparency and data accuracy: the controller should provide proper information on the probabilistic nature of ChatGPT’s output and refer explicitly to  the fact that the generated text may be biased or made up

The report points out that it is imperative that data subjects can exercise their rights effectively.

Taskforce members also developed a common questionnaire as a possible basis for their exchanges with Open AI, which is published as an annex to the report.

Furthermore, the EDPB decided to develop guidelines on Generative AI, focusing as a first step on data scraping in the context of AI training.