![\"are-the-gdpr-walls-closing-in-on-open-ai-no-italy-did-not-ban-chat-gpt\"](\"https:\/\/www.ubiscore.com\/wp-content\/uploads\/2023\/04\/are-the-gdpr-walls-closing-in-on-open-ai-no-italy-did-not-ban-chat-gpt-300x158.png\")
<\/p>\n<\/p>\n
OpenAI began as a non-profit that trained open-source AI models on unpublished books. Eight years later, fueled by billion dollars of investment from Microsoft, the company faces allegations of violating European data protection law\u2014and compliance demands that might be impossible to meet.<\/span>\u00a0<\/span><\/p>\n OpenAI started in 2015, funded by donations from entrepreneurs including Sam Altman (now the company\u2019s CEO), Elon Musk, and Peter Thiel\u2014plus corporations such as Amazon Web Services (AWS), Infosys, and Microsoft.<\/span>\u00a0<\/span><\/p>\n OpenAI\u2019s <\/span>stated goal<\/span><\/a> was to \u201cadvance digital intelligence in the way that is most likely to benefit humanity as a whole, unconstrained by a need to generate financial return.\u201d<\/span>\u00a0<\/span><\/p>\n It’s hard to predict when human-level AI might come within reach,\u201d an early OpenAI press release states. \u201cWhen it does, it’ll be important to have a leading research institution which can prioritise a good outcome for all over its own self-interest\u201d.<\/span>\u00a0<\/span><\/p>\n OpenAI\u2019s most significant work is its GPT series (short for \u201cGenerative Pre-trained Transformer\u201d) of AI models.<\/span>\u00a0<\/span><\/p>\n GPT was the first \u201ctransformer\u201d-type AI to receive \u201csemi-supervised\u201d training. Whereas earlier transformers required a lot of costly and time-consuming human intervention, GPT could <\/span>learn from<\/span><\/a> large amounts of raw, unlabelled data.<\/span>\u00a0<\/span><\/p>\n The <\/span>first GPT model<\/span><\/a> was trained on literature\u20147,000 unpublished books comprising 4.5 GB of text.<\/span>\u00a0<\/span><\/p>\n With GTP\u2019s successor, GPT-2, OpenAI began integrating text scraped from the open web. The model\u2019s training set <\/span>included<\/span><\/a> \u201call outbound links from Reddit\u2026 which received at least three karma\u201d. As a result, GPT-2 produced more convincing, \u201chuman-like\u201d outputs.<\/span>\u00a0<\/span><\/p>\n After some initial reluctance to publicly release the model\u2014supposedly due to concern over its potential to produce disinformation\u2014OpenAI eventually published GPT-2\u2019s source code in February 2019.\u00a0<\/span>\u00a0<\/span><\/p>\n Shortly before releasing GPT-2, OpenAI <\/span>announced<\/span><\/a> that was switching from a non-profit to a \u201ccapped\u201d private company whose profits would never exceed an amount 100 times higher than its original investment.<\/span>\u00a0<\/span><\/p>\n The following year, OpenAI <\/span>announced<\/span><\/a> GPT-3\u2014a version of which would later power OpenAI\u2019s leading commercial product, ChatGPT.<\/span>\u00a0<\/span><\/p>\n GPT-3 was trained on a much larger corpus of data than previous GPT models. Around 60% of GPT-3\u2019s training set came from <\/span>Common Crawl<\/span><\/a>, a non-profit that \u201cscrapes\u201d the web each month and provides free access to the resulting dataset.<\/span>\u00a0<\/span><\/p>\n Common Crawl, a non-profit, has been largely left alone by US authorities and rightsholders. The organisation has <\/span>defended<\/span><\/a> the legality of its operations against allegations of copyright abuse.<\/span>\u00a0<\/span><\/p>\n Under US law, web scraping is <\/span>protected by the first amendment<\/span><\/a>. The legal situation is different in Europe, where a \u201clegal basis\u201d is required for most activities involving personal data (which will inevitably appear in a large enough set of web-scraped data).<\/span>\u00a0<\/span><\/p>\n Although OpenAI <\/span>allowed<\/span><\/a> limited third-party access to the GPT-3 API, enabling others to integrate GPT-3 into their products, the company declined to release the model\u2019s source code.<\/span>\u00a0<\/span><\/p>\n \u201cIn addition to being a revenue source to help us cover costs in pursuit of our mission, the API has pushed us to sharpen our focus on general-purpose AI technology.\u201d OpenAI <\/span>said<\/span><\/a> in a June 2020 blog post.<\/span>\u00a0<\/span><\/p>\n In January, the company received a <\/span>$10 billion<\/span><\/a> funding injection from Microsoft, which subsequently announced it would integrate OpenAI\u2019s model into the Bing search engine.<\/span>\u00a0<\/span><\/p>\n On releasing its most recent GPT model, GPT-4, this March, OpenAI did not publish any information about the model\u2019s size, architecture, or training data, <\/span>citing<\/span><\/a> the \u201ccompetitive landscape\u201d and \u201csafety implications\u201d.<\/span>\u00a0<\/span><\/p>\n ChatGPT, the chatbot released by OpenAI last October, runs on GPT-3.5\u2014a fine-tuned version of GPT-3 whose training data includes information published as recently as June 2021.<\/span>\u00a0<\/span><\/p>\n ChatGPT\u2019s user-friendly design helped it <\/span>reportedly<\/span><\/a> become history\u2019s fastest-growing app, attracting over 100 million users within a few months of its launch.<\/span>\u00a0<\/span><\/p>\n Despite the program\u2019s impressively human-like outputs, OpenAI <\/span>admitted<\/span><\/a> that ChatGPT would sometimes \u201crespond to harmful instructions\u201d, \u201cexhibit biased behaviour\u201d, and produce \u201cplausible-sounding but incorrect or nonsensical answers\u201d.<\/span>\u00a0<\/span><\/p>\n OpenAI\u2019s GDPR compliance efforts have been relatively slow. The company published its <\/span>data processing agreement<\/span><\/a>, a mandatory contract for companies using \u201cdata processors\u201d under the GDPR, on 14 March\u2014some five months after ChatGPT\u2019s launch.<\/span>\u00a0<\/span><\/p>\n The following week, OpenAI <\/span>notified<\/span><\/a> users of a security breach that exposed some users\u2019 private chat topics, names, email addresses, billing addresses, and limited payment information. It was this relatively minor incident that led to OpenAI\u2019s first reckoning under the GDPR.<\/span>\u00a0<\/span><\/p>\n Italy\u2019s data protection authority (DPA), the Garante, was the first regulator to directly challenge OpenAI, announcing <\/span>action<\/span><\/a> against the company on 31 March.<\/span>\u00a0<\/span><\/p>\n While the Garante\u2019s intervention was triggered by ChatGPT\u2019s security incident, the regulator issued an emergency order addressing a much broader set of issues. The Garante alleged that OpenAI:<\/span>\u00a0<\/span><\/p>\n \u00a0<\/span>The regulator cited violations of Articles 5, 6, 8, 13, and 25 of the GDPR\u2014provisions relating to the GDPR\u2019s principles, its legal bases, the rules on delivering online services to children, transparency obligations, and the concept of \u201cdata protection by design\u201d.<\/span>\u00a0<\/span><\/p>\n The Garante\u2019s order against OpenAI required the \u201ctemporary limitation of the processing of personal data of data subjects established in the Italian territory\u201d. The company had 20 days to explain how it would address the compliance issues alleged by the regulator.<\/span>\u00a0<\/span><\/p>\n In <\/span>response<\/span><\/a>, OpenAI \u201cceased offering ChatGPT in Italy\u201d.<\/span>\u00a0<\/span><\/p>\n Italy\u2019s action against OpenAI provoked headlines such as \u201c<\/span>Italy blocks ChatGPT over privacy concerns<\/span><\/a>\u201d and \u201c<\/span>ChatGPT banned in Italy<\/span><\/a>\u201d.\u00a0<\/span>\u00a0<\/span><\/p>\n But rather than having been \u201cblocked\u201d or \u201cbanned\u201d by Italy, OpenAI chose to restrict Italian users\u2019 access as a means to comply with the regulator\u2019s order.\u00a0<\/span>\u00a0<\/span><\/p>\n In an <\/span>interview<\/span><\/a> following OpenAI\u2019s decision, a Garante representative said the company could, in theory, have continued offering ChatGPT\u2014if it could do so without processing any personal data about people in Italy.<\/span>\u00a0<\/span><\/p>\n On a technical level, it would be impossible to offer ChatGPT in Italy without processing personal data about Italians. In fact, it\u2019s unclear how OpenAI could have limited all processing of such data\u2014regardless of whether the company blocked ChatGPT.<\/span>\u00a0<\/span><\/p>\n \u00a0<\/span>Processing\u201d is defined broadly in the GDPR, covering \u201cany operation\u201d performed on personal data.<\/span>\u00a0<\/span><\/p>\n As such, whatever OpenAI did in response to the Garante would have constituted \u201cprocessing\u201d\u2014including deleting personal data in its training set, continuing to store that data, or providing refunds to Italian customers.<\/span>\u00a0<\/span><\/p>\n And despite the geo-restriction of ChatGPT, the chatbot would continue to generate inaccurate personal data about people in Italy (which was one of the Garante\u2019s key concerns). There is no clear solution to the \u201caccuracy\u201d problem short of closing down the app altogether.<\/span>\u00a0<\/span><\/p>\n On 12 April, a week before OpenAI\u2019s original deadline, the Garante <\/span>announced<\/span><\/a> that OpenAI had a further 18 days to bring its operations into compliance with the GDPR.<\/span>\u00a0<\/span><\/p>\n By the end of April, OpenAI must:<\/span>\u00a0<\/span><\/p>\n <\/p>\n The following day, at the <\/span>request<\/span><\/a> of the Spanish regulator, the European Data Protection Board (EDPB) <\/span>announced<\/span><\/a> a new \u201cdedicated task force\u201d to \u201cfoster cooperation\u201d and \u201cexchange information on possible enforcement actions\u201d against OpenAI.<\/span>\u00a0<\/span><\/p>\n The next OpenAI enforcement action could come from France, where the country\u2019s regulator is apparently <\/span>investigating complaints<\/span><\/a> about the company.<\/span>\u00a0<\/span><\/p>\n Even if OpenAI manages to satisfy Italy\u2019s demands, the company\u2019s compliance issues are unlikely to go away.<\/span>\u2018A Good Outcome for All\u2019<\/span>\u00a0<\/span><\/h2>\n
Semi-Supervised Learning<\/span>\u00a0<\/span><\/h3>\n
Common Crawl<\/span>\u00a0<\/span><\/h3>\n
The Closing of OpenAI<\/span>\u00a0<\/span><\/h3>\n
\u2018Plausible-Sounding But Incorrect\u2019<\/span>\u00a0<\/span><\/h2>\n
OpenAI\u2019s GDPR Reckoning<\/span>\u00a0<\/span><\/h3>\n
\n
Not a Block or a Ban<\/span>\u00a0<\/span><\/h3>\n
Further Investigations<\/span>\u00a0<\/span><\/h3>\n
\n
The End of the Beginning<\/span>\u00a0<\/span><\/h2>\n