The future of AI and privacy: Examining the impacts of ChatGPT

What is the global position on privacy with ChatGPT?

ChatGPT and other AI software are shaping the way companies operate. Many organisations use ChatGPT to improve their marketing game and create more compelling content. Like Samsung, some companies may even use it to solve business problems.

This, however, caused some serious privacy issues for Samsung after employees using ChatGPT led to an accidental source code leak.  It's worth noting that while privacy concerns typically revolve around handling personal data, in this context, the focus shifts to safeguarding confidential business data. Samsung is not alone in grappling with such issues pertaining to the AI language model.

In January, Amazon, a well-known retailer, issued a warning to its employees, advising them against sharing any code or confidential information with ChatGPT.

This was after the company reportedly discovered examples of ChatGPT responses that resembled internal Amazon data.

In the case of both Samsung and Amazon, the privacy incidents were the result of human error. Unfortunately, any company can face this risk. That’s why following and maintaining regulations such as the General Data Protection Regulation (GDPR) are crucial. These laws establish stringent standards for collecting, processing and using sensitive data to prevent such issues.

But even with such robust standards, would you still face privacy challenges while using ChatGPT?

Are there privacy compliance challenges with ChatGPT?

Simple answer: yes.

You have the ability to control privacy within your company. However, when it comes to the data you input into AI software like ChatGPT, you can't control what happens to it. This lack of control poses numerous privacy challenges, with the most significant ones being:

• Data collection and retention - ChatGPT's compliance challenge lies in collecting and retaining user data to enhance its learning process. Given the nature of AI systems and their imperative need for data for training and learning, this does not appear to be compatible with the right of data subjects under Art 17 GDPR, according to which data subjects shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay.
• Transparency and accountability - There is a lack of transparency in developing and training AI language models like ChatGPT. Even for experts, it is difficult to understand how it makes decisions and generates responses. This appears to be incompatible with the principle of lawfulness, fairness and transparency of Art. 5(1)(a). In addition, the question arises of who is the controller in the end. The company that uses AI will generally be classified as the controller because it decides on the purposes and means of data processing. It is arguable that the role of the AI system’s provider is a processor, according to Art. 28 GDPR, because the actual data processing takes place on the servers of the providers. Some providers also offer the conclusion of a contract for commissioned processing (e.g. OpenAI for the use of ChatGPT). A privacy contract will be necessary in any case, which raises the consequential question whether the provider can even comply at all with the assurances contained therein.
• Third-Country data transfers - Of course, the ongoing problem of third-country transfers also exists in the use of AI, as the servers of the providers are regularly in third countries. As soon as personal data is sent from one place to another, we speak of data transfer. Depending on the local data protection level, the GDPR formulates different requirements for this.

In the face of such challenges, it is crucial to equip your company with up-to-date security standards. Additionally, ensure that your employees are well-informed about the appropriate utilization of sensitive data. Failure to do so may result in potential reputational harm and penalties under data security laws.

What are the potential risks and penalties for non-compliance?

Data privacy regulations exist to keep citizens safe, ensure fair business practices and protect sensitive personal information. Complying with these regulations is crucial to mitigate damage caused by security incidents like data leaks or breaches. Failure to comply can expose your company to risks such as:

• Monetary penalties - The most well-known consequence of non-compliance is the financial loss from government action, which can take the form of:
  • Limitations on your business activities.
  • Fines
  • Legal fees associated with a legal investigation.
  • In extreme cases, even prison time.
    
    

    For example, the GDPR’s purpose is to safeguard EU citizens' personal data and establish guidelines for its processing by companies in the region. Non-compliance can result in fines of up to €20 million or 4% of the company's global annual revenue, whichever is higher. 

• Loss of trust and brand reputation - Non-compliance can lead to more than just fines. Compliance-driven reputational damage is discouraging to both customers and potential business partners. Damage to your reputation is an unseen cost of non-compliance that can have serious consequences.

• Legal action - Non-compliance can result in legal action, such as civil lawsuits or criminal charges. Legal action can be time-consuming and expensive and could further damage a company’s reputation. Not only small businesses with limited resources face this issue, but even large organisations risk severe damage to operations. This is just the tip of the iceberg of companies’ non-compliance-related risks, especially when using new technology. But with every problem comes a solution, and there are ways that you can avoid these risks.

What can you do to avoid compliance problems with ChatGPT?

Many data protection regulations outline steps you can take to improve privacy in your company. These include:

1. Train your employees and implement policies - Employees are a vulnerable aspect when it comes to data privacy. With the right training and awareness, AI can be used sensibly and in a data protection-compliant manner. Also, implementing transparent data governance policies should outline compliant processing of data by AI Tools.
2. Transparent Information - Pursuant to Art 13 GDPR, companies must inform data subjects about the processing of their data. In addition to the usual information that must always be provided, information on automated decision-making in individual cases pursuant to Art 22 GDPR must also be provided. Data subjects should be informed in a meaningful way about the logic involved and the scope and intended effects of such processing.
3. Updated Documentation - When using new tools, and therefore also when using AI tools, the Data Documentation, including the Records of processing activities according to Article 30 GDPR, should of course be updated.
4. Conducting regular risk assessments and Data protection impact assessment - When using ChatGPT, it’s a good idea to conduct risk assessments and a data protection impact assessment, according to Art. 35 GDPR  to identify potential compliance problems
5. Privacy by design – If possible, the settings should be managed not to give consent to providers to use the data collected through the use of AI systems for the further development of AI models. Instead, it is recommended to make use of the opt-out option (this is available to commercial users, e.g. in the case of ChatGPT).
6. Monitoring ChatGPT for potential bias and ethical concerns - Companies should regularly review and audit ChatGPT models, data inputs, and outputs to ensure ethical use. Additionally, monitoring for biases and ethical concerns is essential. This proactive approach enables identifying and reporting any issues before they escalate into problems.

What does the future of ChatGPT look like?

In many regions around the world, the future of ChatGPT remains uncertain. This is mainly due to heightened regulatory attention and the growing concerns regarding ChatGPT privacy. Italy has already implemented bans, while several European nations closely monitor the AI's development.

With these concerns, stricter regulations may be imposed, prompting ChatGPT to adjust its data collection methods for compliance. Overall, it's crucial for OpenAI and other AI creators to emphasize privacy considerations. They must guarantee a valid and legal framework for collecting data on their platforms.

For now, it is advisable to exercise caution while using ChatGPT. You may also consider exploring alternative software options that can provide assurance regarding the security of your data.