AI privacy: Duty to protect your data

You may have seen that Italy banned ChatGPT for privacy reasons. So how does a generative AI tool have privacy issues?

Before we get into that, it is worth noting that this is not an issue peculiar to Italy. The Canadian Privacy Commissioner has launched an investigation into ChatGPT. The UK’s Information Commissioner’s Office published a post setting out 8 data privacy questions that should be asked about generative AI. Wired magazine says, “Many of the issues raised by the Italian regulator are likely to cut to the core of all development of machine learning and generative AI systems…”

The Italian regulator cites 4 issues. The first is a data breach that allegedly leaked subscriber payment information and user conversations. The second is that it doesn’t adequately verify ages of users who are children. Those issues are not unique to generative AI tools.

The broader issues unique to generative AI are related to the fact that it uses machine learning to generate responses. It trains on data sets that have been put together by various means. Those data sets may contain personal information. Also, the data users input as prompts to generative AI tools may end up in the training database.

The privacy issue is that no one consented to their personal information being used in a data set for training purposes or to be published in AI-generated output. And the platform may not be obtaining proper consent to use data input by users. On top of that, the personal data in the training database and the output may be inaccurate.

In a recent blog, we asked if organizations need an AI policy, and pointed out that inputting anything confidential, sensitive, or personal should be avoided. Unless of course the platform expressly promises that it does not retain that information.

This issue has the same root cause as complaints by artists that they didn’t give AI generative art tools permission to use their works to learn on or to create new works that look like theirs.

Just because we publish our personal information and creative works on the internet or social media doesn’t mean anyone can copy it for whatever they want.

David Canton is a technology and AI lawyer at Harrison Pensa with a practice focusing on technology, privacy law, technology companies and intellectual property. Connect with David on LinkedIn and Twitter.

Image credit: ©Atchariya – stock.adobe.com