German regulators launch inquiry into ChatGPT GDPR compliance

Germany becomes the latest European nation to officially question OpenAI’s compliance with GDPR.

OpenAI faces another hurdle in its quest to continue doing business in the European Union as German authorities have launched an inquiry into the company’s privacy practices and GDPR compliance. 

As reported by AFP, regulators in Germany are demanding answers concerning the company’s intentions and ability to comply with the strict data privacy laws enshrined in the EU’s general data protection regulation (GDPR).

Marit Hansen, commissioner for the northern state of Schleswig-Holstein, told AFP reporters that regulators in Germany “want to know if a data protection impact assessment has been carried out and if the data protection risks are under control.” They added that the country was also asking OpenAI for “information on issues that stem from the European General Data Protection Regulation (GDPR).”

While this news doesn’t come as a surprise — German watchdog groups have recently recommended further scrutiny — it adds to an already complex situation for OpenAI.

The company released its GPT-4 model in mid-March. In the short time since, OpenAI has faced increasing scrutiny from regulators, especially those in Europe. Italy was the first Western nation to issue a ban on the products. At the same time, the company and local regulators are sorting out whether OpenAI can comply with GDPR and Italian privacy laws.

Related: OpenAI has until April 30 to comply with EU laws — ‘Next to impossible,’ say experts

It’s unclear at this time exactly how OpenAI intends to respond — requests for commentary were not immediately returned — but German regulators have signaled that they expect the company to respond to their inquiries no later than June 11.

Essentially, the core issues raised by regulators across Europe relate to the training data used to build the GPT AI models. Currently, users cannot opt out of having their data included, nor can they correct the models if they make a mistake.

Under GDPR, individuals are entitled to have their data modified to reflect accuracy or removed from systems altogether.

Caught in the middle of the ongoing narrative are the many OpenAI users, especially those paying premium subscription fees for personal and business access to the company’s GPT API.

Cryptocurrency traders and analysts building advanced bots on top of the API itself, or those using third-party apps built on the API to prognosticate the market or trade autonomously in the EU, could find themselves swept up in any binding litigation or sweeping bans.

If such a ban goes into effect, it could force any company or individuals using these bots for cryptocurrency trading and analysis — including exchanges, news sites, and blockchain firms — to conduct such operations outside of the EU.