European data protection advocacy organization noyb has lodged a formal complaint against OpenAI concerning the company's inability to rectify inaccurate information generated by ChatGPT, alleging a violation of the General Data Protection Regulation (GDPR) within the European Union.

Maartje de Graaf, Data Protection Lawyer at noyb, emphasized the severity of the issue, stating, "Fabricating false information is concerning on its own, but when it involves individuals, the consequences can be significant."

noyb argues that OpenAI's failure to ensure the accuracy of personal data processed by ChatGPT violates GDPR requirements, which mandate the accuracy of personal data and grant individuals the right to rectification and access to information about processed data and its sources. However, OpenAI has acknowledged its inability to correct inaccurate data generated by ChatGPT or disclose the data sources used for model training, citing ongoing research into factual accuracy in large language models.

The complaint highlights a New York Times report revealing that chatbots like ChatGPT produce false information in a significant percentage of interactions. In one instance cited by noyb, ChatGPT repeatedly provided an incorrect date of birth for a complainant, despite requests for correction.

OpenAI claimed it could filter or block certain data prompts, such as the complainant's name, but doing so would hinder ChatGPT's ability to filter all information about the individual. Additionally, OpenAI failed to adequately respond to the complainant's access request, a requirement under GDPR.

Maartje de Graaf emphasized the universal obligation for companies to comply with access requests and stressed the importance of maintaining records of training data to trace the sources of information. European privacy watchdogs have previously scrutinized ChatGPT's inaccuracies, with actions taken by authorities such as the Italian Data Protection Authority and the European Data Protection Board.

noyb's complaint urges the Austrian Data Protection Authority to investigate OpenAI's data processing practices and ensure the accuracy of personal data processed by its large language models. The organization also seeks enforcement measures, including compliance with access requests, alignment with GDPR standards, and potential fines to ensure future compliance from OpenAI.