Canada’s Privacy Commissioner, Philippe Dufresne, presented the findings of a probe into OpenAI with provincial counterparts in Ottawa on Wednesday.Adrian Wyld/The Canadian Press
A three-year-long investigation by federal and provincial privacy regulators found that OpenAI violated laws when handling personal information for the initial release of ChatGPT, but said the San Francisco-based company has made changes to address major concerns.
The report released on Wednesday found that OpenAI collected vast amounts of personal information without adequate safeguards and valid consent, with many users unaware that their data was captured and used to train AI models. Federal and provincial regulators also faulted OpenAI for not giving Canadians an easy and effective way to correct and delete personal information, and for releasing ChatGPT without first addressing known privacy risks. OpenAI did not provide adequate notice about inaccuracies in ChatGPT responses either, according to the report.
OpenAI’s practices have changed since the Office of the Privacy Commissioner of Canada first launched an investigation into ChatGPT in April, 2023, in response to a complaint. (Privacy regulators from Quebec, Alberta and British Columbia joined the probe soon afterward.)
Those changes include filtering to detect and mask personal information, technical tools to block ChatGPT from revealing personal details about specific public figures, and a formal data retention and deletion policy.
OpenAI also agreed to several other changes in the coming months, including publishing more information about its privacy policies and the sources of content used to train its models. The company will better inform individuals who are signed out and using the web version of ChatGPT that their conversations may be used to train future AI models and advise them not to share sensitive information.
“I’ve concluded that the measures that have been and that will be implemented by OpenAI will address the concerns identified during the investigation,” said Philippe Dufresne, Privacy Commissioner of Canada, at a press conference on Wednesday.
The regulators also called for updated privacy legislation to deal with fast-moving AI technologies.