The joint overview<\/a> says more than 99 per cent of the information used by OpenAI to pre-train the models came from crawling, or scraping, publicly accessible sources, with the rest coming from third-party licensed datasets.<\/p>\nFederal, Alberta and B.C. privacy laws contain consent exceptions for some publicly available information, but the joint overview says the legal definition of \u201cpublicly available\u201d is different from a common understanding of information that can be accessed online.<\/p>\n
OpenAI took the position that it could rely on implied consent to collect and use information from those sources to train its models.<\/p>\n
The federal, Alberta and B.C. offices rejected that position, finding OpenAI failed to obtain valid consent, implied or otherwise, for collecting and using personal information from publicly accessible sources for model-training purposes.<\/p>\n
\u201cFrom the Alberta perspective, I want to note first that it is unfortunate and disappointing that technology companies have moved ahead so quickly with new developments and innovations, without first ensuring that they are adhering to privacy legislation,\u201d said Alberta Information and Privacy Commissioner Diane McLeod.<\/p>\n
\u201cOur investigation found that that OpenAI did not appear to turn its mind adequately to privacy compliance in its development and deployment of ChatGPT, which is very troubling. The first ChatGPT model was launched in 2022, nearly two decades after privacy law in Canada applied to the private sector.\u201d<\/p>\n
Investigation began in 2023<\/p>\n
The joint investigation was triggered by an April 2023 complaint alleging collection, use and disclosure of personal information without consent.<\/p>\n
It was announced the following month and examined whether OpenAI\u2019s handling of personal information in Canada through ChatGPT complied with federal and provincial private-sector privacy laws.<\/p>\n
The joint overview says sources of training data included social media and discussion forums, which can contain personal information about children, sensitive information such as political views or health conditions, and potentially inaccurate information such as opinions or false statements about others.<\/p>\n
The joint overview says the privacy offices found OpenAI\u2019s initial collection of personal information from publicly accessible websites and licensed third-party sources to train the models was overbroad and inappropriate.<\/p>\n
The joint overview says the offices also found OpenAI\u2019s mitigation measures at the time were not sufficient to limit the collection, use and disclosure of personal information to what was necessary and proportional for model training.<\/p>\n
Alberta law<\/p>\n
McLeod said the conclusions reached by each privacy office varied because each regulator investigated compliance with its own legislation.<\/p>\n
\u201cAn important aspect of this investigation is that each of the four regulators investigated compliance with the specific legislation that they oversee,\u201d McLeod said.<\/p>\n
\u201cAs a result, the conclusions reached by each office varied due to the differences in the laws that they enforce. In the case of our office, we were investigating whether the development of ChatGPT was compliant with Alberta\u2019s Personal Information Protection Act or PIPA, which governs private organizations such as corporations, unincorporated associations, professional regulatory organizations, trade unions and partnerships.\u201d<\/p>\n
OpenAI response<\/p>\n
The joint overview says OpenAI generally disagreed with the findings, asserting it was compliant with the laws in most respects through a combination of existing practices and communications.<\/p>\n
It says OpenAI nonetheless engaged with the privacy offices and said it had implemented or committed to measures including new filtering tools, formal retention policies, data-export improvements, additional privacy notices and more plain-language information about the sources used to train its models.<\/p>\n
The Alberta and B.C. offices said the measures are not sufficient to meet the foundational consent requirement under their laws.<\/p>\n
Despite that finding, Alberta and B.C. joined the federal and Quebec privacy authorities in making joint recommendations and monitoring implementation of OpenAI\u2019s commitments.<\/p>\n
\u201cThe privacy laws we currently have in Canada were drafted and enacted during a time when today\u2019s incredible advancements in technologies, such as AI, would have strained believability,\u201d McLeod said.<\/p>\n
\u201cLegislators now face the challenge of modernizing privacy laws in ways that will enable AI companies to continue to develop these innovative technologies, but only in a manner that safeguards privacy, reduces potential harms to citizens, and requires accountability and transparency. My hope is that OpenAI has learned from this investigation and that other technology companies that are developing and deploying AI or other novel technologies also learn from this report that privacy must be a top priority and cannot be an afterthought.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"Alberta\u2019s privacy commissioner says OpenAI failed to meet provincial consent requirements when it developed some ChatGPT models using…\n","protected":false},"author":2,"featured_media":29715,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[580,157],"class_list":{"0":"post-29770","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-openai","8":"tag-chatgpt","9":"tag-openai"},"_links":{"self":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/29770","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/comments?post=29770"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/29770\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media\/29715"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media?parent=29770"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/categories?post=29770"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/tags?post=29770"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}