OpenAi’s new privacy policy

OpenAI the US company that owns ChatGPT knows it is in the spotlight and at the end of last year, informed its users that it had made changes to its Privacy Policy for residents of the European Economic Area (EEA), Switzerland and the United Kingdom, which will take effect from February 15, 2024.

OpenAi updates its privacy policy and for the millions of users of this Artificial Intelligence (AI) application specialized in dialogue, it is important to know how its changes could affect the treatment of their personal data.

We analyze the new OpenAi Policy

With these changes, the artificial intelligence developer hopes to provide more information and transparency regarding the protection of the personal data it obtains from its users, guaranteeing their confidentiality and security.

We will now comment on the most relevant points of this new document, from our point of view:

Positive aspects

Disclosure of data

It is further specified to whom users’ personal data may be disclosed, such as service providers, when commercial transfers are made, affiliated government authorities, as well as administrators of commercial accounts.

Legal basis for processing

A table is included where the different purposes of the processing of personal data are specified according to the data processed, as well as the legal basis that supports such processing.

Negative aspects

Automatic data collection from OpenAi users

Data is collected automatically, such as log data, which includes Internet Protocol address, browser type and settings, the date and time of the request, and how you interact with the OpenAI Services and therefore ChatGpt; usage data, such as types of content you view or interact with, the features you use and the actions you take, as well as your time zone, country, dates and times of access, user agent and version, type and information about the device being used, connection used, where you access the device name, operating system, device identifiers, and the browser you are using.

In this regard, it could be thought that the collection of this data automatically, that is, without us as users being able to intervene in it, is very accurate and with this OpenAI could generate an exhaustive control of all users, as well as where they are located, the content they use or search, day and time of the search or query, etc.

And faced with this situation, should we ask ourselves if OpenAI generates profiles with this information, and can users object to this as part of their data protection rights?

In its Policy it states the following:

“You will have the right of access, rectification, erasure, portability, limitation, opposition for direct marketing and opposition to data processing based on legitimate interest.”

However, the right to object to being subject to automated decisions is not recognized.

On the other hand, there is an option to not use user-generated content to train your models, such as disabling the chat history in the data control section.

This option does not mean that none of our data will be used, but rather that the use of our data to train ChatGpt will be minimized, as OpenAI itself points out:

“We retain certain data from your interactions with us, but we take steps to reduce the amount of personal information in our training data sets before it is used to improve our models. This data helps us to better understand users’ needs and preferences, which allows our model to become more efficient over time. “.

Use of services by minors:

We know that minors must be protected in all types of regulations, as well as be supervised by their parents and/or guardians to perform any act.

In the case that the ChatGpt user is a minor under 18 years old, it is requested that they have permission from their parents and/or guardians to use OpenAi services; but it is not specified in any way how to determine the age or to be able to verify that the minor has obtained this permission from their elders beforehand, so there is no preventive action implemented to restrict access to minors for their use, even though they state in a transparent way that their services are not oriented to minors under 13 years old.

Contradictory aspects

Two Controllers are identified, according to the geographical location of the users:

European Economic Area (EEA) and Switzerland

OpenAI Ireland Limited, registered office at 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland.

United Kingdom

OpenAI OpCo, LLC, with registered office at 3180 18th Street, San Francisco, California 94110, United States.

But it should be noted that OpenAI’s Privacy Policy states the following regarding data transfers:

“(…) By using our Services, you understand and acknowledge that your Personal Data will be processed and stored on our facilities and servers in the United States and may be disclosed to our service providers and affiliates in other jurisdictions.“

From this transcript, it is implied that personal data will also be transferred to the United States and taking into account the decision of the European Commission to adapt the EU-US Data Privacy Framework in July 2023, OpenAI should be included in the list of companies that have adhered to the new privacy framework.

Conclusions OpenAi Privacy Policy

Although we recognize OpenAi’s efforts to improve and make its services more transparent, as well as the processing of the millions of data obtained from the use of the services it provides, we believe that there are still some gaps that need to be addressed in order to ensure that the processing of data is secure and in accordance with the applicable data protection regulations.

Business Adapter® at your service

If you are a ChatGPT user and you need our advice, contact us by email: info@businessadapter.es, you can also call 96 131 88 04, or leave your message in this form:

[su_button url=”https://businessadapter.es/contacto” target=”blank” background=”#f6f903″ color=”#181818″ size=”7″ center=”yes” icon_color=”#000000″]Contact us, we will be pleased to help you.[/su_button]