British Columbia’s privacy watchdog said the province’s privacy law should be updated to reflect how artificial intelligence companies like OpenAI collect personal data.
B.C.’s Information and Privacy Commissioner Michael Harvey was part of a joint investigation into OpenAI’s ChatGPT chatbot, along with his counterparts from Alberta and Quebec and federal Privacy Commissioner Philippe Dufresne.
The report, released Wednesday, said OpenAI was not compliant with Canadian privacy laws in its initial training and use of ChatGPT.
The probe examined OpenAI’s collection of personal information from internet sources and third parties for the purpose of training its GPT-3.5 and 4 models.
Dufresne said the company over-collected personal information without proper consent, and lacked transparency in how it collected the information.
He said there were also concerns about inaccuracies in the personal information provided in ChatGPT responses, people’s inability to access, correct, and delete their personal information, and a general lack of accountability.
“OpenAI launched ChatGPT without having fully addressed known privacy issues. This exposed Canadians to potential risks of harm such as breaches and discrimination on the basis of information about them,” said Dufresne.
The investigation focused on language models that OpenAI has since retired.
The joint report highlights several steps the company has taken to improve user’s privacy.
Dufresne said the measures taken or planned by OpenAI effectively address concerns related to federal privacy laws raised throughout the investigation.
But Harvey said there are still outstanding concerns about OpenAI’s data practices under B.C.’s privacy legislation.
Harvey said in a letter to B.C.’s Citizens Services Minister Diana Gibson that OpenAI contravened B.C.’s Personal Information Protection Act (PIPA) in all but one of the 13 issues the joint group looked into.
Speaking in Ottawa on Wednesday, Harvey said B.C.’s laws generally work together with federal privacy laws, but B.C.’s legislation differs when it comes to implied consent for data collection.
In B.C., implied consent applies when a person voluntarily provides personal information for an obvious purpose.
Harvey said because OpenAI trained its models by scraping data from a vast range of websites, it cannot rely on implied consent under B.C.’s PIPA because it didn’t directly gather the data itself from users.
“Almost all of the information used to train those models was collected in that way, and so the consent model just does not work,” said Harvey.
He said there needs to be a different path for such companies to legally collect data.
Harvey is calling on the province to update its privacy law to include an exception for “legitimate interest” data processing. That would allow organizations to process personal information without consent if they can demonstrate a legitimate interest that outweighs any potential negative impacts on individuals.
“We’re not saying that we should just allow companies to just collect that information, rather that an alternative legal authorization must be created with the appropriate guardrails around it,” said Harvey.
He said those guardrails could include improving oversight and governance of data collection, and increasing privacy commissioners’ authority to make orders and levy penalties.
“These are the things that would give people trust that the use of their information is for their benefit and that value isn’t being extracted from their information for the value of others,” he said.
The Personal Information Protection Act is required to be reviewed at least once every six years, and the last review took place in 2021. Harvey recommended that the timeline for the next review be moved up.
Gibson said she welcomes the report’s findings, and will continue to work with the B.C. commissioner and federal officials on protections around AI.
“Ai is evolving quickly, and people are concerned about the safety and their privacy,” she said.
“We want to make sure that we have modern oversight, strong safe guards and that we are protecting British Columbians privacy,” said Gibson.
