Canada's Privacy Commissioner, Philippe Dufresne, determined that OpenAI infringed Canadian data protection regulations during the development and launch of ChatGPT. The authority concluded that the company collected personal information without legitimate consent.
OpenAI trained its system with real private data of citizens, including medical histories and ideological leanings. The report indicates that this practice also affected minors.
The investigation revealed that the company carried out tracking on forums, public platforms, and social networks. These actions were executed without explicit authorization from those affected nor a legal basis for the massive processing of such sensitive information.
The company assumes corrective measures after the sanction
OpenAI has modified its privacy protections and agreed to take additional measures to prevent recurrence of unauthorized data use. The commitments made include tools to detect and mask personal data.
Additionally, the company will implement improvements in the mechanisms for accessing and correcting information. Formal data retention and deletion policies are established along with clearer notifications to users about the use of their information to train models.
"The company must provide information that proves compliance with the commitments established by Canadian authorities" - Philippe Dufresne, Privacy Commissioner of Canada
This administrative procedure occurs in a context of global scrutiny towards generative artificial intelligence. The Canadian resolution adds regulatory pressure on large-scale data collection practices.
Litigation extends beyond North America
The investigation in Canada coincides with the multimillion-dollar lawsuits that OpenAI faces in the United States for similar issues. The plaintiffs in the neighboring country allege comparable violations regarding intellectual property and privacy.
Canadian authorities maintain active supervision of the case. Compliance with the new protocols will be verified through periodic reports that the technology company must submit to the regulatory body.