A joint investigation by BC Privacy Commissioner Michael Harvey, the federal commissioner, and provincial counterparts in Quebec and Alberta, into OpenAI has identified how the initial development of ChatGPT was not compliant with provincial and federal privacy laws. In British Columbia, private sector organizations are subject to the Personal Information Protection Act (PIPA). 

The report highlights the steps the company has taken to improve users’ privacy in response to the investigation and recommendations.

 The joint investigation examined OpenAI’s collection, use, and disclosure of personal information for the purpose of developing its AI-powered chatbot, ChatGPT. 

 The regulators identified several areas where the initial training and deployment of ChatGPT were not compliant with privacy laws, including overcollection of personal information; lack of consent and transparency; factual inaccuracies involving personal information; issues related to individuals’ ability to access, correct, and delete their personal information; and a general lack of accountability.

 Throughout the course of the investigation and in response to findings and recommendations made by the regulators, OpenAI implemented measures to improve privacy protections in the ongoing development and operation of ChatGPT. Most importantly, in response to the findings OpenAI has significantly limited the personal information and sensitive information that is used to train its new ChatGPT models.

 Each of the four regulators investigated compliance with the specific legislation that they oversee. As a result, the conclusions reached by each Office varied due to the differences in the laws that they enforce.

 In BC, the OIPC found that OpenAI's practice of scraping information, including personal information, from the internet without individuals’ knowledge or consent continues to fall short of meeting the foundational requirement for consent in PIPA. Despite this finding, the OIPC is encouraged by the new measures taken by OpenAI to improve its compliance, and will join in monitoring OpenAI’s further developments.

 “This report highlights the fundamental disconnect between how one of the world’s most widely used AI applications works and what BC’s Personal Information Protection Act demands. The findings of this report show that we’re at an impasse at a critical juncture in the Information Age – between AI applications that could potentially have tremendous benefits for the economy and society but have been developed without adequate attention to privacy; and privacy laws that were written for a different era. Both have to change. I am encouraged that OpenAI has made improvements and will be continuing to monitor further developments. I have also written to the Minister of Citizens’ Services to urge the government to act without delay to modernize PIPA and put obligations on organizations to earn people’s trust by respecting people’s privacy rights, not exploiting their personal information,” said Commissioner Harvey.

 The four regulators will be monitoring the actions of the company to ensure that it continues to limit the impact that its AI tools have on individuals’ privacy.