Lawsuits and Enforcement: Privacy Violations through AI

A number of lawsuits and regulatory proceedings filed last week focus on aspects of privacy protection and data security during use of artificial intelligence, specifically in relation to OpenAI’s ChatGPT software.

A motion to certify a class action filed this week with the Lod District Court alleges, inter alia, that ChatGPT uses the information it collects about users in violation of the provisions of privacy protection laws. Such violations include in relation to the issue of transparency, the time frame for retention of the information, the purposes for information processing, and the identities of other parties to whom the information is forwarded.

The motion also alleges that ChatGPT contains no mechanism to monitor the ages of ChatGPT’s users, which poses a substantive risk. Namely, minors can access the technology freely without any restriction and thus be exposed to inappropriate content.

The motion to certify a class action in Israel was filed a few days after reports that use of the ChatGPT software had been blocked in Italy. This comes on the heels of the Italian data protection authority’s opening of an investigation against the company on suspicions of a data breach that allegedly violated users’ privacy and alleged violations of the European General Data Protection Regulation (GDPR). According to the Italian authorities, during the data breach incident in March, users were exposed to other users’ search questions, thereby violating their privacy. As part of its investigation, the data protection authority demanded that the company stop processing the data of end-users in Italy and rectify the deficiencies within a defined time frame. The authority will also consider the possibility of imposing significant fines in conformity with the GDPR’s provisions.

Legal Exposures

The lawsuit filed against the company in Israel and the blocking of the ChatGPT software in Italy illustrate the importance of privacy protection and data security aspects during any use and development of artificial intelligence. Companies looking to develop or assimilate AI technology must address privacy protection and data security risks in advance and examine the possible exposures, in both legal and technological terms.

***

Our firm’s Privacy and Data Protection Department is at your service to answer any questions or provide clarifications in this regard or on any other issues pertaining to privacy protection, data security laws and AI Regulation.

Dr. Avishay Klein heads the Privacy and Data Protection Department at Barnea Jaffa Lande.

Adv. Ben Norman is an associate in the department.