0

Italy has recently banned ChatGPT, and is now allowing it again in the country, after they implemented a few privacy controls.

The fact that it's now allowed again makes me wonder if Italy (and the rest of EU) is "finally happy" with ChatGPT, GDPR-wise.

Since day 1 of me using ChatGPT, what worries me the most is that:

  1. I cannot change my email address associated with my account

  2. I cannot view or change my phone number associated with my account

  3. If I delete my account, the phone number (at least) stays saved in their database permanently, as we can no longer create a new account with the same phone number associated

  4. Despite my numerous attempts, a human NEVER replies to my questions in the support chat (even though the Bot eventually says that they will reply within 1 week), and when I attempted to ask in the forum, my post was not approved. My questions to them were about changing/deleting the phone number and email address.

These are basic rules of GDPR ("right to erasure" (Article 17) and "right to rectification" (Article 19)), and I'm surprised that at this point, EU countries are still allowing OpenAI/ChatGPT to do this, and that Italy hasn't required them to make changes around these personal elements.

Am I wrong here? Is OpenAI/ChatGPT compliant with GDPR, if they don't allow changing or removing the Phone Number and Email Address?

Improve this question
1
  • 1
    Whoever downvoted, can you please explain what is wrong with the question?
    – GDPR
    Apr 29 at 23:10

1 Answer 1

Reset to default
2

GDPR allows companies to process data for various reasons, including user consent or to fulfill contractual or legal obligations. Using an email or phone number as the unique user ID is legal, and so is retaining the unique user ID of a deleted account to prevent abuse or fraud (or for tax purposes, if it is a paid service).

GDPR requires companies to publish contact details, but there is no requirement to have a chatbot to be this "official contact point." Somewhere in their legal boilerplate you should find a physical address where you can send a printed and signed letter. In this letter, you can request either information on your account or the correction of factually wrong data, but then your phone number is not "wrong" in this sense ...

PS -- I did not downvote, but it seems to me that your question seems to view GDPR as an universal "magic wand" when it is a quite specific set of regulations. About two minutes of googling got me the contact details in the EU/EEA and UK.

Improve this answer
8
  • The problem comes when a phone number is re-allocated to a different person. It is then completely incorrect data, of which the new user may be entirely unaware.
    – Andrew Leach
    Apr 30 at 9:44
  • Thank you for your Answer. I'm however not sure how putting the Phone Number or Email as the unique ID, automatically is a green card to keep that personal data in their database permanently, and bypass the "right to erasure" (Article 17 of the GDPR), and not allowing to ever change them while the account is active, bypassing "right to rectification" (Article 19 of the GDPR).
    – GDPR
    Apr 30 at 10:07
  • Regarding the chatbot or forum, I was simply showing how they are avoiding to answer questions about data preservation/rectification. But thanks - I'll try to contact VeraSafe, their representative in the EEA and UK for data protection matters. It's a good suggestion.
    – GDPR
    Apr 30 at 10:10
  • @GDPR, under GDPR they have to preserve documentation on any erasure request they handle. That alone should show you that erasure cannot be total, it covers only those data for which they no longer have a right to retain/process it.
    – o.m.
    Apr 30 at 11:20
  • @o.m. - only for a reasonable period of time, though. Not permanently. It's not "my fault" that they decided to use the phone number or email address as their "primary key" in the database (if that's even what is happening, and not the fact that they are simply not purging data that they no longer need). I still don't understand how what they are doing is GDPR compliant (at least in relation to Article 19 "right to rectification").
    – GDPR
    Apr 30 at 14:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .