Canadian Privacy Commissioner finds OpenAI violated federal and provincial privacy laws in training its AI models

Philippe Dufresne, the Privacy Commissioner of Canada, along with counterparts in Alberta, Quebec, and British Columbia, found that OpenAI was “not compliant with” Canadian federal and provincial privacy laws in the training of its AI models, including the Personal Information Protection and Electronic Documents Act (PIPEDA). The investigation identified multiple issues, including that OpenAI “gathered vast amounts of personal information without adequate safeguards,” failed to acquire consent to collect and use that information, and did not give ChatGPT users a way to access, correct, or delete data that was used in training. OpenAI has agreed to make multiple changes to comply with Canadian privacy laws, including retiring earlier non-compliant models, deploying a filtering tool to detect and mask personal information in training datasets, and adding new notices to the signed-out version of ChatGPT within the next three to six months.