ChatGPT Factual Errors Lead to Filing of Complaint of GDPR Privacy Violation

The activist organization noyb, founded by Max Schrems, filed a complaint in Europe against OpenAI alleging that ChatGPT violates the General Data Protection Regulation (GDPR) by providing inaccurate personal information such as birthdates about individuals.

Risk classification

• Primary risk domain: 3 Misinformation
• Primary risk subdomain: 3.1 False or misleading information

The incident involves ChatGPT generating incorrect and fabricated birthdates for an individual, which constitutes discrete false or misleading information.

Additional risk subdomains

• 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information: The complaint alleges violations of GDPR privacy rules regarding the processing, accuracy, and correction of personal data.
• 7.3 Lack of capability or robustness: The system failed to perform reliably by hallucinating facts and failing to recognize its lack of correct data.

Causal factors

• Entity: AI
• Intent: Unintentional
• Timing: Post-deployment

The privacy risk was caused by ChatGPT hallucinating incorrect personal data post-deployment, which is an unintentional technical failure of the model.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Risk Level 3. Limited Risk: The system is a chatbot (ChatGPT), which falls under the category of AI systems that pose a moderate risk and require specific transparency obligations.

AI system and alleged parties

• AI system: ChatGPT (OpenAI)
• AI purpose: Chatbot; Question Answering
• Behaviour type: Assistant
• Alleged developer: OpenAI
• Alleged deployer: ChatGPT
• Alleged harmed parties: noyb, Max Schrems, General public

Harm severity

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

People affected

• Occurrences reported: 1
• People reportedly harmed: 1
• People reportedly exposed: 1

Potential causes

Management

• Ignoring Regulatory Risk: Prioritizing deployment over establishing compliance with EU privacy laws.
• Refusal to Address Complaints: Management refused to correct or delete wrong answers when requested.

Technology

• Chatbot Hallucinations: LLMs generate plausible-sounding but false information like wrong birthdays.
• Lack of Gap Detection: Chatbot does not inform users when it lacks the correct data to answer.

Data Inputs

• Inaccurate Training Data: Lack of verified personal data sources leads to guessing personal details.

Human Factors

• User Overreliance: Users trust chatbot outputs for factual personal data without verification.

Process and Methods

• No Correction Mechanism: Lack of process to correct or delete inaccurate personal data in LLMs.
• Inadequate Data Access Process: Failure to disclose processed data, sources, or recipients to individuals.

Regulatory Environment

• GDPR Compliance Gaps: AI systems struggle to meet EU requirements on accuracy and right to erasure.

Information quality

• Classification confidence: High
• Reason for confidence: The report clearly details the specific complaint filed by noyb against OpenAI regarding ChatGPT's hallucination of Max Schrems' birthday. The legal basis (GDPR) and the technical failure (hallucination of personal data) are well-documented and unambiguous.
• Alternative interpretations: The incident could be viewed purely as a regulatory compliance issue rather than an AI safety failure, but the root cause is a technical limitation (hallucination) of the AI system.

The privacy group noyb filed a GDPR complaint against OpenAI in Austria, alleging that ChatGPT hallucinated incorrect personal data and failed to provide correction mechanisms. While highlighting regulatory and privacy challenges for AI deployment in Europe, the incident has negligible national security implications.

• Overall national security impact: Minor
• Response level: Moderate
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: European Union, United States
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. This is a regulatory compliance and technical limitation issue that will play out over months or years, posing no immediate crisis.
• Autonomy: Human-controlled. The AI system functions as a conversational assistant responding to user prompts, with no independent agency or execution capabilities.
• Novelty: Established threat. LLM hallucinations and subsequent GDPR compliance challenges are well-documented, established issues that have been raised previously by European regulators.

Impact by dimension

• Physical security: Negligible. The incident involves a chatbot hallucinating birthdates, presenting no physical threat or impact on critical infrastructure.
• Information security: Negligible. The generation of incorrect personal birthdates by a consumer chatbot does not constitute a national-level information warfare or intelligence security threat.
• Sovereignty: Negligible. While it involves European regulatory frameworks (GDPR), the incident is a civil regulatory complaint and does not threaten state sovereignty or core government functions.
• Economic security: Minor. OpenAI faces potential regulatory fines under GDPR, but this does not pose a systemic threat to national economic or technological security.
• Societal stability: Minor. The incident highlights data privacy concerns and potential GDPR violations for individuals, but does not represent systematic human rights abuses or threats to societal stability.