Italy's watchdog clashes with ChatGPT, Google's Bard raises eyebrows & UK's ICO wields AI to hunt rogue cookies
By Robert Bateman and Privado.ai
In this week’s Privacy Corner Newsletter:
Italian Regulators Says ChatGPT ‘Breaches GDPR’ (Again)
The Italian Data Protection Authority (DPA) (known as the “Garante) has accused OpenAI of violating the GDPR via the generative AI platform ChatGPT.
-> What’s the backstory of this enforcement action?
Here’s a timeline of the issues between OpenAI and the Garante:
-> What were the initial alleged GDPR violations?
Last March, the Garante ordered OpenAI to do the following things (among others):
-> So did OpenAI do all those things?
The Garante lifted its ban after OpenAI satisfied most of those conditions.?
But some unanswered questions remained regarding age verification, the erasure of data in training sets, and the awareness-raising campaign that OpenAI promised to conduct.
The Garante has not stated which GDPR violations OpenAI is alleged to have committed this time around, but it is likely to be in one of these unresolved areas.
Google’s Bard Will ‘Read and Analyze’ Android Users’ Messages
Google has announced plans to introduce a “conversational AI” based on its Bard model into Android phones, raising concerns about the privacy of users’ communications.
-> Why is Google planning to do this?
Google wants more people to use its Messages app. Android users might be familiar with the company’s insistence on making Messages the default messaging app on Android phones.
The company is also in an AI race against other tech firms, and its Bard chatbot has not yet reached ChatGPT levels of popularity.
Integrating Bard into Messages might be intended to tempt Android users away from Meta-owned WhatsApp—or perhaps even convert a few iPhone users currently loyal to Apple’s iMessage.
-> What’s the privacy issue here?
We don’t yet have the full details of how Bard’s integration into Android will work, but there are arguably some privacy red flags—even if the feature is optional.
Forbes reports (after apparently having “asked” Bard directly) that the bot “may ask to analyze your messages” in order to “understand the context of your conversations, your tone, and your interests.”?
Bard may also “analyze your message history with different contacts to understand your relationship dynamics… to personalize responses based on who you're talking to.” On the basis of this analysis, Bard will “tailor its responses to your mood and vibe.”?
-> But if Google gets consent, what’s the problem?
Even if Google gets consent from the Android user, it presumably won’t be obtaining consent from other people with whom the user has been communicating.
In a complaint to the Irish Data Protection Commission (DPC) published on LinkedIn, published by campaigner Alexander Hanff alleges that the plans would violate Article 5(1) of the ePrivacy Directive, which states that EU countries must:
“prohibit listening, tapping, storage or other kinds of interception or surveillance of communications and the related traffic data by persons other than users, without the consent of the users concerned…”
This provision, or rather the associated rules implemented in national laws, arguably requires Google to obtain consent from everyone involved in a conversation before Bard “reads and analyzes” the contents of the messages.
Google’s European rollout of the Bard chatbot was delayed last June as the company sought to reassure the Irish DPC about its GDPR compliance. These allegations around Bard’s deeper integration into Android could represent another AI roadblock for Google.
UK Regulator Developing ‘AI Solution’ to Detect Cookies Violations
The UK DPA, the Information Commissioner’s Office (ICO), has announced that it is “developing an AI solution to help identify websites using non-compliant cookie banners.”
-> So 38 of the 53 targeted websites complied with the ICO’s cookie letter?
Yes, according to the ICO, just over 70% of the website operators that received its November letter made changes to the cookie banners.
The regulator reports that four further websites have promised to become compliant within a month and that “several others” are “working towards” new advertising models, such as contextual advertising.
The ICO’s letter was not an enforcement action per se but included a warning that non-compliant websites would be “named and shamed” in January.
-> It’s February. Did the ICO publish the names of the non-compliant websites?
No, the ICO has not published the names of the 15 website owners who failed to make the requested changes to their cookie banners.
Nonetheless, the ICO says it will now proceed with contacting the next set of popular UK websites whose cookie banners do not meet the regulator’s interpretation of the law.
-> What about this “AI tool”?
The ICO hasn’t provided any details of the AI tool it is reportedly developing to help sniff off non-compliant cookie banners, nor the “hackathon” it plans to host in the coming months.
We might also see some pushback among website publishers who disagree with the ICO’s relatively strict stance on cookie compliance.
If your website is accessible in the UK, you can read the paper published by the ICO and the Competition and Markets Authority (CMA) last year, which sets out the regulators’ joint position on cookies.
What We’re Reading