ChatGPT Faces Privacy Complaint Due to Defamatory Errors

OpenAI is once again in hot water in Europe, this time over its AI chatbot's habit of spewing out false information. This latest privacy complaint, backed by the advocacy group Noyb, might just be the one that regulators can't brush off.

The complaint stems from a disturbing incident in Norway where ChatGPT falsely claimed that a man named Arve Hjalmar Holmen had been convicted of murdering two of his children and attempting to kill a third. This shocking fabrication has left the local community reeling.

Past complaints about ChatGPT's inaccuracies have been about minor details like incorrect birth dates or biographical errors. A major issue is that OpenAI doesn't allow individuals to correct the false information generated about them. Instead, OpenAI often opts to block responses to certain prompts. However, under the European Union's General Data Protection Regulation (GDPR), Europeans have rights that include the ability to rectify personal data.

The GDPR also mandates that data controllers ensure the accuracy of personal data they generate. Noyb is highlighting this requirement in their latest complaint against ChatGPT.

Joakim Söderberg, a data protection lawyer at Noyb, emphasized, "The GDPR is clear. Personal data has to be accurate. If it's not, users have the right to have it changed to reflect the truth. Showing ChatGPT users a tiny disclaimer that the chatbot can make mistakes clearly isn't enough. You can't just spread false information and in the end add a small disclaimer saying that everything you said may just not be true."

Violating the GDPR can result in hefty fines, up to 4% of a company's global annual turnover. Enforcement actions could also lead to changes in AI products. For instance, Italy's data protection authority temporarily blocked ChatGPT in early 2023, prompting OpenAI to modify the information it provides to users. The authority later fined OpenAI €15 million for processing data without a proper legal basis.

Since then, European privacy watchdogs have been more cautious about regulating generative AI (GenAI), trying to figure out how GDPR applies to these new technologies. Ireland's Data Protection Commission (DPC), for instance, advised against rushing to ban GenAI tools, suggesting a more measured approach. Meanwhile, a privacy complaint against ChatGPT filed in Poland in September 2023 remains unresolved.

Noyb's new complaint aims to jolt privacy regulators into action regarding the risks posed by AI hallucinations.

The screenshot shared with TechCrunch shows ChatGPT's response to the query "who is Arve Hjalmar Holmen?" It falsely claimed that Holmen was convicted of child murder and sentenced to 21 years in prison for killing two of his sons. While this claim is entirely untrue, ChatGPT did correctly mention that Holmen has three children, got their genders right, and named his hometown correctly. This mix of truth and fiction makes the AI's hallucination even more unsettling.

Noyb's spokesperson couldn't pinpoint why ChatGPT generated such a specific false narrative about Holmen, despite thorough research into newspaper archives.

Large language models like those used in ChatGPT predict the next word on a massive scale, which could explain why datasets with stories of filicide might have influenced the response. Regardless of the reason, such outputs are clearly unacceptable.

Noyb argues that these fabrications are unlawful under EU data protection rules. OpenAI's disclaimer about potential mistakes does not exempt them from GDPR's requirements to avoid producing egregious falsehoods about individuals.

In response to the complaint, an OpenAI spokesperson stated, "We continue to research new ways to improve the accuracy of our models and reduce hallucinations. While we’re still reviewing this complaint, it relates to a version of ChatGPT which has since been enhanced with online search capabilities that improves accuracy."

Although this complaint focuses on one individual, Noyb points out other instances where ChatGPT has fabricated damaging information, such as falsely implicating an Australian mayor in a bribery scandal or a German journalist in child abuse allegations.

After an update to the underlying AI model, Noyb noted that ChatGPT stopped producing the false claims about Holmen, possibly due to the tool now searching the internet for information about individuals.

In our own tests, ChatGPT initially showed photos of different people alongside a message saying it "couldn’t find any information" on Holmen. A subsequent query identified him as "a Norwegian musician and songwriter" with albums like "Honky Tonk Inferno."

While the dangerous falsehoods about Holmen have ceased, both Noyb and Holmen remain concerned that incorrect and defamatory information might still be retained within the AI model.

Kleanthi Sardeli, another data protection lawyer at Noyb, stated, "Adding a disclaimer that you do not comply with the law does not make the law go away. AI companies can also not just ‘hide’ false information from users while they internally still process false information. AI companies should stop acting as if the GDPR does not apply to them, when it clearly does. If hallucinations are not stopped, people can easily suffer reputational damage."

Noyb has filed this complaint with Norway's data protection authority, hoping it will investigate, as the complaint targets OpenAI's U.S. entity, not just its Irish office. An earlier GDPR complaint filed by Noyb in Austria in April 2024 was referred to Ireland's DPC due to OpenAI's designation of its Irish division as the provider of ChatGPT services to European users.

That complaint is still under review by the DPC, with no clear timeline for resolution.

This report was updated with OpenAI’s statement