Hi ChatGPT, do you know my name? Navigating privacy laws in a post-ChatGPT world

01 Aug 2023

This past year has seen the emergence of various Artificial Intelligence (“AI”) models, the most popular of which has undoubtedly been ChatGPT, a language-based AI chatbot. Businesses have been quick to discover that ChatGPT can provide helpful insight into their daily practices. By inputting prompts and information, users can generate contracts, marketing blurbs, CVs, articles and more. In a similar fashion, users can provide the chatbot with existing content to review and amend.

Although AI has many advantages, its fast-paced evolution is not easily matched. South Africa does not currently have any legislation regulating the use of AI. While existing pieces of legislation can be applied to scenarios in which AI is used, one has to question whether the legislation adequately addresses the intricacies of AI.

One such piece of legislation is the Protection of Personal Information Act 4 of 2013 (“POPIA”). POPIA was promulgated with the intention to regulate the processing of personal information in South Africa, and to give effect to and promote the constitutional right to privacy.

Advocate Pansy Tlakula, the Chairperson of the Information Regulator (the regulatory authority established and empowered by POPIA), has held media briefings with regard to the regulation of ChatGPT in POPIA. Speaking to the media, Tlakula noted that she believes that the emerging AI technologies will, in the future, be responsible for the majority of data privacy infringements. Going forward, she said that the office of the Information Regulator needs to educate itself on these new AI tools before attempting to regulate them.

The Information Regulator is not alone in their concern over the recent and rapid development of various AI technologies. Earlier this year, the Italian government issued an immediate ban on the use of ChatGPT in the country, due to violations of the country’s privacy laws. Although the ban has subsequently been lifted, the possibility of data breaches and privacy infringements remains a growing concern globally.

During this transitional period where there is currently no regulatory authority on the use of AI, it is recommended that the inputting of personal information is approached with caution, and is, at all times, executed in compliance with the provisions of POPIA.

Section 11(a)(i) of POPIA provides that personal information may not be processed without inter alia consent from the data subjects to whom the information relates. The definition of “processing” in POPIA includes the dissemination of personal information by means of transmission, distribution or making available in any other form. Thus, while it may be standard practice for businesses to inform their clients that their personal information is being processed, inputting that information into ChatGPT may constitute further processing.

According to POPIA, one of the conditions for lawful processing of personal information is accountability. Section 8 of POPIA explains that the responsible party (being the party that determines the purpose and means of processing) must ensure that the lawful conditions of processing are complied with. Responsible parties are therefore accountable for any breach due to non-compliance with the lawful conditions of processing. Failure to comply with the provisions of POPIA may result in an administrative fine not exceeding R10 million and/or to imprisonment for a period not exceeding 12 months or 10 years, depending on the offence.

The dangers of ChatGPT are not limited to privacy alone. There are also valid concerns regarding plagiarism, intellectual property abuse, and the overall accuracy of the information provided. Recently, in the case of Parker v Forsyth NO and Others, attorneys were severely criticised for using ChatGPT for legal research without personally reviewing the information it provided. As a result, fictitious cases were referenced in advancing their client’s case. This case is not the first of its kind and highlights some of the potential and actual dangers of the irresponsible use of AI.

Whilst the insight and assistance that AI can provide is obvious, the consequences of the reckless use of AI are severe. It is therefore imperative that businesses and individuals alike ensure that they are using ChatGPT and other AI models in a responsible manner, and in accordance with the provisions of POPIA and other legislation.

For more information on the subject, please do not hesitate to contact our offices.

Article sourced from Eversheds Sutherland.

See also:

• POPIA – Who is your information officer?
• The copyright of articles drafted by ChatGPT
• Risks and considerations for privacy, cybercrime and blockchain
• Copyright in AI-generated works
• Artificial Intelligence and IP – Who owns the copyright?

(This article is provided for informational purposes only and not for the purpose of providing legal advice. For more information on the topic, please contact the author/s or the relevant provider.)