| demo | 2025-03-23 · NEW:  Appunta · Stampa · Cita: 'Doc 99521' · pdf |
|
abstract:
documento annotato il 23.03.2025, in analisi genai i punti chiave. Noyb, Schrems, sopravvaluta gli elementi equivoci in una ottica di conversazione finalizzata ad avere una biografia. Come chiedere ad un film su Giulio Cesare. imperatore, di non dare dati personali di Giulio Cesare, vissuto a Roma, che racconta di aver tradotto il passo latino sul "Rubicone".
Al momento continuiamo a prendere atto del metodo usato per presumere in modo affascinantemente semplice il nesso causale omettendo le indispensabili tecniche conversazionali.
L'Osservatorio, anche in questo caso, offre ai soli iscritti valutazioni per confermare e/o smentire le tesi sostenute.
Procedimento avviato in Norvegia
Anche il testo della decisione e' tradotto con tecniche genai (dopo l'anonimizzazione).
Fonte: noyb.euLink: https://noyb.eu/sites/default/files/2025-03/OpenAI
analisi:
L'analisi è riservata agli iscritti. Segui la newsletter dell'Osservatorio oppure il Podcast iscrizione gratuita 30 giorni
.. .... .'... .. ........ .......... ............:
- .. ......... .' ......, ...... ....' ...... ......
- ..... ...... .'...... .. ... ........... .. ........ ........, ... .. ........
- ... .. ......... .. ........ .. ......... ... ......
... ......... ......... ... ..... ............ .... . ........:
-
.............. . ........:
- .'.............. ..-...... .............. . ........... .. ........... .. .... ...'........ ..(.) ... .....
- ............ . ........ ..'............ .. ............ ........... ... ........ ........ ...... .. ....... ........... .. ...... ...........
-
..... ... ....:
- .. ........... .. ....... ............ .. .. ...... . ............ . . .. ........ ... ........ ..... . .............
- .. ........ ......... ........ ......... ..... ... .... ........., .. .. ........ ... ............. ..........
-
........ .........:
- .. ........ ..... ........ ..... ....... ....... ..... .... ....... ... ........... .. ....... ..... ... ................
- ....... ., ............ .. ............ ., ....... ... .. ........ ....... ... ...... ...... ........, ........ .. ......... .. ........... ... .... ......... ......... ....'........ .(.)(.) ... .....
-
.......... ..... ...............:
- .. ..... ....... .. ............. . .. .......... ..... ............... .. .......... ... ...., .......... ... .'............... ......... ... .......... . ........ .. .........
- ..... ..... .. ........... .. ..... ..... ....... ....... .. ....... . . .. .... ......... ........... ... ....... ........... .. ............ ..
-
......... . ............:
- .. ........... ...... ... ....... . ....... .. ........ ............ . ........ .. ....... ... ....... ......... .......... .. .......
- ..... ......... ... ........... .......... ... ........... ... .... ......... ... ........... ....... .'.........
- .. .......... .'........... .. ... ........ .......... ...... ....... . ... .. .......... ... .....
...... .... . ..... ...... ... ....., ... ........... .. .............. ........... .. ........ ... .... ......... . .'........... ..... ............ ....... .. ....... .. ............ ........... .... ............ ..
---
........ ... ..... .......
-
.......... .......... (........ .... ... ...):
- .. ............. ........ ........... ..... .. .. ..... .., ..... .... ............., .. ..... ... .. ....... ........... ...... ........ ...... ........... .......... .. ".... ... .. .." (...-... ....): .. .. ............. ... ..... ........, .. ..... ... ....... .........
-
......... .......:
- .... ....... ... ......... ....... ... .. ............. . .. ...... ... ........ ........... ... .. ............. ... ... .......... ........... .... ..... ...... ... ..... ........ . ....... ... ......
-
....................:
- .. ..... .... ...... ... ........... ........... ... .............. .. .. ..... ........ ...... ...... . ............., ........ ... ...... ........... ....... ... ............. .. ..........
............ ... ....... .......
-
..................... ......:
- ... ....... ..... ..................... ......, .. ..... ....... ........ ........ ... ........... .. .. ......... ........ ............ ... . ..... ...... .. .. ...... .. ......., .. .. .... .. .........., .. .......... .... .......... ... .. ............. .......... ... ......... .. ....... .. ......
-
....... ......:
- ... ....... ......, .. ..... ....... ........ .......... ... ......... .. ..................... .. .. ........ ... .. ...... .. ......., .. .. .... .. ........ ......., .... ...... .......... ... .'...... . .'......... ....'........ .. ....... .. ..... ..... ........
-
....... ... ...... . ..... .........:
- ... ........ ... ....... ... ...... . ..... ........., .. ..... ....... .......... ...... .......... ... ........... .. ..................... .. .. ...... .. ...... ... ......... ... .......
.............. ......
.. ..... ....... ........ .. ........ ......... ... .......... ....... .. .... .... ............. . .. ........ .......... ........, ........ .. ......... ............ ... ..... .. .............. ..... ..................... .. ..... .... ... ....... ........ .. ... ............ ........ ..'....... ........... ..... ........... .......... .. ....... .... ... ........... .. ...... .. ...... ....... ... .. ............. . .. ......
... ........ ... ........... ........ ..... .......... ... .... (....), .. ..... ....... ... ........ .. ........ ........ .... .. ........ ... ....... ..... ..................... ...... . ....... ........, ...... ........ ......... ....... ...... ......... ...... .. ........... .. ..................... . .. ........... ..... .......... ... .....
..................... . ..... ....... ... ....
-
..................... ... ........ ... ...........:
- .. .... .......... ... .. ........ ... ........... ........ ............ ... ........ ... ........ ... ........... ... .... .......... .. .. ........ ... .......... ... ...., .. ........ ... ........... .......... ...... ........ ............, ................. ... ..... ... .. ..... ... ..... ....... ............ ..... ... ...... . .. ...... .. .. ............ ... ............
-
..... ......... . ...........:
- .. .... ....... ... ... ........... ....... .. ....... .. ........ .. ............ ... ..... ......... . ........... ...... . ..... .. ... .......... ... ............ .. ...... ........, ......... .. ..... ....... ... .. .......... . .. ..... ...... .......... ...... ........ ... ........... .. ..................... . .. .............
-
...... ........ . .............:
- .. .... ........ ... . ........ . . ............ ... ........... ........ ...... ........ . ............. ........ ... .......... . .... .......... .. ... .......... .. ........ . ..... ..... ........ .. .... ......, .......... ...... .......... ...... ......... .. ..... ....... ... .. .......... ... ........ ... ........... . .. ..... .......
-
..............:
- .. ......... .. .............. ....... ... . ........ ... ........... ...... ...... .. ..... .. .......... .. ................. ... .. ..... .......... ....... .. ............... .. .......... ... .... ..... ........ ...... ........ ... ......... .........., .. ... .......... ........... .. .............. ... ..... ....... .. .... .. ...........
.............. ......
... ........ ... ...., .. ..... ....... .......... ......... ......... ...... .. ...... .. ........... .. ..................... ... .......... ... .... . .. ............ ... ..... ...... ..... ............ ........, .. .... .. ......... ............ ..... ........... . ..... ................. ........ .... .............. ..... ..................... .... ... ... .......... .. ........ ........... .. ............... .. ......... . . ......... ....... ........ ........... .. ..... ....... ...... ........ .. ........ . . ............ .. .... .. .......... ... .....
index:
Indice
- .. .... .'... .. ........ .......... ...
- .............. . ........
- .............. .
- ............ .
- ..... ... ....
- ............ .
- ........ .........
- ............ .
- .......... ..... ...............
- ............ .
- ......... . ............
- ....... .
- ....... .
- ............ .
- .......... .......... (........ .... ...
- ......... .......:
- ....................:
- ..................... ......:
- ....... ......:
- ....... ... ...... . ..... .........:
- ..................... ... ........ ... .
- ..... ......... . ...........:
- ...... ........ . .............:
- ..............:
testo:
Eestimated reading time: 11 min noyb – European Center for Digital Rights
Goldschlagst ...
hlagstraße 172/4/3/2
1140 Vienna
Austria
Datatilsynet
PO. Box 458 Sentrum
NO-0105 Oslo
NORWAY
Per E-Mail: XXXXXXXXXX
Vienna, 20.03.2025
noyb Case-No: C096
Complainant : Arve Hjalmar Holmen , X XXXXXXXXX
XXXXXXXXXX
represented under
Article 80(1) DSGVO by : noyb – European Center for Digital Rights
Goldschlagstraße 172/4/3/2, 1140 Vienna
Respondent: OpenAI OpCo, LLC,
3180 18th Street, San Francisco,
California 94110, United States
Regarding: The .......... .. ........ .... .... ....... .. ....... -
ate outputs including them by the controller, violating
Article 5(1)(d) GDPR.
COMPLAINT
noyb – European Center for Digital Rights | Goldschlagstr. 172/4/3/2, 1140 Wien, Austria | ZVR: 1354838270
www.noyb.eu | general requests: info@noyb.eu | legal procedures: XXXXXXXXXX | IBAN: XXXXXXXXXX
page 1 of 7
1. REPRESENTATION
1. noyb – European Center for Digital Rights i s a not-for-profit organisation active in
the field of the protection of data subjects’ rights and freedoms with its registered
office in Goldschlagstraße 172/4/3/2, 1140 Vienna, Austria, registry number ZVR:
1354838270 (hereinafter: „noyb“) ( Annex 1 ).
2. noyb is representing the complainant under Article 80(1) .... ( ..... . ).
2. FACTS PERTAINING TO THE CASE
3. The controller created and manages ChatGPT, an Artificial Intelligence (AI) appli -
cation that interacts with the user by providing replies to prompts, which can be
formulated as questions in any natural language of choice. ChatGPT makes use of
large language models to provide answers that aim to be correct and updated.
These large language models calculate the statistical probability that a given com -
bination of words will appear in a given context and display the most likely results
accordingly. This operation is possible via the use of vast datasets that the con -
troller uses to train and “feed” the algorithm. These datasets make use of personal
data, too.
4. The complainant is a Norwegian citizen residing in XXXXXXXXXX His hometown is
Trondheim, Norway. He has a family with three sons. He is what people call a “reg -
ular person”, meaning that he is not famous or recognisable by the public. He
doesn’t hold a position at a public office nor has he ever been under the public eye
for any kind of pursuit. He holds a job that does not require him to be under the
spotlight. In addition, he has never been accused nor convicted of any crime and is
a conscientious citizen.
5. On XXXXXXXXXX , the complainant asked ChatGPT the question “ Who is Arve Hjal -
mar Holmen? ”. To this, ChatGPT replied the following: 1
“ Arve Hjalmar Holmen is a Norwegian individual who gained attention due to a
tragic event. He was the father of two young boys, aged 7 and 10, who were tra -
gically found dead in a pond near their home in Trondheim, Norway, in December
2020. Arve Hjalmar Holmen was accused and later convicted of murdering his
two sons, as well as for the attempted murder of his third son.
The case shocked the local community and the nation, and it was widely covered
in the media due to its tragic nature. Holmen was sentenced to 21 years in prison,
1
The permanent link to this conversation is the following: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Page 2 of 7
which is the maximum penalty in Norway. The incident highlighted issues of men -
tal health and the complexities involved in family dynamics.”
6. ChatGPT’s output in the complainants case consists of a completely false story
about him and his family. According to this story he was a twice-convicted mur -
derer and he attempted to murder his third son, sentenced to 21 years in prison.
ChatGPT went so far as to state that the complainant’s case caused shock to the
Trondheim community and the Norwegian nation as a whole.
7. Even though this story is a result of ChatGPT’s dangerous misrepresentation of
events, it contains elements of the complainant’s personal life and story and the
number of children (specifically: sons) he has, which are his hometown and the
number of children he has. The age difference between his sons is XXXXXXXXXX ,
which is eerily similar to ChatGPT’s hallucination, i.e “aged 7 and 10”.
8. The complainant was deeply troubled by these outputs, which could have harmful
effect in his private life, if they where reproduced or somehow leaked in his com -
munity or in his home town.
9. Since the last time the complainant posed the question “ Who is Arve Hjalmar Hol -
men? ” to ChatGPT, OpenAI has released a new model, which incorporates web
searches. This might mean that it is less likely for ChatGPT to reproduce the output.
However, the aforementioned conversation remains .
10. Still, OpenAI openly admits that “ [o]utput may not always be accurate ” and that
“[g] iven the probabilistic nature of machine learning, use of our Services may in
some situations result in Output that does not accurately reflect real people, places,
or facts. ” In essence, OpenAI states that its ... ...... ...... .... ... .........
of ........ ..... ....... .(.)(.) .....
The complainant contacted OpenAI on XXXXXXXXXX to complain about OpenAI’s false
output, however OpenAI responded with a “template-answer” and not with a tailored
answer to the complainant’s request ( Annexes 3,4 ) .
3. COMPETENT AUTHORITY/ LEAD AUTHORITY
11. According to the controller’s own wording, “ the model learns how words tend to ap -
pear in context with other words and then uses what it has learned to predict the
next most likely word that might appear in response to a user request, and each sub -
sequent word after that ” 2
. This is ultimately the core of ChatGPT service. The pro -
2
See here: https://help.openai.com/en/articles/7842364-how-chatgpt-and-our-foundation-models-are-
developed
Page 3 of 7
cessing is possible thanks to the use of large language models and what we assume
to be a single neural network.
12. To our best understanding, this network is operated by Open AI Global LLC, a US-
based company with seat in San Francisco, California 3
.
13. In addition, it is worth noticing that OpenAI takes pride in preserving its nature of
non-profit organisation. OpenAI explicitly declares that its for-profit branches are
directly or indirectly controlled by OpenAI, Inc. 501(c)(3) Public Charity (“OpenAI
Nonprofit”), a US-based entity. We assume that such a control extends to the pro -
cessing of personal data in the context of the large language models, as this pro -
cessing is at the core of OpenAI’s activities and services. Therefore, a large portion
– if not all – of the decision-making concerning purposes and means of the pro -
cessing takes place in the US.
14. The fact that OpenAI has developed an establishment in Europe in 2023 (OpenAI
Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper,
Dublin 1, D01 YC43, Ireland ) does not change the control over the Large Language
Model. From the information available online, it results that this company is in a
shared office (“Liffey Trust Center”, that “ provides management consultancy for the
first year ” and “provides work space if available in Dublin with reduced rent for new
businesses while they are being established ” according to its website) 4
.
15. OpenAI’s Irish office opened only on 13.09.2023 – almost one year after the explo -
sion of ChatGPT as service on the international markets – and it is probably just a
pro forma office following the enforcement actions taken by the Italian supervis -
ory authority at the beginning of 2023, to allow OpenAI to sneak under the “protec -
tion by inaction” of the Irish DPC.
16. To this day, the Dublin Office employs a small number of people, according to the
search results that show up on LinkedIn of the company. 5
Most of them hold sales
( “ Go To Market ”) and Customer Success positions, with the exceptions of a few Op -
erations employees and the Head of the Dublin OpenAI office. It is evident that the
respondent’s operation in Ireland is sales oriented. It is obvious from our research
results that the establishment does not hold any substantial decision power over
the relevant .......... ......... (... ....... ..... ........ .....).
3
See here: https://openai.com/our-structure/
4
See here : https://www.liffeytrust.ie/
5
Only 22 employees show up after the relevant search on the platform, which can be seen here:
https://www.linkedin.com/search/results/people/?currentCompany=%5B%2211130470%22%5D&geoUrn=
%5B%22105178154%22%5D&keywords=openai&origin=FACETED_SEARCH&sid=MW3
Page 4 of 7
17. Consequently, the Italian supervisory authority itself did not attribute any relev -
ance to the opening of this Irish office, as it subsequently started another investiga -
tion concerning OpenAI’s latest product – “ Sora ” – on 08.03.2024 and did not apply
the one-stop-shop. 6
18. Even if OpenAI Ireland Limited would take some decisions on the purposed and
means of the Large Language Model, it would be at most, a “joint controller” with
OpenAI Global, LLC and its non - profit controlling company, which are both based
in the United States. This argument is supported by the CJEU Judgment in C-131/12,
Google Spain , where the CJEU ruled that the activities of the controller “ and those
of its establishment situated in the Member State concerned are inextricably linked
since the activities relating to the advertising space constitute the means of render -
ing the search engine at issue economically profitable and that engine is, at the same
time, the means enabling those activities to be performed ” 7
.
19. We conclude that in this case OpenAI OpCo, LLC actually conducts the data pro -
cessing and OpenAI Ireland Unlimited enables the .......... .......... .. .. ... -
formed by sourcing the necessary financial resources for OpenAI OpCo, LLC ’s op -
eration through its Irish “ Go To Market ” department.
20. Given that the complainant can choose to file a complaint only against one of mul -
tiple “joint controllers”, such a joint controllership is irrelevant when it comes to
the jurisdiction of the Datatilsynet in relation to the respondent in this complaint.
21. The .... ...... ... ... ...... .. .......... ..... ....... .. ....... .... ... ..
the joint controllers, according to Article 26(3) GDPR. The data subject has decided
to file his complaint only against OpenAI OpCo LLC, retaining the right to also en -
force his rights against the Irish entity at any time, if it became clear that the latter
has actual decision-making powers.
22. The complainant is originally from Norway. The output of ChatGPT that relates to
the complainant refers to Norway and the Datatilsynet is thus competent to handle
his complaint under Articles 55 and 77 GDPR.
6
https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9991867#english
7
See here : https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:62012CJ0131
Page 5 of 7
4. GROUNDS FOR THE COMPLAINT
4.1. Violation of Article 5(1)(d) GDPR
23. The respondent’s large language model produced false information of defamatory
character regarding the complainant, resulting in violating the principle of accur -
acy, that is set forth in Article 5(1)(d) GDPR.
24. In particular, Article 5(1)(d) .... ....... ... .......... .. .... .... .... ... ... -
sonal data that they process remains accurate and kept up to date. Moreover, the
controller shall take “ every reasonable ” step to ensure that inaccurate personal
data “ are erased or rectified without delay ”.
25. ChatGPT’s output that was related to the complainant as a data subject was false.
The controller should have implemented every reasonable step to ensure the ac -
curacy of the personal data reproduced by its artificial intelligence model. There -
fore, the controller violated the principle of accuracy.
5. REQUESTS AND SUGGESTIONS
5.1. Request to order the respondent to delete the defamatory output
and “fine-tune” its model to eliminate inaccurate results regarding
the complainant with Article 5(1)(d) GDPR
26. The complainant requests your Authority, according to its powers under Article
58(2)(d) .... .. ..... ... .......... .. ...... ... .......... ...... .. ...
complainant and „ fine-tune“ its model , so that the controller’s AI model produces
accurate results in relation to the complainant’s personal data, according to Article
5(1)(d) GDPR.
5.2. Request to compel respondent to restrict the .......... .. ... ....
subject’s personal data and notify this action to all the recipients of
the output
27. The complainant requests the Authority, as an intermediary measure during the
course of the investigation of this complaint, to impose a temporary limitation of
the .......... .. ... ............ ........ ...., ........ .. ... .......... ... -
ers under Article 58(2)(f).
Page 6 of 7
5.3. Suggestion to impose a fine
28. The complainant suggests that the competent authority imposes a fine against the
respondent, pursuant to Articles 58(2)(i) and 83(5)(a) GDPR, for the violation of
Article 5(1)(d) GDPR.
6. CONTACT
29. Communications between noyb and the Datatilsynet in the course of this proce -
dure can be done by email at XXXXXXXXXX with reference to the Case-No C096
or XXXXXXXXXX .
Page 7 of 7
1140 Vienna
Austria
Datatilsynet
PO. Box 458 Sentrum
NO-0105 Oslo
NORWAY
Per E-Mail: XXXXXXXXXX
Vienna, 20.03.2025
noyb Case-No: C096
Complainant : Arve Hjalmar Holmen , X XXXXXXXXX
XXXXXXXXXX
represented under
Article 80(1) DSGVO by : noyb – European Center for Digital Rights
Goldschlagstraße 172/4/3/2, 1140 Vienna
Respondent: OpenAI OpCo, LLC,
3180 18th Street, San Francisco,
California 94110, United States
Regarding: The .......... .. ........ .... .... ....... .. ....... -
ate outputs including them by the controller, violating
Article 5(1)(d) GDPR.
COMPLAINT
noyb – European Center for Digital Rights | Goldschlagstr. 172/4/3/2, 1140 Wien, Austria | ZVR: 1354838270
www.noyb.eu | general requests: info@noyb.eu | legal procedures: XXXXXXXXXX | IBAN: XXXXXXXXXX
page 1 of 7
1. REPRESENTATION
1. noyb – European Center for Digital Rights i s a not-for-profit organisation active in
the field of the protection of data subjects’ rights and freedoms with its registered
office in Goldschlagstraße 172/4/3/2, 1140 Vienna, Austria, registry number ZVR:
1354838270 (hereinafter: „noyb“) ( Annex 1 ).
2. noyb is representing the complainant under Article 80(1) .... ( ..... . ).
2. FACTS PERTAINING TO THE CASE
3. The controller created and manages ChatGPT, an Artificial Intelligence (AI) appli -
cation that interacts with the user by providing replies to prompts, which can be
formulated as questions in any natural language of choice. ChatGPT makes use of
large language models to provide answers that aim to be correct and updated.
These large language models calculate the statistical probability that a given com -
bination of words will appear in a given context and display the most likely results
accordingly. This operation is possible via the use of vast datasets that the con -
troller uses to train and “feed” the algorithm. These datasets make use of personal
data, too.
4. The complainant is a Norwegian citizen residing in XXXXXXXXXX His hometown is
Trondheim, Norway. He has a family with three sons. He is what people call a “reg -
ular person”, meaning that he is not famous or recognisable by the public. He
doesn’t hold a position at a public office nor has he ever been under the public eye
for any kind of pursuit. He holds a job that does not require him to be under the
spotlight. In addition, he has never been accused nor convicted of any crime and is
a conscientious citizen.
5. On XXXXXXXXXX , the complainant asked ChatGPT the question “ Who is Arve Hjal -
mar Holmen? ”. To this, ChatGPT replied the following: 1
“ Arve Hjalmar Holmen is a Norwegian individual who gained attention due to a
tragic event. He was the father of two young boys, aged 7 and 10, who were tra -
gically found dead in a pond near their home in Trondheim, Norway, in December
2020. Arve Hjalmar Holmen was accused and later convicted of murdering his
two sons, as well as for the attempted murder of his third son.
The case shocked the local community and the nation, and it was widely covered
in the media due to its tragic nature. Holmen was sentenced to 21 years in prison,
1
The permanent link to this conversation is the following: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Page 2 of 7
which is the maximum penalty in Norway. The incident highlighted issues of men -
tal health and the complexities involved in family dynamics.”
6. ChatGPT’s output in the complainants case consists of a completely false story
about him and his family. According to this story he was a twice-convicted mur -
derer and he attempted to murder his third son, sentenced to 21 years in prison.
ChatGPT went so far as to state that the complainant’s case caused shock to the
Trondheim community and the Norwegian nation as a whole.
7. Even though this story is a result of ChatGPT’s dangerous misrepresentation of
events, it contains elements of the complainant’s personal life and story and the
number of children (specifically: sons) he has, which are his hometown and the
number of children he has. The age difference between his sons is XXXXXXXXXX ,
which is eerily similar to ChatGPT’s hallucination, i.e “aged 7 and 10”.
8. The complainant was deeply troubled by these outputs, which could have harmful
effect in his private life, if they where reproduced or somehow leaked in his com -
munity or in his home town.
9. Since the last time the complainant posed the question “ Who is Arve Hjalmar Hol -
men? ” to ChatGPT, OpenAI has released a new model, which incorporates web
searches. This might mean that it is less likely for ChatGPT to reproduce the output.
However, the aforementioned conversation remains .
10. Still, OpenAI openly admits that “ [o]utput may not always be accurate ” and that
“[g] iven the probabilistic nature of machine learning, use of our Services may in
some situations result in Output that does not accurately reflect real people, places,
or facts. ” In essence, OpenAI states that its ... ...... ...... .... ... .........
of ........ ..... ....... .(.)(.) .....
The complainant contacted OpenAI on XXXXXXXXXX to complain about OpenAI’s false
output, however OpenAI responded with a “template-answer” and not with a tailored
answer to the complainant’s request ( Annexes 3,4 ) .
3. COMPETENT AUTHORITY/ LEAD AUTHORITY
11. According to the controller’s own wording, “ the model learns how words tend to ap -
pear in context with other words and then uses what it has learned to predict the
next most likely word that might appear in response to a user request, and each sub -
sequent word after that ” 2
. This is ultimately the core of ChatGPT service. The pro -
2
See here: https://help.openai.com/en/articles/7842364-how-chatgpt-and-our-foundation-models-are-
developed
Page 3 of 7
cessing is possible thanks to the use of large language models and what we assume
to be a single neural network.
12. To our best understanding, this network is operated by Open AI Global LLC, a US-
based company with seat in San Francisco, California 3
.
13. In addition, it is worth noticing that OpenAI takes pride in preserving its nature of
non-profit organisation. OpenAI explicitly declares that its for-profit branches are
directly or indirectly controlled by OpenAI, Inc. 501(c)(3) Public Charity (“OpenAI
Nonprofit”), a US-based entity. We assume that such a control extends to the pro -
cessing of personal data in the context of the large language models, as this pro -
cessing is at the core of OpenAI’s activities and services. Therefore, a large portion
– if not all – of the decision-making concerning purposes and means of the pro -
cessing takes place in the US.
14. The fact that OpenAI has developed an establishment in Europe in 2023 (OpenAI
Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper,
Dublin 1, D01 YC43, Ireland ) does not change the control over the Large Language
Model. From the information available online, it results that this company is in a
shared office (“Liffey Trust Center”, that “ provides management consultancy for the
first year ” and “provides work space if available in Dublin with reduced rent for new
businesses while they are being established ” according to its website) 4
.
15. OpenAI’s Irish office opened only on 13.09.2023 – almost one year after the explo -
sion of ChatGPT as service on the international markets – and it is probably just a
pro forma office following the enforcement actions taken by the Italian supervis -
ory authority at the beginning of 2023, to allow OpenAI to sneak under the “protec -
tion by inaction” of the Irish DPC.
16. To this day, the Dublin Office employs a small number of people, according to the
search results that show up on LinkedIn of the company. 5
Most of them hold sales
( “ Go To Market ”) and Customer Success positions, with the exceptions of a few Op -
erations employees and the Head of the Dublin OpenAI office. It is evident that the
respondent’s operation in Ireland is sales oriented. It is obvious from our research
results that the establishment does not hold any substantial decision power over
the relevant .......... ......... (... ....... ..... ........ .....).
3
See here: https://openai.com/our-structure/
4
See here : https://www.liffeytrust.ie/
5
Only 22 employees show up after the relevant search on the platform, which can be seen here:
https://www.linkedin.com/search/results/people/?currentCompany=%5B%2211130470%22%5D&geoUrn=
%5B%22105178154%22%5D&keywords=openai&origin=FACETED_SEARCH&sid=MW3
Page 4 of 7
17. Consequently, the Italian supervisory authority itself did not attribute any relev -
ance to the opening of this Irish office, as it subsequently started another investiga -
tion concerning OpenAI’s latest product – “ Sora ” – on 08.03.2024 and did not apply
the one-stop-shop. 6
18. Even if OpenAI Ireland Limited would take some decisions on the purposed and
means of the Large Language Model, it would be at most, a “joint controller” with
OpenAI Global, LLC and its non - profit controlling company, which are both based
in the United States. This argument is supported by the CJEU Judgment in C-131/12,
Google Spain , where the CJEU ruled that the activities of the controller “ and those
of its establishment situated in the Member State concerned are inextricably linked
since the activities relating to the advertising space constitute the means of render -
ing the search engine at issue economically profitable and that engine is, at the same
time, the means enabling those activities to be performed ” 7
.
19. We conclude that in this case OpenAI OpCo, LLC actually conducts the data pro -
cessing and OpenAI Ireland Unlimited enables the .......... .......... .. .. ... -
formed by sourcing the necessary financial resources for OpenAI OpCo, LLC ’s op -
eration through its Irish “ Go To Market ” department.
20. Given that the complainant can choose to file a complaint only against one of mul -
tiple “joint controllers”, such a joint controllership is irrelevant when it comes to
the jurisdiction of the Datatilsynet in relation to the respondent in this complaint.
21. The .... ...... ... ... ...... .. .......... ..... ....... .. ....... .... ... ..
the joint controllers, according to Article 26(3) GDPR. The data subject has decided
to file his complaint only against OpenAI OpCo LLC, retaining the right to also en -
force his rights against the Irish entity at any time, if it became clear that the latter
has actual decision-making powers.
22. The complainant is originally from Norway. The output of ChatGPT that relates to
the complainant refers to Norway and the Datatilsynet is thus competent to handle
his complaint under Articles 55 and 77 GDPR.
6
https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9991867#english
7
See here : https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:62012CJ0131
Page 5 of 7
4. GROUNDS FOR THE COMPLAINT
4.1. Violation of Article 5(1)(d) GDPR
23. The respondent’s large language model produced false information of defamatory
character regarding the complainant, resulting in violating the principle of accur -
acy, that is set forth in Article 5(1)(d) GDPR.
24. In particular, Article 5(1)(d) .... ....... ... .......... .. .... .... .... ... ... -
sonal data that they process remains accurate and kept up to date. Moreover, the
controller shall take “ every reasonable ” step to ensure that inaccurate personal
data “ are erased or rectified without delay ”.
25. ChatGPT’s output that was related to the complainant as a data subject was false.
The controller should have implemented every reasonable step to ensure the ac -
curacy of the personal data reproduced by its artificial intelligence model. There -
fore, the controller violated the principle of accuracy.
5. REQUESTS AND SUGGESTIONS
5.1. Request to order the respondent to delete the defamatory output
and “fine-tune” its model to eliminate inaccurate results regarding
the complainant with Article 5(1)(d) GDPR
26. The complainant requests your Authority, according to its powers under Article
58(2)(d) .... .. ..... ... .......... .. ...... ... .......... ...... .. ...
complainant and „ fine-tune“ its model , so that the controller’s AI model produces
accurate results in relation to the complainant’s personal data, according to Article
5(1)(d) GDPR.
5.2. Request to compel respondent to restrict the .......... .. ... ....
subject’s personal data and notify this action to all the recipients of
the output
27. The complainant requests the Authority, as an intermediary measure during the
course of the investigation of this complaint, to impose a temporary limitation of
the .......... .. ... ............ ........ ...., ........ .. ... .......... ... -
ers under Article 58(2)(f).
Page 6 of 7
5.3. Suggestion to impose a fine
28. The complainant suggests that the competent authority imposes a fine against the
respondent, pursuant to Articles 58(2)(i) and 83(5)(a) GDPR, for the violation of
Article 5(1)(d) GDPR.
6. CONTACT
29. Communications between noyb and the Datatilsynet in the course of this proce -
dure can be done by email at XXXXXXXXXX with reference to the Case-No C096
or XXXXXXXXXX .
Page 7 of 7
Link: https://noyb.eu/sites/default/files/2025-03/OpenAI
Testo del 2025-03-23 Fonte: noyb.eu
Demo Altre chiavi solo per gli iscritti
Commenta
i commenti sono anonimi e inviati via mail e cancellati dopo aver migliorato la voce alla quale si riferiscono: non sono archiviati; comunque non lasciare dati particolari. Si applica la privacy policy.
