The Supervision of EU National Data Protection Authorities over personal data processing by AI Systems (The case of ChatGPT)

The article addresses the issue of personal data protection in the context of the rapid development and proliferation of artificial intelligence. This issue once again highlights the complex relationship between human rights and emerging technologies. The focus is on the legitimacy of processing personal data by AI systems, taking into account the experiences of EU national data protection authorities supervisory activities. The growing interest in AI-related human rights issues, among other things, stems from the dependence of artificial intelligence on vast amounts of information, including personal data. To be as helpful as possible, AI systems should be provided with extensive input of data. Among the AI systems widely used today, chatbots based on artificial intelligence, particularly ChatGPT by OpenAI, have gained significant popularity due to their ability to mimic human communication skills. The development and use of such chatbots is accompanied by the emergence of dangers to personal data protection, which the EU national data protection authorities have already noted. The article outlines the specifics of the legal status of EU national data protection authorities and lists their powers designed to ensure that personal data processing by AI systems complies with the stringent standards of the General Data Protection Regulation. The author thoroughly examines the case of Garante of Italy v. OpenAI that revolves around data protection violations revealed by the Italian national data protection authority due to the lack of GDPR compliance regarding how ChatGPT operates. The article also summarizes cases involving OpenAI and initiated by AEPD of Spain, UODO of Poland, and complaints addressed to Datenschutzbehörde of Austria and Datatilsynet of Norway. The findings of this study may contribute to enhancing Ukraine’s personal data protection system. It is essential for national authorities responsible for monitoring and enforcing personal data protection to consider the progressive approaches and methods adopted in the EU and for private companies to adapt to EU standards, especially given the aspirations of Ukraine for European integration.