Alberta's privacy regulator is renewing its call for legislative changes to address the illegal scraping of personal information for artificial intelligence, following a federal-provincial investigation that found the company behind ChatGPT violated privacy laws.
Investigation findings
Alberta Information and Privacy Commissioner Diane McLeod presented a report on Wednesday alongside the federal privacy regulator and counterparts from British Columbia and Quebec. The investigation concluded that OpenAI obtained Canadians' personal information without valid consent and used it to train its large language model. The report also found that OpenAI failed to meet transparency standards under federal and provincial privacy acts, and that ChatGPT did not allow users to access, correct, or delete their information. Additionally, the chatbot was noted to generate inaccurate responses.
Regulatory challenges
McLeod described AI as one of the biggest challenges to privacy protection in history. The investigation, triggered by a complaint three years ago, alleged that the American company collected and used Canadians' personal data for training. Federal Privacy Commissioner Philippe Dufresne said the matter is now resolved, as OpenAI made changes to limit data collection and improve user communication. However, McLeod emphasized that Alberta's privacy laws differ from federal ones, requiring both consent and a reasonable purpose for data collection under the Personal Information Protection Act (PIPA).
Two possible paths forward
McLeod outlined two potential approaches for lawmakers. If an exception for consent is included in PIPA, it must be balanced with stronger controls such as expanded oversight, fines for violations, greater accountability, transparency, and opt-out options. Alternatively, if society deems scraping unacceptable, the province should explore technological solutions to block access to personal information from scrapers.
“Is it something that society thinks is okay for these kinds of companies to go out and scrape personal information off the internet?” McLeod asked. “That’s the first question that needs to be considered when you’re looking at amending privacy laws.”
