ChatGPT, forget about me

Fulfilling the Right to Be Forgotten in AI chatbots is easier said than done. By Abigail Dubiniecki, Independent Consultant, Canada.

In principle, the EU GDPR’s Right to Be Forgotten (RTBF) applies to personal data processed by large language models (LLMs) or systems that integrate them, typically AI chatbots. In practice, determining whether something is personal data subject to the RTBF and then ensuring it is forgotten is a non-trivial exercise. Beyond the serious technical challenges, there is no clear consensus among regulators and technical experts as to what is in fact subject to the RTBF. The boundaries defining personal data are fuzzy at best due to re-identification and re-purposing risks. Security threats, complex AI supply chains, and the ability for LLMs to make rapid and revealing inferences further complicate matters.

Continue Reading

International Report subscribers, please login to access the full article

LOGIN

If you wish to subscribe, please see our subscription information.

Subscribe