Get started
Work

Lawfulness of the mass processing of publicly accessible online data to train large language models

Year: 2024
Type: article
Abstract: Key points With the unstoppable rise of large language models, the lawfulness of training them with publicly accessible online data started to be questioned. This article examines this question in the European Union data protection context by taking ChatGPT as a case study to understand whether a valid legal basis could be found for these processing activities. This discussion has so far focused on Article 6(1)(f) GDPR and inquired whether and to what extent OpenAI has a legitimate interest in processing publicly accessible online data to train ChatGPT. However, this article suggests that Article 9 GDPR should apply to these processing activities considering the relevant judgments of the Court of Justice of the European Union. Accordingly, it examines the exceptions listed in Article 9(2) GDPR that OpenAI could rely on for these processing activities. Consequently, the article argues that while it is practically not possible for OpenAI to obtain and demonstrate the explicit consent of data subjects whose publicly accessible personal data are used for training ChatGPT, the pool of personal data that are manifestly made public by data subjects and, therefore, could be used for training large language models appears limited. Considering that OpenAI or other developers currently do not mention that only this limited amount of personal data is being used for training their models, the article calls for clarification for all stakeholders. Lastly, it speculates on a possible way forward and provides of the of all to that these models are the that of to their online that this a that could the public of a of them is on to of all the of this to be to this the and by and data protection of and the with of to these on the that the publicly so that interest of the could be However, not them being in these to the of only the data protection for the of the on the processing of publicly accessible online data a in the data protection the and models on processing these with the unstoppable rise of large language models it has the in ChatGPT has that by the that it the in by ChatGPT are on of in as personal or and with and to as are to the their Accordingly, are being used for of these models, ChatGPT, started their as processing and to their other ChatGPT, are not whether these models could could by these models, to these models or to the of and on the and whether and to what extent should be to on the that are of the that are to the to these legal are to the that a amount of data is used for training these models, ChatGPT. OpenAI is the training of are what of data and used for OpenAI that models are on a of that publicly and by and of training data personal that is on the public these with the of the it be that ChatGPT is data publicly accessible other OpenAI of online data that is publicly accessible to train ChatGPT. has that other developers the to train their it that ChatGPT the to Accordingly, it is that personal in on the are data be of of the these not to be the OpenAI in the that ChatGPT on their a of this it is that and are the other of the in the are taking the in these the made way to the in it OpenAI processing data to of the the of basis the and processing of personal data in to the on the OpenAI has with the to this and this appears to as the that it has of the GDPR to OpenAI and in OpenAI to the legal basis for processing personal data to train the while other their of ChatGPT, the European has a on ChatGPT to and on possible to that the of the legal on the processing of publicly accessible online data for training this article on the question in the European Union data protection context by taking ChatGPT as a case whether a valid legal basis could be found for these processing that it that processing of publicly accessible online data to train ChatGPT the of the data protection and, therefore, to be a valid legal basis for these processing activities. Accordingly, it examines the discussion on on legitimate in Article 6(1)(f) as the legal basis for these processing activities. Article 9 GDPR should be to the legal basis for these processing activities of Article GDPR in of the case of the Court of Justice of the European Union OpenAI and data training ChatGPT with publicly accessible online article examines exceptions in Article 9(2) GDPR OpenAI could rely on for training ChatGPT with this it is practically for OpenAI to obtain and demonstrate the explicit consent of data subjects whose personal data is the by OpenAI to train ChatGPT. a the article the made public by the data it the that the pool of personal data that are manifestly made public by data subjects and, therefore, could be used for training appears limited. that has explicit made by OpenAI or other that only this limited amount of personal data is being used for training their the article calls for clarification on this to for all stakeholders. Lastly, the article speculates on a possible way forward and by the of all to that are the to data protection of it a valid legal basis is OpenAI that large language models, the models that ChatGPT, are of that is publicly on the that and that or of this for the data protection is that all these personal and processing them the of the However, the of this article is the by the that is publicly on the personal data processing activities by OpenAI are this data is as to or in the Accordingly, of the of this as and so in the has of the of personal a in the on this case for and on personal training ChatGPT with the that is publicly on the OpenAI data that is personal data as Article OpenAI this by large amount of data on the to so training personal to of training and and and explicit of the the personal data in the training of ChatGPT, OpenAI that with the are to that are to However, it is that of training data personal that is on the public to personal the training models to for personal of and to to their personal the that models that the personal of in this as and the only the that ChatGPT is being on and could personal OpenAI that models personal to and public This models relevant only this it is to that OpenAI personal data training ChatGPT with that is publicly on the the training OpenAI that ChatGPT not or training in a it and the to and in to a not and training a has a and it models do not to training OpenAI with this that it not or the data used for training this not the that their on that is publicly on the to train ChatGPT as processing as in the This is Article GDPR processing as or of is on personal data or on of personal whether or not by as or by or or or be the of and in this the European provides a of this this it is to that by OpenAI to ChatGPT processing as Article the training data are not or in a this it should be that the has that the of personal data in the public as as the activities of a in the and in of the of the by OpenAI on the that is publicly on the to train ChatGPT with the activities as processing by the in these only this OpenAI has a European provides to data subjects in the and not the of for the of the processing personal it with in the of the in that is with the lawfulness in Article processing activities to rely on a valid legal Accordingly, OpenAI should rely on of the legal listed in Article GDPR for training ChatGPT with the that is publicly on the OpenAI with this has to legal the OpenAI in processing the personal data of in the of a valid legal basis for processing personal data for training the OpenAI to the legal basis for processing personal data for training by to the to the legal basis in Article GDPR that personal data to be it is for the of a to the data is or in to the of the data to a and on consent or legitimate interest OpenAI with this and the European and the that legal for processing legitimate in or train it is that OpenAI this on as of the to the legitimate of and as the legal basis for processing of personal data the that is publicly on the to train However, these only the legal basis for processing the personal data of ChatGPT that OpenAI that is publicly on the it is that the personal data of are not ChatGPT are to this OpenAI should a valid legal basis for processing the personal data of these article on on this by training and the of this training are publicly these and of personal that is in training on legitimate the This that OpenAI on Article 6(1)(f) GDPR as the legal basis for processing the personal data of these in Article 6(1)(f) this legal basis personal data to be the processing is for a legitimate interest of the data or a the interest or and of the data subjects be this it is not for data to to a legitimate interest to rely on this legal to a in to demonstrate that the of their processing is the processing is for that and the and the and of the data subjects are not their to be Accordingly, data on this legal should demonstrate that this to be to personal data in with the lawfulness in Article the on this legal basis for processing publicly accessible online for the of training models, has in case and whether OpenAI could rely on Article 6(1)(f) GDPR to train ChatGPT with that is publicly on the has started to be to this the should be to processing activities on these data to train ChatGPT, and the should be used as in the it should be that the has in case in a of are to be while it should be that is currently a case it whether could be as in the the whether could a legitimate interest for a data that a data interest in or to it and, therefore, could be a legitimate interest in processing personal Accordingly, OpenAI could that it has a legitimate interest in processing the publicly accessible online data to train and ChatGPT, it to the it is possible for OpenAI to this by on a legitimate as interest in the as the the of whether the legitimate interest be as by other that with the and of data should be by whether the data in Article is the the processing activities in question by to their and in a of data subjects processing their personal in and the the of this processing and on data it whether processing could be for This has for is that processing of publicly accessible online data to train ChatGPT be with the data the personal data to be and limited to what is for the of the processing in the and the of data that being of this it is for the the data protection that training is only possible the of data and currently is that could be with could OpenAI to the However, it should be that the developers of these models that it is to these models has started to be Accordingly, whether could be by processing or publicly accessible online data is it is that developers of these models are for data their with data it has started to be that of training data in the these developers to for to data to train their these it is that OpenAI could the Lastly, the the in the case that the processing activities by on data subjects and, that data subjects could not their data to be by these are to processing it should be that whose personal data are publicly accessible online and could not that their personal data be used for training ChatGPT, considering the of and the models and that are being on the processing of publicly accessible online data in ChatGPT This that processing activities on that is publicly on the could on it should be that the in the case that the of processing activities so that it to as data subjects as their being in the context to processing of publicly accessible online data to train and models in could to on as to online to these models of their This is for in as the online of their to the developers them for training and their the and these developers and data protection could only these the and of data in could the legitimate interest of OpenAI other OpenAI the that is publicly on the to train ChatGPT in the of to the on it OpenAI could the of the of Article 6(1)(f) GDPR to do so and it is that OpenAI could rely on Article 6(1)(f) GDPR for training ChatGPT with publicly accessible online data it processing activities on these data to to the data protection as data and to the on the and of the data subjects in the of is the the lawfulness of these processing activities this as to their the on ChatGPT OpenAI the legal basis to Article 6(1)(f) GDPR for training However, a be the processing of publicly accessible online data to train the of Article 9 as it data the data protection of personal as that or the or of data are as their processing to data and Accordingly, their processing is as Article it on of the exceptions listed in Article 9(2) processing publicly accessible online OpenAI of data the of the accessible on the as data to the or of it should be that the protection by Article 9 GDPR of Article GDPR should apply to the personal data processing by for personal data to the listed in Article However, this be this the in Article GDPR is the has the for a of what the the whether personal data that is to the of a the a to this question and, therefore, personal as the of the or of the data that or the of the protection of Article 9 this it that is it with other a of the of data subjects to be the of the with their and This appears in to what extent personal data by OpenAI is to Article 9 GDPR This is personal data that is not could be with other personal data by ChatGPT to data as while this it should be that OpenAI that it not data for of it that models personal to and public This models relevant a could be as ChatGPT training data to of the of for to not only the personal data as by their not could the of Article 9 GDPR training ChatGPT with publicly accessible online However, the amount of personal data by OpenAI with this it be practically to and data the of their processing to of the of Article 9 this the should be this the that the processing in question and data and personal data is the being to them the of the these processing activities should be to Article 9 This has for OpenAI of data the to train models, the training of ChatGPT and personal data considering OpenAI that it personal data training it appears that OpenAI and personal data the of their all personal data that are publicly accessible online and by OpenAI to train ChatGPT the of Article 9 the that Article 9 GDPR of the that data in question to other the of the whether is or the to obtain that for it is that the personal data of other ChatGPT whose personal data are publicly accessible are to Article 9 data used for training ChatGPT that are or to the by ChatGPT that are could the of Article 9 GDPR as as data are Article 9 GDPR of to models the not these that personal data processing by OpenAI to train models by publicly accessible online data should be Article 9 This processing activities by OpenAI to train ChatGPT with publicly accessible online data to be it on of the exceptions in Article 9(2) the exceptions only for is explicit consent data and the is processing personal data that are manifestly made public by data is these legal OpenAI could rely on of to Article personal data could be on the explicit consent of the data the GDPR consent in Article consent to be and it of what explicit consent is as the of consent that the in Article GDPR and is by of the data consent to data and consent and the to or consent data subjects to be or and whether is a the data and the that the data consent to consent that is for processing consent data subjects to the processing in and accessible with and language so Lastly, consent the data and GDPR that while a a or or that the data this or of these this is to the to the way the consent is that the that the in online could be by in a with the or on explicit consent a be these explicit consent has to be it be that on the explicit consent of data subjects as the legal basis for training ChatGPT by processing their publicly accessible online data not for OpenAI to and legal This is that of data subjects are to these processing it be a in for OpenAI to obtain and demonstrate their explicit in to with the consent OpenAI processing activities to these processing their personal data to train ChatGPT. be practically for OpenAI to do so that it has with these to as their personal data are all of the in a case OpenAI and to obtain and demonstrate the explicit consent of all these it to with as a of on explicit consent as the legal basis for these processing activities. data subjects are to their consent that the lawfulness of the processing in However, it is to be whether and to what extent OpenAI could with to that the personal data in question is the training of ChatGPT. on Article GDPR as the legal basis for training ChatGPT with publicly accessible online OpenAI the legal basis for these processing activities in Article 9(2) this it should be that the OpenAI to legal basis to consent or legitimate interest for training OpenAI to for legitimate interest of a made to legal and in the consent of these Accordingly, the could be their explicit consent is in it appears that OpenAI rely on Article GDPR for processing publicly accessible online data to train ChatGPT, the made public by the data should be to whether it could as the legal basis for it be in with the of OpenAI that it that is publicly this it should be that the a in the and case by that this to publicly accessible online data the that with other the in Article should be in Accordingly, whether this could a valid legal basis for OpenAI to be this by the relevant case and in Article GDPR and Article of the in the data protection the made public by the data legal basis appears as of the legal the of and on limited has by the and on this legal the to what are the of this legal basis that the data and should be to be to rely on the made public by the data processing personal in the the this should be this the that this should be and personal data be manifestly made public data subjects to their personal data accessible to the public and by this it that a to a or data are be as manifestly personal data the the in data subjects in other with and that data and that whether that is public should on the by the data data subjects to do so and to their as on a or accessible to the of a or limited of with of the their personal data could be manifestly made public by the other are on the or with the data should be made by whether data subjects to their data being accessible by to that or on the to OpenAI with the be used to models and are to that are to or that is the that their with and that do whether OpenAI could rely on Article GDPR training ChatGPT with publicly accessible online data should be whether OpenAI could rely on Article GDPR for processing the personal data of data subjects made their personal data publicly accessible should be the whether data subjects made their personal data publicly accessible with and of the Accordingly, that this and the data should be this personal data to be the and in of data subjects made with of the explicit and could be for in the data subjects to their personal data accessible by of that or the This with the data protection by and by in Article as it that by personal data are not made accessible the to of is that the this as it listed the of a the to be for on Article GDPR to the personal data on the that the of a that the personal data in question publicly accessible this personal data to be as the European whether a and public the of their whether personal data that is on these it should be that the personal data of of the personal data on them publicly accessible the data this be as other for this to be OpenAI should demonstrate that data subjects whose personal data publicly accessible online in to their personal data their However, the of publicly accessible online data that with this is the of that do not with this it should be that has on the not for this by the in to and while the case a the publicly personal it to what extent the publicly accessible online data that OpenAI to train ChatGPT with this in data subjects to their personal data publicly the a to be made with of the the to what should be the by it be that it to the of the personal data in question to the data subjects these and whether to to their personal data accessible to the public by to them by the are as of and However, these their and to their on for and the and possible of personal these data subjects data subjects should the of possible their these the that the of the the data subjects are the a in whether the personal data in question has Accordingly, the for in a that data subjects to their personal data to the be of the data data subjects the and to their personal data to the their it is that the data subjects the are to that are not to data the data This is to for the of personal data to the public be by the data the not to their of to the of their data with or that data for training data subjects the of the be to their personal data for as the or to be to a for their as their be in data subjects of the or their to their personal data to the whether and OpenAI and only the personal data of data subjects their personal data public in OpenAI not be to rely on Article GDPR to these data to train ChatGPT. This is as by the that be a for on this that that the of data subjects should be whether their personal data the of the data is of the of the lawfulness of a processing by the that the European to it in and GDPR in this Accordingly, it is for the that data subjects could not their to be to a while that processing activities the that the European for and could rely on the made public by the data legal basis to the personal data of with a public for it it is whether a that public data be by the for of and of the of data subjects processing their personal data on Article on the whether a made by in a discussion could the processing of data for is the that by in a discussion that public for the and the data manifestly made data to public as Article However, the that a in the processing of these data for by the is in Article GDPR and data to personal data for and legitimate it be that their personal data to the data subjects could not their data to be used for training This not only the of the to the publicly accessible online data to train these models their it has that and to mention that publicly accessible data the be used training it has that and are their to to their publicly accessible online data to train models, processing are to data subjects to their personal data and their on their and are relevant for data subjects are in their to the of their by them to the public and not for them to be used for training as by the and the developers of these models Accordingly, OpenAI and other developers should the of data subjects whether their personal data However, as it these could them on Article GDPR to publicly accessible online data to train their OpenAI could rely on Article GDPR to publicly accessible online data as as are as other the personal data in question should to the of the data manifestly made However, the GDPR of what in Article it is that by personal data are not made accessible the to of This that the of of what in online in the data protection appears to be this This is the to the in online it of of of and in the of data and it whether has to personal data or the in question to are to the personal data in the to it is to a of the Consequently, it be that are and, therefore, the personal data in question is accessible by of a or or of of the it is personal data should be as and the this of as that personal data should be accessible by for it to be on the made public by the data legal while the listed the of a as of the to the of the personal data in the to public by this This OpenAI to the personal data that are accessible by on Article that other of this are However, a could to as it to understand and public are in online this on a with is a on with only is a appears to the of personal this has by the and the on the processing of personal data of the that the of the should be on Article it should be whether the to the data subjects with their and and or them to with their used to this that it be to personal data manifestly made the is to and it is accessible by the public to the of that this by personal data in a or article in the is not the as a on a the that personal data should be accessible by the public and that is not public to a of the found that not manifestly their personal data by the their only to a limited of other on their Lastly, and that to data a it be these are the pool of personal data that is in the and, therefore, could be by OpenAI to train ChatGPT, that other of Article GDPR are be limited. This is it OpenAI to for whether the personal data in question are to and of the data is accessible while However, the of the on what in online appears to OpenAI to personal data that is accessible by to train ChatGPT on Article that other of this are it should be as by the and the in with other in the data protection in Article should be This appears to be the data subjects to their personal data to the Accordingly, a data not to personal data to the public it by that personal data could not be manifestly made public the data for data or in the of that the of personal data to the public the a the personal data in question are to the public it be on Article as is by of the data This has for This is it online to train ChatGPT and, as by the that not by the to it it has that training by publicly accessible online data it should be that OpenAI that personal to and public This that in data subjects are by as are used by OpenAI to train ChatGPT. However, whether data subjects are for the of the is in as by the data should be that it the to their data the in a data for a or the public to the in that on other are used by OpenAI to train the on as publicly accessible or personal personal data of other the of while the personal data of the of could be as manifestly made public the data that other of Article GDPR are the be for the personal data of other it is that the of that OpenAI that with the are to that are to or that to be to these are to personal data by data subjects it be whether the the data is OpenAI on Article GDPR to train ChatGPT with the publicly accessible online all these it appears that OpenAI could only the of Article GDPR it for training ChatGPT, the personal data of are with to their personal data to the the other it is these data the of the and, in are not the data the pool of personal data that is publicly accessible online and could be by OpenAI to train ChatGPT by on Article GDPR appears limited. This to the lawfulness of processing activities to train ChatGPT by publicly accessible online to the of has clarification made by OpenAI that only this limited amount of personal data has used for a that for other to the data subjects are not with to their personal data to the Article GDPR could be used as the legal basis to their data to their data to to the or in question on the This the data protection by and by in Article personal data not to be to of the data Accordingly, data subjects are not with the of their personal as the explicit consent of these data OpenAI should demonstrate that these to their data to the public on the to be to their data to train ChatGPT by on Article However, it is not in whether the explicit consent is
DOI: 10.1093/idpl/ipae013
Author: Taner Kuru
Institution: Tilburg University
Language: English
Subfield: Law
Open Access status: hybrid
Estimated APC paid: $4,877
OpenAlex ID: W4403307364
FWCI: 31.54
Cites:
Cited by: 12
Related to: 10