Challenging Silicon Valley: A Comprehensive Look Into Polish Legal Battles Against OpenAI and Meta

In August 2023, acting on behalf of cybersecurity and privacy researcher Lukasz Olejnik, GP Partners filed with the Polish Data Protection Authority (PUODO) a complaint against OpenAI in relation to ChatGPT.

We claimed OpenAI breached the right to rectification of personal data (Article 16, GDPR), as well as several other of the GDPR’s provisions regarding lawful basis, transparency, fairness, data access rights, and privacy by design. As a result, PUODO opened a probe into ChatGPT and made a (first of its kind) public announcement. The complaint received significant coverage in the international press, including techcrunch.com, mashable.com, reuters.com, yahoo.com, dig.watch, cpomagazine.com, iapp.org and others.

Lukasz Olejnik has released the full text of the complaint together with his main reasons for making it on his blog.

The complaint brings several issues to the attention of PUODO. The mere collection of personal data for training a large language model (LLM) raises questions in light of the right to be informed contained in Article 14 of the GDPR. However, the main issue at stake seems to be the lack of a mechanism to correct so-called hallucinations (the incorrect or misleading results that LLMs sometimes generate) in a commercial product such as ChatGPT, leading to disregard of the right of rectification contained in Article 16 of the GDPR. Underlying this is a deeper issue though: OpenAI’s attitude to data protection laws, which could be characterised, like much of Silicon Valley, as indifference bordering on disregard. The case of copyright disregarded in bulk by providers of generative AI products is typical of this attitude. The complaint therefore asked PUODO to demand OpenAI to present their data protection impact assessment (Article 35, GDPR) for ChatGPT as well as a proof of compliance with the principle of privacy by design (Article 25.1, GDPR).

PUODO has dispatched its demands to OpenAI but we are not yet aware of any reaction from OpenAI. In the meantime, there have been significant developments in the realm of generative artificial intelligence (GAI) compliance (or non-compliance). GAI providers are being sued by various organisations over copyright infringements, further privacy claims have been brought against OpenAI and recently the Italian Data Protection Authority has found OpenAI in breach of the GDPR in relation to personal data in training and also regarding the use of ChatGPT by minors.

In January 2024, Poland has chosen a new President of the Polish Personal Data Protection Office. The new President is Miroslaw Wroblewski PhD, whose background is in the field of human rights. In an interview for the Polish daily Rzeczpospolita Mr Wróblewski underlined the risks for privacy posed by artificial intelligence. It therefore seems only a matter of time before the issue of ChatGPT’s compliance with the GDPR brought in Mr Olejnik’s complaint will be further pursued by PUODO.

“Konfederacja Wolność i Niepodległość” is a Polish political party with especially strong support on the internet and in social media. In January 2022, Meta (the parent company of Facebook) removed Konfedaracja’s Facebook page, which had approximately 700,000 followers, and which the party used as its main communication channel with supporters. Meta’s reasoning was that posts on Konfederacja’s page violated the Facebook Community Standards regarding COVID-19 information and hate speech.

Konfederacja engaged GP Partners to prepare a lawsuit against Meta including a motion for an interim measure. In July 2022 the court granted the motion, which, due to the complexity and gravity of the case, as well as its unprecedented character, had meaningful results. The court ordered Meta to:

At the beginning of 2023, after repeatedly calling on Meta to unblock Konfederacja’s Facebook page, we filed a further motion to initiate executive proceedings against Meta in view of Meta’s failure to execute the court’s interim order. We further threatened Meta with financial claims. This finally led to the “re-platforming” of Konfederacja on Facebook. Meta claimed that they did not want to interfere with Polish elections, hence, they reinstated Konfederacja’s Facebook page.

The court case, however, is ongoing, with Meta claiming that we are raising “conspiracy theories” regarding its decision-making process.

The case is particularly interesting and current as it involves the issue of freedom of speech in today’s information society and how social media companies moderate public discourse in line with their own arbitrary rules and against the laws of independent democratic countries such as Poland. The dispute touches on issues that are consequential in current EU legislation (the Digital Services and Digital Markets Acts especially) and that have major societal and political implications. The matter also extends to constitutional rights, especially as it concerns a significant political party.

In the lawsuit we requested the court to confirm that Meta cannot limit access (through deplatforming or shadow bans) to the pages of any political party, MP or President due to reasons other than those explicitly indicated in Polish law and only based on Polish courts’ rulings. The dispute is, in fact, a clash between an independent democratic country and a private web monopolist. The Polish government has publicly stated its support for our client and has criticised Meta for its actions, giving widespread, national publicity to the issues raised as part of the proceeding.