B.C. privacy watchdog investigates OpenAI over shooter's chat data

The privacy probe begins

The Office of the Information and Privacy Commissioner of B.C. (OIPC) has launched an investigation into OpenAI. The watchdog is looking into how the company handled personal information provided to ChatGPT through user prompts. This inquiry specifically examines how that data is used by the service.

The investigation came to light through a court petition filed by OpenAI OpCo LLC. The company is currently asking the B.C. Supreme Court to stop the probe. If the court does not stop it, OpenAI wants to limit the scope of the documents the watchdog can demand.

The OIPC is a quasi-judicial body with the authority to issue binding orders on privacy and freedom-of-information matters. Because of the sensitive nature of the case, the watchdog initially kept the probe quiet. It eventually released a statement saying it would share key details now that the matter is public.

Links to the Tumbler Ridge tragedy

The probe follows the mass shooting at Tumbler Ridge that occurred on February 10. Reports surfaced that OpenAI staff had flagged violent messages from the shooter, Jesse Van Rootselaar. However, the company's leadership reportedly chose not to contact the police at that time.

After her initial account was banned, Van Rootselaar created a new one to continue sending violent messages and planning shooting scenarios. OpenAI stated in legal filings that it eventually provided the chat logs to the RCMP following a formal legal process. The company maintains it continues to cooperate with law enforcement.

The OIPC contacted OpenAI to learn how these violent messages were flagged for review. They also want to understand the company's internal processes for deciding whether to disclose such information to authorities. OpenAI initially turned down this request because it was not under a specific investigation regarding the shooting at that time.

Previous privacy violations

This new probe follows a separate three-year joint investigation involving multiple provinces and the national privacy commissioner. That investigation concluded in May and found that OpenAI had broken several federal and provincial privacy laws. The findings included issues with over-collecting personal information and a lack of transparency.

The watchdog also cited a lack of consent and inaccuracies regarding personal information in its previous report. It noted that users faced difficulties accessing or correcting their data and highlighted a general lack of accountability. These findings suggested that OpenAI's data practices were not meeting legal standards.

OpenAI claimed it had already begun taking steps to address those specific issues. The company argued that it should not face a second, duplicative investigation immediately following the first. They argue the current order is overbroad and demands information that is irrelevant to the watchdog's mandate.

Legal arguments and behavior

OpenAI's lawyers argue that the OIPC's demand for all of Van Rootselaar's chat logs is unnecessary because they were already given to the police. They claim the request for records regarding the company's decision-making process also exceeds the watchdog's authority. The company asserts that the probe violates the Canadian Charter of Rights and Freedoms.

The company also argues that the province's lawsuit against them suggests the opposite of the watchdog's concerns. They claim the lawsuit alleges that OpenAI should have provided the information to law enforcement much earlier. OpenAI maintains that the OIPC has not provided a coherent reason for investigating whether they broke the Personal Information Protection Act (PIPA).

The OIPC has declined to provide further comments beyond its initial press release. The watchdog is specifically interested in the potential for ChatGPT's responses to influence user behavior. This aspect of the investigation looks at how the AI's outputs might impact the actions of the people interacting with it.