Using ChatGPT can be convenient for drafting emails or handling customer issues, but dealers should be aware of significant GDPR risks, now heightened by a recent US court order.
This order requires OpenAI to store all ChatGPT conversations indefinitely, even those users attempt to delete, so they can be preserved as potential evidence in a copyright lawsuit. Deleted chats, which would normally be wiped after 30 days, are now kept under legal hold with access restricted to a small legal and security team, but with no clear end date. OpenAI is currently challenging this order in court, arguing that it undermines long standing privacy norms and user expectations.
For UK GDPR purposes, this creates several compliance concerns. It directly conflicts with key principles such as data minimisation (only collecting data necessary for the purpose) and storage limitation (not keeping data longer than needed). It also makes it harder to fulfil data subject rights, particularly the right to erasure, since dealers may no longer be able to ensure that customer data entered into ChatGPT is truly deleted. This means that by feeding personal data into ChatGPT, a dealer could unintentionally cause a GDPR breach simply because OpenAI is now forced to retain that data beyond what GDPR would permit.
Under the UK GDPR, dealers using large language models like ChatGPT also remain responsible for several obligations. They must have a lawful basis for processing personal data, such as legitimate interests balanced against the rights of customers. They must ensure appropriate security measures are in place, including assessing risks posed by sending data to external AI systems. They must also be prepared to report personal data breaches to the ICO within 72 hours, and to demonstrate accountability through measures like documented data protection policies and, where appropriate, conducting a Data Protection Impact Assessment (DPIA).
Given these heightened risks, this development should make dealers carefully consider how ChatGPT or other large language models are used in their business.
Remember, our members have GDPR modules and expert advice available to help manage these risks. If you are unsure how this affects your compliance, contact our legal team at Lawgistics.
Impression works with businesses across the automotive aftermarket supply chain such as parts suppliers, warehouse distributors, motor factors and independent garages. Covering all aspects of automotive aftermarket marketing, including social media, event management, customer newsletters and PR, Impression is able to quickly establish itself within a client’s business and work towards their objectives.
