Using ChatGPT can be convenient for drafting emails or handling customer issues, but dealers should be aware of significant GDPR risks, now heightened by a recent US court order.
This order requires OpenAI to store all ChatGPT conversations indefinitely, even those users attempt to delete, so they can be preserved as potential evidence in a copyright lawsuit. Deleted chats, which would normally be wiped after 30 days, are now kept under legal hold with access restricted to a small legal and security team, but with no clear end date. OpenAI is currently challenging this order in court, arguing that it undermines long standing privacy norms and user expectations.
For UK GDPR purposes, this creates several compliance concerns. It directly conflicts with key principles such as data minimisation (only collecting data necessary for the purpose) and storage limitation (not keeping data longer than needed). It also makes it harder to fulfil data subject rights, particularly the right to erasure, since dealers may no longer be able to ensure that customer data entered into ChatGPT is truly deleted. This means that by feeding personal data into ChatGPT, a dealer could unintentionally cause a GDPR breach simply because OpenAI is now forced to retain that data beyond what GDPR would permit.
Under the UK GDPR, dealers using large language models like ChatGPT also remain responsible for several obligations. They must have a lawful basis for processing personal data, such as legitimate interests balanced against the rights of customers. They must ensure appropriate security measures are in place, including assessing risks posed by sending data to external AI systems. They must also be prepared to report personal data breaches to the ICO within 72 hours, and to demonstrate accountability through measures like documented data protection policies and, where appropriate, conducting a Data Protection Impact Assessment (DPIA).
Given these heightened risks, this development should make dealers carefully consider how ChatGPT or other large language models are used in their business.
Remember, our members have GDPR modules and expert advice available to help manage these risks. If you are unsure how this affects your compliance, contact our legal team at Lawgistics.
Composer is a next-gen automotive platform that has been designed from the ground up to give you an intuitive way to promote your stock. You have extensive stock management options, and you'll gain a brilliantly responsive new website to advertise your stock, starting at just £39.99/month.
