\documentclass[10pt]{article}

\usepackage{fullpage}
\usepackage{setspace}
\usepackage{parskip}
\usepackage{titlesec}
\usepackage[section]{placeins}
\usepackage{xcolor}
\usepackage{breakcites}
\usepackage{lineno}
\usepackage{hyphenat}





\PassOptionsToPackage{hyphens}{url}
\usepackage[colorlinks = true,
            linkcolor = blue,
            urlcolor  = blue,
            citecolor = blue,
            anchorcolor = blue]{hyperref}
\usepackage{etoolbox}
\makeatletter
\patchcmd\@combinedblfloats{\box\@outputbox}{\unvbox\@outputbox}{}{%
  \errmessage{\noexpand\@combinedblfloats could not be patched}%
}%
\makeatother


\usepackage{natbib}




\renewenvironment{abstract}
  {{\bfseries\noindent{\abstractname}\par\nobreak}\footnotesize}
  {\bigskip}

\titlespacing{\section}{0pt}{*3}{*1}
\titlespacing{\subsection}{0pt}{*2}{*0.5}
\titlespacing{\subsubsection}{0pt}{*1.5}{0pt}


\usepackage{authblk}


\usepackage{graphicx}
\usepackage[space]{grffile}
\usepackage{latexsym}
\usepackage{textcomp}
\usepackage{longtable}
\usepackage{tabulary}
\usepackage{booktabs,array,multirow}
\usepackage{amsfonts,amsmath,amssymb}
\providecommand\citet{\cite}
\providecommand\citep{\cite}
\providecommand\citealt{\cite}
% You can conditionalize code for latexml or normal latex using this.
\newif\iflatexml\latexmlfalse
\providecommand{\tightlist}{\setlength{\itemsep}{0pt}\setlength{\parskip}{0pt}}%

\AtBeginDocument{\DeclareGraphicsExtensions{.pdf,.PDF,.eps,.EPS,.png,.PNG,.tif,.TIF,.jpg,.JPG,.jpeg,.JPEG}}

\usepackage[utf8]{inputenc}
\usepackage[ngerman,english]{babel}



\usepackage{float}








\begin{document}

\title{Navigating GDPR Compliance in AI: A Deep Dive into OpenAI's ChatGPT ---
A Perspective from Multimedia Design Architecture}



\author[1]{Alicia Colmenero-Fernandez}%
\affil[1]{Affiliation not available}%


\vspace{-1em}



  
  \date{May 16, 2024}


\begingroup
\let\center\flushleft
\let\endcenter\endflushleft
\maketitle
\endgroup








\sloppy


\subsection*{Introduction}

{\label{787531}}

In an era increasingly dominated by artificial intelligence, the matter
of informed consent has never been more crucial. A study conducted by
Ipsos indicates a significant 11-point drop in internet trust since
2019{[}1{]}. Particularly in the European Union, there is growing
concern about the handling of personal data. This article aims to shed
light on the ways in which AI platforms, like OpenAI's ChatGPT, fall
short of meeting key guidelines established by the European Union's
General Data Protection Regulation (GDPR).

Utilizing data
from~\href{https://www.enforcementtracker.com/}{Enforcement Tracker}, we
present a graph illustrating the distribution of GDPR fines across
various sectors. The Media, Telecoms, and Broadcasting sectors are
particularly noteworthy, both for the number of violations and the scale
of the fines imposed, signaling serious continuos non-compliance .

\par\null\selectlanguage{english}
\begin{figure}[H]
\begin{center}
\includegraphics[width=0.70\columnwidth]{figures/1-s1UPlBAgaUFouBbbqnGnrA/1-s1UPlBAgaUFouBbbqnGnrA}
\caption{{Sum of fines by sectors
{\label{858775}}%
}}
\end{center}
\end{figure}\selectlanguage{english}
\begin{figure}[H]
\begin{center}
\includegraphics[width=0.70\columnwidth]{figures/1-3WribFhzCJ8kRx8GhuKfCg/1-3WribFhzCJ8kRx8GhuKfCg}
\caption{{Statistics: Hightest Individual Fines (Top 10)
{\label{962713}}%
}}
\end{center}
\end{figure}

\section*{}

{\label{224083}}

\section*{1. The Hidden Dangers of Opt-Out and Implied Consent in Data
Harvesting}

{\label{224083}}\par\null

\subsection*{Risk: Steep Fines for Inadequate Consent on Personal Data
Processing}

{\label{risk-steep-fines-for-inadequate-consent-on-personal-data-processing}}

When you register for the ChatGPT platform, the system is configured by
default to harvest data from your conversations to enhance its
algorithms. This setup shifts the burden onto you to actively opt out, a
tactic that flies in the face of GDPR guidelines.

According to Articles 7.2 and 4(11) of the GDPR, genuine consent must be
a ``free, specific, informed, and unambiguous indication of the data
subject's wishes'' --- a bar that opt-out strategies woefully fail to
clear.

\emph{\textbf{Article 4.11 EU~}GDPR} :~\emph{`consent' of the data
subject means any freely given, specific, informed and unambiguous
indication of the data subject's wishes by which he or she, by a
statement or by a~\textbf{clear affirmative action}, signifies agreement
to the processing of personal data relating to him or her; {[}2{]}}

\subsection*{}

{\label{better-practices-embrace-an-explicit-opt-in-model-for-user-autonomy}}

\subsection*{Better Practices: Embrace an Explicit Opt-In Model for User
Autonomy}

{\label{better-practices-embrace-an-explicit-opt-in-model-for-user-autonomy}}

The platform ought to be upfront with users about its data collection
protocols, offering them the liberty to choose whether their
conversational data will be included in the dataset or not.
Transitioning to an explicit opt-in model would bring the platform into
greater harmony with GDPR requirements, which stipulate that consent
must be free, specific, informed, and unambiguous.

From a design standpoint, adopting an explicit opt-in model is more than
just a legal obligation --- it's a cornerstone of a positive user
experience. Users deserve to know, in no uncertain terms and plain
language, what data is being gathered and for what purposes. A
well-crafted consent form can make this process transparent and
user-friendly, effectively ticking the boxes for both GDPR compliance
and sound design principles.

\par\null

\section*{2. The Flaw in Bundled Consents: Muddled Choices and Hidden
Implications}

{\label{the-flaw-in-bundled-consents-muddled-choices-and-hidden-implications}}\par\null

\subsection*{Risk: Non-Compliance with Articles 7.2 of the
GDPR}

{\label{risk-non-compliance-with-articles-7.2-of-the-gdpr}}

On the ChatGPT platform, a single toggle in the settings controls both
your chat history and the use of your data for AI training. Deactivating
this button not only stop future conversation from contributing to model
training but also erases your chat history . However, what it doesn't
make clear is that your past conversations can still be used for model
training unless you navigate through additional layers to explicitly opt
out.

\par\null\selectlanguage{english}
\begin{figure}[H]
\begin{center}
\includegraphics[width=0.70\columnwidth]{figures/1-nLXc-uCkx0kp2nnckBPxPQ/1-nLXc-uCkx0kp2nnckBPxPQ}
\caption{{Settings
{\label{387211}}%
}}
\end{center}
\end{figure}

\par\null

\emph{\textbf{Article 7.2 EU~}GDPR\textbf{:~}{[}\ldots{}{]}~} If the
data subject's consent is given in the context of a written declaration
which also concerns other matters, the request for consent shall be
presented in a manner which is clearly distinguishable from the other
matters, in an intelligible and easily accessible form, using clear and
plain language.\emph{{[}2{]}}

\emph{}

\subsection*{Best Practices: Separate and Visible Consent
Options}

{\label{best-practices-separate-and-visible-consent-options}}

To align with GDPR guidelines, these consent options should be unbundled
and made distinct. A transparent and easily accessible setting should
allow users to opt in or out of each feature independently.

\subsection*{User-Friendly Revocation
Mechanisms}

{\label{user-friendly-revocation-mechanisms}}

Moreover, when a user chooses to delete a specific conversation, the
implications --- both in terms of model training and data storage ---
should be clearly stated. Additionally, users should be provided with a
straightforward path to opt out of having any of their past
conversations used for model training.

\par\null

\section*{3. Data Retention: A Dubious Policy at Odds with
GDPR}

{\label{data-retention-a-dubious-policy-at-odds-with-gdpr}}\par\null

Risk: Penalties for Violating GDPR and LOPDGDD Principles, Including
Data Minimization and Purpose Limitation

{\label{risk-penalties-for-violating-gdpr-and-lopdgdd-principles-including-data-minimization-and-purpose-limitation}}

The ChatGPT platform holds onto your information for 30 days, even after
you've opted out of data training. This policy not only raises ethical
questions but also appears to contradict Article 17 of the GDPR, which
confers the ``right to erasure.''

\textbf{(Platform) If I disable history, does the setting apply to all
my conversations, or can I choose specific conversations to enable it
for?} ~While history is disabled, new chats will be deleted from our
systems within 30 days -- and reviewed only when needed to monitor for
abuse -- and won't be used for model training. Existing conversations
will still be saved and may be used for model training if you have not
opted out.\emph{{[}3{]}}

\emph{\textbf{Article 17. EU GPRD:~}``} The data subject shall have the
right to obtain from the controller the erasure of personal data
concerning him or her without undue delay and the controller shall have
the obligation to erase personal data without undue delay {[}\ldots{}{]}
``.\emph{{[}2{]}}

\emph{}

\subsection*{Best Practices: A Clear Path to Immediate Data
Deletion}

{\label{best-practices-a-clear-path-to-immediate-data-deletion}}

Given the GDPR's stringent conditions for data retention, the platform's
30-day policy raises compliance issues. Unless the platform can prove a
compelling legal justification that aligns with GDPR exceptions, an
immediate data erasure option should be made available and clearly
marked within user settings.

\par\null

\section*{4. Obstacles to Seamless Rights Exercise: The Syncing
Snare}

{\label{obstacles-to-seamless-rights-exercise-the-syncing-snare}}

\subsection*{}

{\label{risk-non-compliance-with-articles-25-and-7.3-of-the-gdpr}}

\subsection*{Risk: Non-Compliance with Articles 25 and 7.3 of the
GDPR}

{\label{risk-non-compliance-with-articles-25-and-7.3-of-the-gdpr}}

The process of withdrawing your consent should be straightforward.
However, the platform's settings don't sync across devices, forcing you
to opt out on each device separately. This complicates matters and runs
afoul of Articles 25 and 7.3 of the GDPR, which mandate that withdrawing
consent should be as easy as giving it.

\textbf{(PLATFORM) Does this functionality sync between web and mobile
devices?~} \emph{This setting does not sync across browsers or devices.
You will have to enable it in each device.}

Article 25.2 EU GDPR:~ The controller shall implement appropriate
technical and organisational measures for ensuring that, by default,
only personal data which are necessary for each specific purpose of the
processing are processed. That obligation applies to the amount of
personal data collected, the extent of their processing, the period of
their storage and their accessibility. In particular, such measures
shall ensure that by default personal data are not made accessible
without the individual's intervention to an indefinite number of natural
persons.\emph{{[}2{]}}

Article 7.3 EU GDPR:~ The data subject shall have the right~\textbf{to
withdraw his or her consent at any time} . The withdrawal of consent
shall not affect the lawfulness of processing based on consent before
its withdrawal. Prior to giving consent, the data subject
shall~\textbf{be informed} ~thereof. It shall be as easy to withdraw as
to give consent.\emph{{[}2{]}}

\emph{}

\subsection*{Best Practices: Streamline Consent Across
Devices}

{\label{best-practices-streamline-consent-across-devices}}

The user experience should be consistent across all devices. When
consent is withdrawn on one device, this choice should be universally
applied to all other platforms. This is not just a hallmark of good
design but is also in line with GDPR's Articles 25 and 7.3, which call
for an uncomplicated withdrawal process.

\section*{5. The Maze of Consent: How Complexity Undercuts
Transparency}

{\label{the-maze-of-consent-how-complexity-undercuts-transparency}}

\subsection*{The Hurdles in Opting Out}

{\label{the-hurdles-in-opting-out}}

Withdrawing your consent on the platform is far from straightforward. To
fully opt out, you must navigate through two separate links and fill out
a form. The initial deactivation button, which turns off chat history
and model training, only applies to future conversations. Prior chats
will continue to be used for training unless you specifically navigate
to and complete an additional opt-out form. This convoluted process
erodes transparency and impedes users' ability to easily withdraw
consent.

\subsection*{Recommendations for
Improvement}

{\label{recommendations-for-improvement}}

\subsection*{Simplify Consent
Withdrawal}

{\label{simplify-consent-withdrawal}}

Good design often adheres to the principle of ``less is more.'' The
option to withdraw consent should be easily accessible, not hidden
behind multiple layers of menus or hyperlinks. A clean interface,
perhaps using progressive disclosure techniques, would make the process
more user-friendly.

\subsection*{Enhance Transparency with Clear Information
Architecture}

{\label{enhance-transparency-with-clear-information-architecture}}

The key to improving transparency lies in robust information
architecture. Users shouldn't have to dig through a labyrinth of links
to manage their data and consents. A streamlined, user-focused design
can go a long way in enhancing a user's ability to control their own
data.

\section*{6. The Rigidity of Rectification: An Oversight in User Data
Management}

{\label{the-rigidity-of-rectification-an-oversight-in-user-data-management}}

\subsection*{Risk: Fines for Infringement of Data Subject Rights,
Including Access and
Rectification}

{\label{risk-fines-for-infringement-of-data-subject-rights-including-access-and-rectification}}

One area where ChatGPT falls short in GDPR compliance is in facilitating
users' right to rectify their data. Article 16 of the GDPR unequivocally
states that individuals have the right to correct any inaccurate
personal data about themselves.

Article 16 EU GDPR:~ The data subject shall have the right to obtain
from the controller without undue delay the rectification of inaccurate
personal data concerning him or her. Taking into account the purposes of
the processing, the data subject shall have the right to have incomplete
personal data completed, including by means of providing a supplementary
statement.\emph{{[}2{]}}

In the ChatGPT system, your email is tethered to a unique token that
identifies your activity on the platform. Currently, if you change your
email --- which is often linked to your phone number --- the platform
offers no straightforward way to update this information.

\par\null

\subsection*{Best Practices: Enable Email Address
Flexibility}

{\label{best-practices-enable-email-address-flexibility}}

Users should be able to effortlessly update their associated email
addresses. Streamlining this process not only enhances user experience
but also brings the platform into compliance with GDPR's Article 16,
concerning the right to data rectification.

\subsection*{UI Note for Compliance:}

{\label{ui-note-for-compliance}}

``To change the email linked to your account, simply follow this link:
{[}Link to Change Email{]}. The procedure is reversible and designed for
utmost simplicity, aligning with Article 16 of the GDPR.''

\par\null

\section*{Conclusion: Charting the Path
Forward}

{\label{conclusion-charting-the-path-forward}}

Trust in AI systems isn't just desirable --- it's imperative. Both legal
compliance and thoughtful design must collaborate to forge a user
environment that's both safe and GDPR-compliant. As we tread deeper into
the AI landscape, especially concerning biometric data collection and
processing, the urgency to address these issues only amplifies.

By melding principles from multimedia design architecture with GDPR
guidelines, businesses can adopt a proactive stance --- effectively
safeguarding user privacy without compromising on experience.

\subsection*{}

{\label{quuxe9-debo-hacer-si-creo-que-no-se-han-respetado-mis-derechos-de-protecciuxf3n-de-datos-personales}}\selectlanguage{ngerman}\href{https://commission.europa.eu/law/law-topic/data-protection/reform/rights-citizens/redress/what-should-i-do-if-i-think-my-personal-data-protection-rights-havent-been-respected_es?}{¿Qué
debo hacer si creo que no se han respetado mis derechos de protección de
datos personales? Acciones posibles si no se ha respetado la protección
de sus datos según el Derecho de la UE, como recurrir a la\ldots{}}

~

{\label{acciones-posibles-si-no-se-ha-respetado-la-protecciuxf3n-de-sus-datos-seguxfan-el-derecho-de-la-ue-como-recurrir-a-la}}\par\null

Sources:

{[}1{]} ``Trust in the Internet,'' Ipsos, November 2022.~\emph{Link}

{[}2{]} ``UE Reglamento General de Protección de Datos,'' Privacy
Regulation EU.~\emph{Link}

{[}3{]}''Data Controls FAQ,'' OpenAI Help Center.~\emph{Link}

\selectlanguage{english}
\FloatBarrier
\end{document}

