The Problem with the Privacy of ChatGPT Data

 Very key issue, when we converse with any chatbot, they have learned something about our needs. To predict your next question.    As Chatbots gets more sophisticated, they can get more specific and valuable data.    Are we ready to do that?   Is a warning sign-off enough?  

ChatGPT is a data privacy nightmare, and we ought to be concerned  in ArsTechnica.  

ChatGPT's extensive language model is fueled by our personal data.

URI GAL, THE CONVERSATION - 2/8/2023: 

ChatGPT has taken the world by storm. Within two months of its release it reached 100 million active users, making it the fastest-growing consumer application ever launched. Users are attracted to the tool’s advanced capabilities—and concerned by its potential to cause disruption in various sectors.

A much less discussed implication is the privacy risks ChatGPT poses to each and every one of us. Just yesterday, Google unveiled its own conversational AI called Bard, and others will surely follow. Technology companies working on AI have well and truly entered an arms race.

The problem is, it’s fueled by our personal data.

300 billion words. How many are yours?

ChatGPT is underpinned by a large language model that requires massive amounts of data to function and improve. The more data the model is trained on, the better it gets at detecting patterns, anticipating what will come next, and generating plausible text.

OpenAI, the company behind ChatGPT, fed the tool some 300 billion words systematically scraped from the Internet: books, articles, websites, and posts—including personal information obtained without consent.

If you’ve ever written a blog post or product review, or commented on an article online, there’s a good chance this information was consumed by ChatGPT.

So why is that an issue?

The data collection used to train ChatGPT is problematic for several reasons.

First, none of us were asked whether OpenAI could use our data. This is a clear violation of privacy, especially when data is sensitive and can be used to identify us, our family members, or our location.  ... '   ... 

China Passes Strict New Data Privacy Law

Intriguing in the details.  But data privacy for who?  How is it applied legally?   How will it be interpreted? 

China Passes Strict New Data Privacy Law    By Alex Woodie  in Datanami

The Chinese government today announced that it will institute a strict new data privacy law on November 1. Dubbed the Personal Information Protection Law (PIPL), it is said to be among the most stringent data privacy laws in the world.

Passed by the National People’s Congress earlier today, PIPL requires organizations to obtain the consent of Chinese citizens before collecting their personal information. Companies must also give citizens the option not to be targeted for marketing purposes or to have marketing based on personal characteristics.

The law also requires that there must also be a “clear and reasonable purpose” for handling personal information, and organizations must aim for the “minimum scope necessary to achieve the goals of handling” data, according to a Reuters story.

PIPL, which was first proposed in 2020, applies to all companies that work with Chinese citizens, including foreign and domestic entities. Chinese citizens in recent years have begun to complain about the mismanagement and abuse of their personal information at the hands of Chinese companies.

Chinese citizens succumb to scams and fraud at rates similar to people in other countries. A 2015 survey by the Internet Society of China found that 76% of Chinese users had received fraudulent information from sources purporting to be banks, Internet companies, or television stations offering prizes, according to a 2016 story in the Wall Street Journal. Over half have received scam calls, while one-third said they have lost money after receiving fraudulent calls, text messages, or emails, the story said.

PIPL is the third of three new laws that Chinese lawmakers have passed in recent years. The Chinese Data Security Law, which is set to go into effect on September 1, sets a framework for companies to classify data based on its importance, including “national core data,” “important data,” and “general data.” The country’s Cybersecurity Law, which went into effect in 2017, requires network operator to store select data within the country, and allows the government to conduct spot-checks of data and network operations.

PIPL resembles the European Union’s General Data Protection Regulation (GDPR) in some respects. However, it differs in one major way, which is that Chinese authorities are expected to maintain access to people’s personal information. Multi-national companies that want to sell their products and services to Chinese citizens, however, would do well to pay attention to the new law, says Charles Farina, head of innovation at Adswerve.  ... '