United Kingdom

[GB] Data protection regulator adopts a preliminary enforcement notice against Snap regarding the privacy risks posed by AI chatbot "My AI"

IRIS 2023-9:1/6

Eric Munch

European Audiovisual Observatory

On 6 October 2023, the Information Commissioner’s Office (ICO), the UK’s data protection regulator, issued a preliminary enforcement notice against Snap Inc. and Snap Group Limited over “a potential failure to assess the privacy risks posed by its generative AI chatbot ’My AI.’” The ICO’s investigation provisionally found that Snap “failed to adequately identify and assess the risks to several million ‘My AI’ users in the UK,” including children between the ages of 13 and 17.

This preliminary enforcement notice follows the publication on 15 June 2023 of a reminder to businesses to address the privacy risks posed by generative AI before adopting this technology. Prior to that, on 3 April 2023, the ICO had published a series of 8 questions organisations developing or using AI should consider with regards to the processing of personal data, ranging from the lawfulness of the data processing to transparency, security risk mitigation, individual requests for information and the intention to rely on AI to make automated decisions.

Initially launched in February 2023 for Snapchat+ subscribers in the UK, the chatbot feature was made available to all UK users in April 2023. Using OpenAI’s GPT technology, ‘My AI’ is the first example of a generative AI being directly embedded into a major messaging platform in the UK.

The preliminary notice outlines the steps which the ICO may require depending on Snap’s actions. In the event that a final enforcement notice were adopted, Snap may be required to stop processing data in connection with ‘My AI.’ Leading to the adoption of the preliminary notice was the ICO’s finding that Snap “did not adequately assess the data protection risk posed by the generative AI technology, particularly to children.” While John Edwards, the ICO’s Information Commissioner, said that the investigation suggested “a worrying failure,” it must be noted that the findings are provisional and that no breach of data protection law has been observed. The final decision by the ICO will be taken after careful consideration of Snap’s response.


References




This article has been published in IRIS Legal Observations of the European Audiovisual Observatory.