French data protection authority (CNIL) to look into generative AI, chatbots in 2023

On May 16, 2023 the CNIL issued a statement in which it said that it will be looking into privacy issues posed by generative AIs, large language models (LLMs) and derived applications (chatbots). The official statement is a very useful summary of the many initiatives that CNIL has pursued in the sector in the last 5 years and provide links to many existing resources.

Its forthcoming action plan will include (i) an analysis of the functioning of AI systems, (ii) the publication of guidance for privacy-friendly AI and (iii) audit and control of AI systems (official statement is here). CNIL says that it will help prepare the entry into force of the forthcoming European AI Regulation.

CNIL considers that the techniques used for the design and operation of AI tools raise questions about data protection, in particular, fairness and transparency of the data processing, protection of data transmitted by users when they use AI tools, protection against bias and discrimination, and unprecedented security challenges.

In its official statement, CNIL also mentioned that complaints have already been lodged. Where companies process personal data to develop, train or use artificial intelligence systems, CNIL will ensure that they have carried out a Data Protection Impact Assessment (DIA) to document risks and take measures to reduce them; informed people; created tools for users to enable them to exercise their rights.