OpenAI strategizes to mitigate regulatory risk in the EU regarding data privacy

In the waning days of the previous month, while much of Europe indulged in holiday chocolates, OpenAI, the creator of ChatGPT, took proactive steps to minimize regulatory risks within the European Union (EU). OpenAI addressed concerns about ChatGPT’s impact on privacy, which had prompted investigations by data protection authorities in Italy and Poland. Italy’s intervention even led to a temporary suspension of ChatGPT in the country.

In an email dispatched on December 28, OpenAI communicated a significant update to its terms. The email stated, “We have changed the OpenAI entity that provides services such as ChatGPT to EEA and Swiss residents to our Irish entity, OpenAI Ireland Limited.” A concurrent modification to OpenAI’s Privacy Policy for Europe clarified that OpenAI Ireland Limited, based in Dublin, would be the data controller for users in the European Economic Area (EEA) and Switzerland, where the General Data Protection Regulation (GDPR) is applicable. The updated terms, designating the Dublin-based subsidiary as the data controller for the mentioned regions, will come into effect on February 15, 2024.

The one-stop-shop (OSS) mechanism of the GDPR permits companies processing European data to streamline privacy oversight under a single lead data supervisory authority located in an EU Member State. This arrangement reduces the capacity of privacy watchdogs elsewhere in the EU to independently address concerns, as they typically refer complaints to the main established company’s lead supervisor.

When asked about OpenAI’s pursuit of main establishment status for its Dublin entity under the GDPR’s OSS, the Irish Data Protection Commission (DPC) confirmed its engagement with OpenAI and other EU data protection authorities on the matter. OpenAI established its Dublin office in September, initially hiring for policy, legal, and privacy roles. While local hiring seems limited, the company’s strategic moves suggest an interest in obtaining main establishment status under the GDPR.