Copyright and data protection at Chat GPT

As of April 11, 2024, ChatGPT is on everyone's lips. What do companies need to consider regarding copyright and data protection when using this AI tool?

There's general confusion surrounding the use of GPT services. It depends on the company's location and the country where the service is offered.(just saying, this can be tricky if you deploy your application in multiple regions on AWS) Currently, there are no global regulations requiring labeling of AI-generated content or censorship of language models. However, some AI startups might self-impose restrictions.

A notable exception is the EU AI Act, which launched on January 1st, 2024. We might see companies migrate out of the EU due to this. In a follow-up piece, I'll delve into the additional costs and regulations companies need to consider. The most interesting question will be how big tech firms adapt to the new EU regulations. Will they simply stop offering services within the EU? It remains to be seen.

As someone who develops AI solutions daily (and is no longer located in the EU), here's some common sense to share:

Rule No.1 : DO NOT HOST ANYTHING WITHIN THE EU.

Question: Who is considered the author when companies use Chat GPT - and use the tool to write a text for the company website, for example?

Answer: Only humans can create copyrighted works. Therefore, there is usually no author for texts written by Chat GPT. The first relevant judgments from the USA also point in this direction. However, it is currently being discussed whether the way in which instructions are given to artificial intelligence (AI) could create copyright - similar to the technical process of a photograph in which a person presses the shutter button and then becomes the author of it Photo applies. If chat GPT texts are post-edited by a person, they could potentially acquire copyright to the text. This would then also apply to companies. However, the legal questions in this context have not yet been finally clarified.

Question: Do I need to mark or let others know that the created text or content is done with AI?

Answer: In general, no. However, there are future plans being developed that will make it easier for companies to detect real human work versus automatically created work (like with Meta). On your own website, you can do whatever you like, even translate the text into Vulcan language! Just be sure to read the rules when using public portals.

Question: Can companies unknowingly infringe copyright when using Chat GPT?

Answer: Yes. The problem is that it is not clear which sources Chat GPT uses to create content. According to the Copyright Act, the adoption of parts of other people's works or their transformation is generally not permitted without the consent of the author. However, it is entirely possible that content from Chat GPT represent only minimally modified versions of another content or that essential elements of the original content have even been adopted identically. Anyone who reproduces or publishes such a text or images is committing a copyright infringement - even if they do so without malicious intent. In such a case, the author of the original can assert claims for injunctive relief, damages and removal. For example, if you ask Chat GPT to write an advertising text using the setting of the Lord of the Ring novels, the author Tolkin's copyrights are likely to be violated. However, copyright infringements are rare for other texts, as Chat GPT uses its “own” formulations and these are then not protected.

Question: What consequences do employees face if they reveal sensitive company data on Chat GPT?

Answer: Theoretically, the company where the employee works could be confronted with claims for damages or fines for data protection violations. In fact, however, this will usually fail because no one can find out that personal data of a third party has been entered into Chat GPT. In the event of a breach of confidentiality obligations, the employee and possibly also the company are threatened with claims for damages or contractual penalties. In extreme cases, the behavior can even lead to criminal liability for those involved - depending on whether contractual or statutory confidentiality regulations are violated and whether this is done negligently or intentionally. If trade secrets of your own company are entered, they lose their qualification as trade secrets and may henceforth be used by third parties. The employee may face consequences under labor law.

Question: Are companies allowed to enter personal data into Chat GPT without being asked?

Answer: No. A company is bound to the regulations of the General Data Protection Regulation (GDPR). This means: No personal data from third parties such as names or addresses may be entered into Chat GPT without the consent of those affected. Since Chat GPT stores and uses the data entered, the terms of use also expressly require that the user comply with the GDPR when entering personal data. In addition, entering operational and business secrets can constitute a violation of legal or contractual confidentiality obligations. So: do not enter sensitive data in Chat GPT!

Question: Are there legal consequences if a company uses information from a chat GPT text and unknowingly spreads false information?

Answer: Spreading false information is not illegal per se. The situation is different when untrue facts are spread via third parties. In this case, the affected persons or competing companies are entitled to claims for injunctive relief and compensation.