Is training an AI on the internet processing personal information? There is an article on El Reg where the author asks ChatGPT about themselves, and they get back some information. If this data acquisition and dissemination process was being performed specifically by a company it would clearly be a situation where the GDPR applies, and the company would have certain responsibilities. However it seems probable that the actual design and implementation of ChatGPT was a bit higher level than that. Does the GDPR apply to ChatGPT and the other chatbots that are in development around the world that are trained by reading the internet?
Yes ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; ChatGPT, or more precisely the owner of Chat GPT, certainly does all the things in bold and probably some of the others as well.
Your data is not anonymous since from the picture of the face the individual can be identified. It would be anonymous, if the face was blurred and other possible identifiable information was removed. Of course, that would defeat your purpose. Please note that, in any case, Anonymization Techniques are, themselves, a type of personal data processing that requires a legal ground, and achieving real anonymization is not a trivial matter (see Article 29 Working Party's opinion 0829/14/EN WP216 on the subject). 1. The face of a person includes biometric information, which is defined in article 4 (14) among other types of personal information regulated by the GDPR as: "personal data resulting from specific technical processing relating to the physical, physio­logical or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data". A facial recognition software's purpose is exactly to perform a specific technical processing based on the facial features of the persons, to achieve a unique identification of a person based on these biometric features. Article 9 of the GDPR includes biometric data among the types of prohibited processing, unless one of the exceptions in § 2 applies. There are 10 types of exceptions among which: consent of the person, employment context, personal data made public by the person, scientific or historical research,... (each exception having its own conditions). You should check that you comply with one of these exceptions stated in article 9 § 2, if your application is about using facial images for unique identification of a person based on these biometric features. 2. In turn, if your processing is not about unique identification of a person based on these biometric features, but only about emotions recognition (which you briefly mentioned at the beginning of your post), it could be considered as not falling under the requirements of Article 9. That would still be a processing of personal information, but it would fall under the normal article 6 requirements.
Let's assume that I created a mobile app for iPhone that is tracking rides on a bike [...] So the app is processing that data in the way I programmed it but I as a person do not have access to that data. I assume in such case I am not the data controller according to GDPR because I do not have access to that data is that correct? Yes, as far as I can see that is correct. The GDPR defines a data controller as someone who "determines the purposes and means of the processing of personal data" - you just provide a tool, you don't control for what purposes your customers use their ride data. This is also discussed in this question: How does the GDPR apply to software developed by one company and used by another? What if additionally to that I will program my app for example in such way that it will sometimes send current GPS coordinate to an online service controlled by external company such as Apple [...] But still my app would send this data directly to Apple server so I will still not have any access to that data. Does this change anything and does GDPR now apply to me? Yes, and yes. In that case, you are telling Apple to process data for you, so you would become the data controller (because you "determine[s] the purposes and means of the processing of personal data"), and Apple is a data processor for you. That means also the usual mechanisms kick in - you need to inform your users about this processing, you need to make sure Apple plays by the rules, etc. etc. I also do not know if Apple save this request on their servers or if they just automatically convert received gps coordinates to a name and return the answer without saving the request. This is exactly the kind of situation the GDPR is meant to address. Under GDPR, saying "I do not know what X does with the data" is not an option. This is something many companies tried in the past, that is why GDPR explicitly assigns responsibility to the data controller (i.e., you). As explained in a EU document, What is a data controller or a data processor?: The duties of the processor towards the controller must be specified in a contract or another legal act. For example, the contract must indicate what happens to the personal data once the contract is terminated. A typical activity of processors is offering IT solutions, including cloud storage. [...] So, no, you cannot just say "I do not know if Apple saves this request". Instead, you must make a contract with Apple which says whether (and how, and for how long...) they save the request, and you must inform your users about this in your privacy policy. And if Apple refuse to make such a contract with you, you must find a different company to work with.
The territorial scope of the GDPR is defined in Article 3. It covers "personal data of data subjects who are in the Union", whether they are EU citizens or not. So to answer your questions: 1) are EU users, but moved to USA a few years ago, and signed-up on my website? They are not in the EU, so are not covered. You don't need to know if someone is an EU citizen, just if they are currently in the EU. 2) went for holidays in USA, signed-up on my website, and then came back to EU? (note - potentially skipped any Consent questions at sign-up, because IP was from USA) If someone moves into the EU while using your service then they fall under the GDPR for the time they are in the EU. If their home address is in the EU then that is covered, and monitoring of their behaviour while in the EU is also covered. Your other two questions are about VPNs. If a VPN is used to evade IP address geolocation and you have no other clue about where someone is then you can't be blamed for not knowing where they are (although I'm not aware of any actual case law on this topic). But if someone with a USA IP address gives a home address in the EU then you should probably treat them as being in the EU to be on the safe side. Basically, if you don’t know if they are in the EU or not, you should treat them as if they were.
In my opinion, this should be enough. The GDPR regulation is general - it does not attempt to address these issues directly, precisely for the reasons we see here: You can never predict how the technology will develop. When interpreting the GDPR, we must keep the intended goal in mind. What is the purpose of the "right to erasure"? To prevent anyone from further processing the personal data. If you "crypto-shred" it, it can't be processed anymore, not even theoretically. The encryptec file cannot be used to identify the subject, therefore it is not even personal data anymore. In case it can be decrypted in the future... Well, that is just a speculation. The courts can go to great lengths in interpreting what personal data is (dynamic IP address is considered personal data, since it can be linked to a person by the police with a court order), but i am pretty sure that "it can be theoretically possible in some distant future" is beyond the limit. As for the second question, I am not aware of any applicable case-law, but I guess that current security and technological standards will be used to assess the delay. You have a right to protect your data, the subject has a right to erase them. Those rights must be balanced, neither fully overrules the other. The delay should be short enough so the right to erasure is effective, and it should not extremely long compared to other (economically viable) backup solutions available, in line with current industrial standards.
The GDPR only mentions cookies once (Recital 30). (It says that cookies are personal data if they are associated with natural persons.) As far as cookies go, nothing has really changed since 2002, and the exception granted in the EU cookie directive Article 5(3) is still valid: This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service. If your site complies with the 2002 directive today, it will be GDPR compliant. All the "EU Cookie Law Compliance" plugins I've checked out let the admin configure the site to comply with the 2002 directive, and most let you choose between implicit consent (which is, and still will be, OK if you or third party services do not use cookies for profiling or to collect personal data), soft consent, or hard consent. The latter is however mandatory if you or third party services use cookies to for profiling or to collect personal data. However, if at least one of your cookies are used for profiling (and if you use Google analytics, you are), or if they are used to collect personal data, the exception from explicit consent quoted above does not apply and implicit consent (i.e.: "continued use of the site amounts to implicit consent to the use of cookies") has never been legal for the site. So while nothing has changed since 2002, there is a lot of misinformation about cookies floating on the Internet, and a lot of sites have their cookie banners set up wrong. You may want to do a new cookie audit for your site to verify that you comply with existing legislation.
No GDPR applies to people (not just citizens) who are in the EU. It has no applicability if both parties are not in the EU.
Yes, there would still be an obligation to comply with erasure requests – if the data subject can be identified, and if the GDPR applies. This is a case for Art 11 GDPR: processing which does not require identification. The pastebin site is not required to collect identifying info just in order to facilitate later deletion. If the site is unable to identify the data subjects, then the data subject rights (like access, rectification, erasure, restriction, or data portability) do not apply. Other rights like the right to be informed and the right to object do remain, though. But if the data subject provides sufficient additional information that makes it possible to identify their records, then the data subject rights apply again. In practice, this is likely going to mean that anyone with access to a paste will be able to request deletion, since the site would have no ability to verify the identity of the data subject beyond the information in the paste. None of this absolves the site from implementing appropriate technical and organizational measures to ensure the security of this data. Even though the pastes might not be directly identifying, they are personal data and are far from anonymous. Common practices like numbering pastes with a sequential ID or showing recent pastes on a homepage have to be viewed critically. My go-to recommendation is to assign a cryptographically random UUIDv4 ID to the post, so that it is practically impossible for anyone to find the paste unless they were given a link by the uploader. Your idea to delete pastes after a fairly short retention period is also good. This helps with security, and it is in line with the GDPR's data minimization and storage limitation principles: data may only be kept as long as necessary for its purpose. On the other hand, quick deletion might not be in line with the purpose of these pastes – it all depends on context. You mention that this is an US-based site. If so, there's a question whether GDPR would even apply. GDPR will apply per Art 3(2) if the data controller is offering its services to people who are in Europe. Here, “offering” does not mean mere availability of the website, but that the data controller intends the service to be used by such people, in particular if the service is somehow targeted or marketed to such people.