The Information Commissioner’s Office has issued Snap, Inc and Snap Group Limited with a preliminary enforcement notice over potential failure to properly assess the privacy risks posed by Snap’s generative AI chatbot “My AI”.
The preliminary notice sets out the steps which the ICO may require, subject to Snap’s representations about the preliminary notice. If a final enforcement notice were to be adopted, Snap may be required to stop processing data in connection with My AI. This means not offering the My AI product to UK users pending Snap carrying out an adequate risk assessment.
Snap launched the My AI feature for UK Snapchat+ subscribers in February 2023, with a roll out to its wider Snapchat user base in the UK in April 2023. The chatbot feature, powered by OpenAI’s GPT technology, marked the first example of generative AI embedded into a major messaging platform in the UK. As at May 2023 Snapchat had 21 million monthly active users in the UK.
The ICO’s investigation provisionally found the risk assessment Snap conducted before it launched My AI did not adequately assess the data protection risks posed by the generative AI technology, particularly to children. The assessment of data protection risk is particularly important in this context which involves the use of innovative technology and the processing of personal data of children aged 13 to 17.
The ICO’s findings in the notice are provisional. It emphasises that no conclusion should be drawn at this stage that there has, in fact, been any breach of data protection law or that an enforcement notice will ultimately be issued. The ICO says that it will carefully consider any representations from Snap before taking a final decision.
The issue of this preliminary enforcement notice follows an ICO reminder to companies developing or using generative AI that they should be considering their data protection obligations from the outset. The ICO has issued advice to developers and users of generative AI on the issues that they must consider and says that it will continue to scrutinise the compliance of products and services introduced to market.
