Lawfulness of the mass processing of publicly accessible online data to train large language models

With the unstoppable rise of large language models, the lawfulness of training them with publicly accessible online data started to be questioned. This article examines this question in the European Union data protection context by taking ChatGPT as a case study to understand whether a valid legal basis could be found for these processing activities.<br/><br/>This discussion has so far focused on Article 6(1)(f) GDPR and inquired whether and to what extent OpenAI has a legitimate interest in processing publicly accessible online data to train ChatGPT. However, this article suggests that Article 9 GDPR should apply to these processing activities considering the relevant judgments of the Court of Justice of the European Union. Accordingly, it examines the exceptions listed in Article 9(2) GDPR that OpenAI could rely on for these processing activities.<br/><br/>Consequently, the article argues that while it is practically not possible for OpenAI to obtain and demonstrate the explicit consent of data subjects whose publicly accessible personal data are used for training ChatGPT, the pool of personal data that are manifestly made public by data subjects and, therefore, could be used for training large language models appears limited. Considering that OpenAI or other developers currently do not mention that only this limited amount of personal data is being used for training their models, the article calls for clarification for all stakeholders.<br/><br/>Lastly, it speculates on a possible way forward and provides an overview of the responsibilities of all stakeholders involved to ensure that these models are developed responsibly.