Poland's data regulator opened a formal case against OpenAI over ChatGPT

What happened

Cybersecurity researcher Łukasz Olejnik asked ChatGPT for information about himself and found it had generated inaccurate personal data. He requested a correction under GDPR - a right every data subject has - and found no working mechanism to exercise it with OpenAI.

Poland's data protection authority (UODO) opened a formal administrative proceeding against OpenAI, citing potential violations of several GDPR provisions covering transparency, lawful processing, and the right to rectification. The case highlighted a structural problem: large language models don't have an obvious way to correct or delete a specific fact about a specific person once it's embedded in the model.

The business problem

A system that generates or stores information about real people needs a working process for correcting it - "the model doesn't work that way" isn't a defense regulators accept.

What could have helped

• Any AI system touching personal data needs a real, working process for data-subject rights requests, not just a policy statement
• Design that process before deploying, not after a regulator asks for it
• Accuracy obligations apply to AI-generated data about people the same way they apply to any other record
• A vendor's own compliance gaps become the deploying company's exposure too

Where this points