12 April 2023
Corporate Newsletter – April 2023
ChatGPT – Privacy Point of View
Overview of ChatGPT
Chat Generative Pre-trained Transformer (“ChatGPT”) was launched in November 2022. ChatGPT is a language model driven by Artificial Intelligence (AI) built by OpenAI.
In a very short period of time, ChatGPT has gained popularity globally to the extent that it is now labelled as the fastest growing consumer application ever launched.
ChatGPT is being known of the ability to generate instant responses on a wide array of requests and topics, from drafting a legal document to answering technical questions. The language model allows ChatGPT to answer to questions and requests with natural language as if a real person is responding to the questions and requests.
We wish to share our brief overview of ChatGPT from the lense of Indonesia data privacy landscape.
Data privacy landscape in Indonesia
In mid October 2022, Indonesia enacted Law No. 27 of 2022 regarding Protection of Personal Data (“Indonesia PDPR”) which refreshes the regulatory landscape of data privacy in Indonesia. Chapter 4 of Indonesia PDPR provides the following rights for the data owner:
- Right to understand the utilisation of his/her data including the purpose of collection of his/her personal data.
- Right to complete, renew, and/or revise the mistake and/or the inaccuracy of his/her personal data.
- Right to gain access and copies to his/her personal data.
- Right to suspend or terminate the processing of his/her personal data including to erase and/or destroy his/her personal data.
- Right to withdraw his/her consent in relation to the personal data processing.
- Right to object to any decision derived from the automated processing of his/her personal data which lead to legal or material impact to such person.
- Right to postpone or limit the processing of his/her personal data.
- Right to sue and be compensated for any breach of his/her personal data processing.
- Right to obtain and/or utilise his/her personal data from the personal data controller in the format or structure commonly used or readable by electronic systems. This includes the right to share his/her personal data to other personal data controller.
Indonesia PDPR sets out the following activities which are included within the scope of processing personal data:
- Collecting;
- Processing and analysing;
- Storing;
- Fixing and Renewing;
- Showing, announcing, transferring, spreading, or disclosing; and/or
- Erasing or destroying.
Key obligations of personal data controller in processing the personal data include the obligations to obtain sufficient consent, narrow down the purpose of the processing, and to protect the personal data even after the processing.
Brief Overview of ChatGPT from Indonesia PDPR Lense and Regulator’s View
Since ChatGPT is driven by AI, it requires massive amounts of data to function and improve and this may include personal data which would trigger the requirement to obtain consent of the data owner. While certain personal data might have been published publicly on other platforms/websites, it is our view that the consent requirement is not waived.
In addition to the consent around personal data collection, the possibility of ChatGPT assessing third party data within the network would need to be considered. This may impose significant risk of third-party data breach.
It is important for ChatGPT to consider tailoring its privacy notice to include required information such as purpose of analysing, consent, rights of user, and mechanism of data processing on the platform.
To date, Indonesia government has not shared any specific view on ChatGPT, but we have seen recent views from other regulators. While ChatGPT is blocked in some countries, other countries (mainly EU countries) remain open to welcome ChatGP although thorough review is progressing by authorities such as Italian data-protection authority and Irish data protection agency.
In general, we do believe that Indonesia government carefully consider the risks brought by ChatGPT utilisation in balance of the ease and technology it could offer.
As MNP believes in regulator engagement as one of keys to achieve sustainable compliant approach, we do consider ChatGPT could provide opportunity for regulators (especially Indonesian authorities) to take a closer look into data privacy matters and to the extent possible might help in shaping authorities’ perspective on the technicalities of data processing.
Download PDF version here.
————-III————-
MURZAL & PARTNERS
For more information, please reach us at Murzal & Partners Law Firm to:
e-Mail: info@murzallawfirm.com
Telp: +62 21 29930869
Whatsapp: +62 81211122884
Linkedin: Murzal & Partners Law Firm
A member of World Law Alliance
Disclaimer:
The foregoing material is the property of MNP and may not be used by any other party without prior written consent. The information herein is of general nature and should not be treated as legal advice, nor shall it be relied upon by any party for any circumstance. Specific legal advice should be sought by interested parties to address their particular circumstances.
Any links contained in this document are for informational purposes and are available and relevant at time this publication is made. We provide no liability whatsoever in respect of any information or content in such links.
Read article Fixed Term Employment – Fixed Term Employment – Indonesian Government Recent Standing here.
