Facts
On 20 and 21 March 2023 a bug in an open-source caching component caused ChatGPT Plus to show some users other subscribers' names, email addresses, payment addresses, the last four digits of their credit card numbers and card expiry dates. Based on Korean IP addresses, 687 Korean users were affected. OpenAI OpCo, LLC did not notify the Personal Information Protection Commission (PIPC) within 24 hours of becoming aware of the leak. The PIPC opened an investigation that also covered the company's security measures and, more broadly, the duties a foreign generative AI provider owes to users in Korea.
Question
The PIPC considered whether a foreign generative AI company serving users in Korea was bound by the breach-notification duty in the Personal Information Protection Act (PIPA) and whether it had breached that duty. It also assessed whether the leak resulted from a failure to take the technical and administrative safeguards the Act requires, which would have amounted to a separate breach of the duty to take security measures. The answers to these two questions would determine the type and weight of any sanction.
Decision
At its plenary meeting on 26 July 2023 the PIPC held that OpenAI had breached the notification duty by failing to report within 24 hours of becoming aware of the leak, and imposed an administrative fine of KRW 3.6 million. It did not impose a sanction for breach of the duty to take security measures. It also issued improvement recommendations asking the company to put measures in place to prevent a recurrence, to comply with Korean data protection law and to cooperate actively with the PIPC's preliminary inspection. The PIPC announced that it would carry out preliminary inspections of major domestic and foreign AI services, ChatGPT included.
Why it matters
Although the amount was small, the decision made clear that foreign generative AI providers serving Korean users are subject to local breach-notification rules. It also combined a sanction with softer tools, namely improvement recommendations and a programme of preliminary inspections, which the PIPC went on to use in its later oversight of generative AI services.