The UK data protection authority, ICO, issued a preliminary enforcement notice against Snapchat last Friday (October 6). It is suspected that the platform has not assessed the data protection risks of its artificial intelligence robot “My AI”.

“My AI” is Snapchat’s generative chatbot that launched this year. It runs on ChatGPT, which had previously raised data protection concerns in the European Union.

Snapchat’s chatbot is the first generative AI from a major messaging platform available in the UK.

According to one of its blog posts, the interim notice issued by the ICO in this case means that the Office of the Data Protection Commissioner could require the company to take action. If the enforcement notice is final, Snapchat could be forced to stop processing data related to My AI.

The Information Commissioner’s Office found that the risk assessment conducted by Snapchat before launching My AI “did not adequately assess the privacy risks posed by generative AI technology, particularly to children,” the blog post said.

“The preliminary findings of our investigation indicate a worrying failure by Snapchat to adequately identify and assess privacy risks to children and other users before launching My AI,” said UK Information Commissioner John Edwards.

However, a Snapchat spokesperson told Euractiv that they conducted a “robust legal and privacy review process” before launching “My AI.”

Compared to ChatGPT has “MiAI” “Additional security controls and improvements unique to Snapchat.”

For example, “My AI” takes into account the user’s age during the conversation. Anyone using Snapchat’s Family Center can see if their kids have communicated with “My AI.”

“All content shared with ‘My AI’ is saved until you delete it,” says Snapchat’s blog post.

“We have made it clear that companies must consider the risks associated with AI alongside the benefits. “Today’s provisional enforcement notice shows that we will take action to protect the data protection rights of UK consumers,” Edwards added last Friday. He may have been referring to one warning The June ICO asked companies using generative AI to comply with data protection obligations.

Snapchat told Euractiv that they are “closely reviewing the ICO’s preliminary decision. Like the ICO, we are committed to protecting the privacy of our users.”

“We will continue to work constructively with the ICO to ensure they agree with our risk assessment procedures.”

Although possible, the current notice does not mean that there has definitely been a breach of data protection law or that a final notice on data protection compliance will necessarily follow.

It is currently unknown whether the European Commission is planning a similar step. The Commission did not respond to a request from Euractiv until the article was published.

[Bearbeitet von Alice Taylor]