OpenAI: New NOYB Complaint on AI Hallucinations

NOYB (None of Your Business) has filed a fresh GDPR complaint against OpenAI, this time targeting AI-generated hallucinations and their conflict with the GDPR's accuracy principle under Article 5(1)(d).

The Core Issue

Large language models can generate factually incorrect information about real people — so-called "hallucinations." Under GDPR, the accuracy principle requires that personal data be accurate and kept up to date. When an AI system generates false statements about identifiable individuals, this creates a direct tension with fundamental GDPR requirements.

Legal Analysis

The complaint raises several important legal questions:

• Is AI output "personal data"? — If an AI generates text about an identifiable person, the output likely qualifies as personal data processing
• Controller obligations — Can OpenAI rely on the argument that outputs are probabilistic and not assertions of fact?
• Right to rectification — Article 16 GDPR gives data subjects the right to have inaccurate data corrected. How does this work with probabilistic AI models?
• Technical limitations — Current LLM architecture makes it fundamentally difficult to guarantee factual accuracy

Implications for AI Providers

This complaint has implications beyond OpenAI. Any organization deploying AI systems that generate text about individuals should consider:

1. Risk assessment — evaluate hallucination risks in your AI deployment
2. Disclaimers and transparency — clearly communicate the probabilistic nature of AI outputs
3. Rectification procedures — implement processes for handling accuracy complaints
4. Monitoring — consider output filtering for known problematic generations

Intersection with the EU AI Act

The AI Act's transparency requirements (Article 52) complement GDPR's accuracy principle. AI systems that generate content must clearly indicate that the output is AI-generated. This creates a layered regulatory framework that AI providers must navigate carefully.

The outcome of this complaint will likely shape the future regulatory landscape for generative AI in Europe.