EU GDPR enforcement: ChatGPT cannot correct factually wrong personal data
Date: 2024-12
Affected: OpenAI ChatGPT — individuals whose personal data is hallucinated incorrectly
Attack vector: hallucination
Category: real-world
Severity: High

The Italian Garante (DPA) and Austrian noyb filed complaints demonstrating ChatGPT generates factually incorrect personal data (wrong birthdate, fabricated biographical details) and cannot correct or delete this information because OpenAI cannot identify which training data produced the hallucination. This created an impossible GDPR compliance situation: the right to rectification (Art. 16) and right to erasure (Art. 17) cannot be fulfilled for hallucinated personal data.

Impact: GDPR enforcement precedent; structural compliance challenge for all LLM providers; potential systematic fines under Art. 83

Mitigations:
Output monitoring for personal data generation with factual verification
Personal data opt-out mechanisms with verified identity
Training data documentation to enable lineage tracking for personal data
Architectural solutions: retrieval-based personal data rather than memorised

Architectural layers (MAESTRO):
label: Foundation Models
notes: Model generates incorrect personal data that cannot be traced to training source
role: origin
label: Data Operations
notes: No mechanism to identify or modify specific data learned from training
role: propagation
label: Security & Compliance
notes: Fundamental GDPR compliance gap — Art. 16/17 rights cannot be fulfilled
role: impact