ICO Issues Preliminary Enforcement Notice to Snap Over Data Protection Risks Posed by Generative AI Chatbot 'My AI''

The Information Commissioner’s Office (ICO) has issued a preliminary enforcement notice to Snap, Inc and Snap Group Limited (Snap), the parent company of Snapchat, after an investigation revealed that risks posed by their generative AI chatbot ‘My AI’ were not adequately assessed prior to its launch. The potential enforcement notice sets out requirements that could be issued if a final enforcement notice is adopted, which includes the cessation of data processing related to 'My AI' in the UK pending a proper risk assessment. The chatbot feature, powered by OpenAI’s GPT technology, marked the first example of generative AI being embedded into a major messaging platform in the UK. As of May 2023, Snapchat had 21 million monthly active users in the UK – 13 to 17 year old children forming a large portion of that.The ICO’s investigation provisionally found that the risk assessment conducted was inadequate for this innovative technology and data processing, and “a worrying failure” was observed. The UK consumers' privacy rights require any organisations using AI to adequately identify and assess potential privacy risks. If the findings are validated, then a final enforcement notice may be issued to Snap requiring them to cease all data processing related with ‘My AI’ pending a thorough risk assessment.