AI chat bots and GDPR rights

gwynfil

I recently had a very bad customer service experience with an AI chat bot. I didn't consent to giving my details to this AI bot. I thought I was through to customer service, as it was given various real person like names. It seems now many companies are using their customers for this AI experiment, without considering the implication sof GDPR rights. The company does not know how far these AI in learning programs go. Anyone know what our rights are regarding being asked questions from what looks like a normal customer service process, (which would follow gdpr rules inside a company), but ends up an AI program in learning? I worry that in order to secure a refund, I may have given too much personal date to a bot in learning. Does it simply come under the legal responsibility of that company? Should we not be told that we are being engaged by AI? This was not a chat bot that has limited parameters and set answers, this was a learning program.

born_again

If you did not consent to giving your details. How did they get them? The fact you entered them is giving consent.. Makes no difference if it is a BOT or a human. 

AI bot follows companies GDPR polices. Why is a AI bot going to do anything different with your details?

Vitor

Submit a Subject Access Request (SAR) to the company, asking what data was collected, how it was used, and whether any automated decisions were made.

- without considering the implication sof GDPR rights - 

Possible, but unlikely. A company rolling out a 'bot' will have a dedicated system, not just a link to ChatGPT, Gemini etc.

gwynfil

Thanks for your reply. Great advice.

gwynfil

@born__again. What proof do you have that AI is conforming to GDPR for all companies?. Be great if you could site your source. Thanks. 

gwynfil

@born__again To add, if the AI was conforming to GDPR regulation, then why would I feel it overstepped that boundary and why should it be up to the customer to not answer and know the law, in order to access customer service for their consumer rights? I had no idea I had to know medical law when a surgeon operated on me for example.

elsien

If you gave the AI exactly the same information as you would give a human customer service operative I’m really unsure why you think any data protection boundary has been overstepped?
Your contact and the response will be recorded on their systems and subjected to protection law either way.

Have you read this?

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-do-we-ensure-lawfulness-in-ai/#:~:text=If%20you%20intend%20to%20use,protection%20because%20it%20is%20sensitive.

born_again

gwynfil said:

@born__again. What proof do you have that AI is conforming to GDPR for all companies?. Be great if you could site your source. Thanks. 

No source. Just know that our Ai is run by the company & falls within the GDPR regulations. Or it would not be used.

PHK

gwynfil said:

@born__again To add, if the AI was conforming to GDPR regulation, then why would I feel it overstepped that boundary and why should it be up to the customer to not answer and know the law, in order to access customer service for their consumer rights? I had no idea I had to know medical law when a surgeon operated on me for example.

This is illogical. 

Why would the AI be in training mode so that it is learning from your answers. How is it different to typing your information into a database by a human agent.  Why do you think that the data protection principles in the regulations are being broken. What AI regulations do you think there are.

DullGreyGuy

gwynfil said:

To add, if the AI was conforming to GDPR regulation, then why would I feel it overstepped that boundary and why should it be up to the customer to not answer and know the law, in order to access customer service for their consumer rights? I had no idea I had to know medical law when a surgeon operated on me for example.

Because people have wrong feelings all the time? 

It's not up to the customer to know GDPR or medical law however customers will sometimes question if things are being done within the law to both customer service teams and surgeons. In most cases the customer is wrong, occasionally they are right. 

If people want a third party assessment they have to give much more detail of why they feel the bot or the surgeon did wrong and not simply state that they feel they did. Obviously asking for a third party assessment on a public forum is going to result in responses from people that know nothing about "the law" and others who may have some or vast knowledge in the field. Depending on who you are etc you may be made to feel more comfortable with knowledgable replies even if they say you were mistaken or you may decide that you only like the answers that reinforce your beliefs even if they are coming from the resident conspiracy theorist 

Desmond_Hume

gwynfil said:

@born__again. What proof do you have that AI is conforming to GDPR for all companies?. Be great if you could site your source. Thanks. 

Just out of curiosity, what evidence would you accept as proof?