British Columbia privacy watchdog investigates OpenAI use of Tumbler Ridge shooter’s personal information

OpenAI filed a petition this week to shut down the investigation.VANCOUVER, British Columbia (CN) — British Columbia’s privacy watchdog is investigating OpenAI to determine if the company mishandled the private information of the shooter in this year’s Tumbler Ridge mass shooting.The Office of the Information and Privacy Commissioner of B.C. never announced the investigation itself — instead, it came to light through a court petition brought by OpenAI OpCo LLC, the company behind the ChatGPT large language model.In legal filings, the company said it’s seeking an order to quash the investigation, which began on June 10. Barring that, the company wants the B.C. Supreme Court to find that an order to hand over documents is overly broad.The OIPC is a quasi-judicial body with the power to issue legally binding orders related to freedom-of-information requests and privacy matters.In an Oct. 27 press release, the watchdog said it was limiting what it would publicly disclose because of the case’s sensitive nature, but said it would provide “key information about the investigation to the general public, now that it is in the public domain.”The OIPC said it is investigating the use of personal information provided to ChatGPT through prompts, and how that personal information is used by the service, “including the potential for [ChatGPT’s] responses to influence behavior.”ChatGPT is the subject of a lawsuit by the family of one of the victims and another one in the U.S. by the B.C. government, after The Wall Street Journal reported OpenAI staff flagged the violent messages and wanted to contact police, but the company’s leadership shut them down.Instead, OpenAI banned the account, and Jesse Van Rootselaar went on to make another account, with which she continued her violent messages, including planning shooting scenarios.Van Rootselaar committed the mass shooting on Feb. 10, and in its petition, OpenAI said it voluntarily told police it had information about her accounts.“In response to legal process from the RCMP, OpenAI then produced Ms. Van Rootselaar’s chat logs. OpenAI has cooperated with and continues to cooperate with law enforcement agencies in their investigation into the Tumbler Ridge tragedy,” OpenAI said in its petition.Two weeks later, the OIPC contacted OpenAI seeking information about how Van Rootselaar’s violent messages were flagged for review and the company’s processes for considering disclosing the information to authorities, according to OpenAI.Since the company wasn’t under investigation related to the Tumbler Ridge shooting by the OIPC at the time, OpenAI said it turned down the information request.At the time, the OIPC was doing a joint three-year investigation into OpenAI alongside its counterparts in other provinces, including Alberta and Quebec, and the national Office of the Privacy Commissioner.The findings of that investigation were made public in May: The company had broken federal and provincial privacy laws, including over-collecting personal information, a lack of consent and transparency, inaccuracies related to personal information, people’s ability to access and correct that personal information and a “general lack of accountability,” according to the OIPC in a May 6 press release.The OIPC also noted OpenAI had begun taking steps to address the issues.After that investigation, OpenAI claimed it shouldn’t “immediately be faced with a duplicative second investigation.”“In furtherance of the new investigation, the OIPC has issued a sweeping order, both requiring extensive document production and compelling an OpenAI representative to answer questions,” OpenAI argued.“The order is overbroad and unnecessary: it requires production of documents and information that are irrelevant to the investigation and that far exceed the OIPC’s statutory mandate.”That includes a demand for all of Van Rootselaar’s chat logs, which OpenAI said it had already provided to police, and all of the company’s records related to its decision about referring the shooter’s account to police.That “far exceeds” the OIPC’s scope of authority under the Personal Information Protection Act (PIPA), it violates the Canadian Charter of Rights and Freedoms, and it “offends the OIPC’s own privacy obligations,” OpenAI argued.The company said the OIPC hasn’t offered a coherent rationale for investigating whether OpenAI broke PIPA in relation to the Tumbler Ridge shooting.“No such grounds exist. Indeed, the province’s U.S. lawsuit alleges the opposite: that OpenAI should have made greater use of personal information by providing it to law enforcement eight months before the tragedy,” OpenAI said.The OIPC declined to comment beyond its press release. OpenAI’s lawyers didn’t respond to a request for comment before publication.Courthouse News reporter Dustin Godfrey is based in Vancouver, Canada.Subscribe to our free newslettersOur weekly newsletter Closing Arguments offers the latest about ongoing trials, major litigation and rulings in courthouses around the U.S. and the world, while the monthly Under the Lights dishes the legal dirt from Hollywood, sports, Big Tech and the arts.Additional Reads