Google has delayed the planned launch of its generative AI chatbot, Bard, in the European Union, according to the Irish Data Protection Commission (DPC), the tech giant's main data protection authority in the region.
The development, first reported by politico.eu comes long after OpenAI released a free preview version (November 2022) of its rival chatbot, ChatGPT, without enforcing limits on where in the world Internet users can access it.
DPC Deputy Commissioner Graham Doyle said today that Google "recently" informed the authority of its intention to launch Bard in the EU "this week". However, he said he had not provided the regulator with adequate information ahead of schedule and a launch could now not take place on schedule.
“The DPC had not had any detailed briefing nor seen a DPIA (data protection impact assessment) or any supporting documentation so far," Doyle said in a statement. “Since then, he has urgently sought this information and has raised a number of additional data protection questions with Google for which he awaits an answer and therefore Bard will not be released this week.”
It is not known when the launch of Bard EU could take place. But it's worth noting that Europeans have already been able to freely use similar large language model (LLM) technology for months, since OpenAI didn't limit access to ChatGPT. Google's Bard is also trivially easy for users in the region to access if they use a VPN with a location set to the US or another market where the tool is available.
The DPC also did not provide details on specific concerns it raised with Google regarding Bard.
Other EU DPAs have already identified a number of data protection issues related to ChatGPT that may also be relevant in Google's case, including the claimed legal basis for processing people's data to train LLM AI models; compliance with transparency requirements built into regional privacy laws; and how developers address other problematic issues such as AI-generated misinformation (all these AI chatbots “distort”, as their creators say), as well as tackling child safety issues and providing EU users with access to data, rectification and / or deletion of rights.
“The matter is being looked into by the DPC and we will share information with our DPA colleagues as soon as we receive further responses to our questions,” was the only additional public comment Doyle offered.
In April, EU DPAs agreed to set up a working group, through the European Data Protection Board, to coordinate its implementation on ChatGPT. Therefore, presumably the DPC intends to incorporate any learning into that effort, where/if applicable.
OpenAI's chatbot, ChatGPT, quickly landed on the radar of several EU data protection authorities this spring and was forced to briefly suspend its service in Italy in April after an intervention by the local DPA, Guarantor. Unlike Google, OpenAI is not primarily based in any EU Member State, which means that all EU DPAs have the power to intervene under the bloc's General Data Protection Regulation (GDPR) if they have concerns; while only the Irish DPC is empowered to lead oversight of the Google chatbot.
DPC Commissioner Helen Dixon has previously criticized hasty bans on generative AI chatbots, starting in april for regulators to figure out how to apply EU bloc rules to the technology before rushing into bans.
It is therefore notable that there is now no strict ban from Ireland; just an unquantified degree of delay that is explicitly related to inadequate information provided by Google (plus some unspecified "data protection issues").
Unlike the case of the Guarantor With ChatGPT, Europeans are unaware of the nature of the concerns that the DPC is raising with Google. So there is no way to assess how substantial this intervention by the Irish regulator could be in this powerful generative AI tool. Or, indeed, if it could force Google to provide privacy disclosures comparable to OpenAI and more control for users, as happened with ChatGPT after the Italian job. Although investigations into compliance with the GPRD of the latter are still ongoing in several EU Member States.
Contacting Google for a response to the DPC's concerns, a company spokesperson issued the following statement: "We said in May that we wanted to make Bard more widely available, including in the European Union, and that we would do so responsibly, after collaborating with experts, regulators and legislators. As part of that process, we have been speaking with privacy regulators to address their questions and hear their feedback."
