OpenAI Sued to Stop a British Columbia Privacy Investigation Into ChatGPT and the Tumbler Ridge Shooter. The Lawsuit Is How the Public Learned It Existed

OpenAI has asked British Columbia's Supreme Court to quash an investigation by the province's Office of the Information and Privacy Commissioner into how ChatGPT used the personal information of the 18-year-old who killed eight people in Tumbler Ridge in February, CBC News reported.

The commissioner's office had not previously disclosed that it opened the investigation in June. It issued a public statement on Oct. 27, one day after OpenAI filed its petition, according to CBC.

Jesse Van Rootselaar died of a self-inflicted gunshot wound after killing six children and two adults on Feb. 10 in the small northeastern B.C. town; more than two dozen others were injured, CBC reported. Van Rootselaar allegedly used ChatGPT to help plan the attack. OpenAI has said the account was flagged internally for violent content and shut down, and later said it failed to notice a second account created after the first was disabled. Chief executive Sam Altman wrote a letter of apology to the community for failing to notify Canadian authorities, CBC reported.

In its statement, the commissioner's office said the investigation "is focused on whether the use of personal information (including as contained in and derived from prompts, uploaded content, usage data, interaction with other users) in the delivery of the service (i.e. ChatGPT responses) is one that a reasonable person would consider appropriate in the circumstances, including the potential for responses to influence behaviour," according to CBC.

The office has jurisdiction over organizations that collect, use and disclose the personal information of people in British Columbia under the province's Personal Information Protection Act, known as PIPA, and an organization needs legal authorization for those activities, the office said.

In its petition, OpenAI says the investigation "strays beyond the statutory and constitutional limits" of the commissioner's authority. "The OIPC has offered no coherent rationale for the investigation and, contrary to the Personal Information Protection Act (PIPA) … has identified no reasonable grounds to believe OpenAI breached that statute in connection with the Tumbler Ridge tragedy," the filing says, as quoted by CBC.

OpenAI also argues the issues were already examined in a three-year joint investigation by Canadian privacy regulators, including the B.C. office, which concluded in May. That investigation found OpenAI lacked accountability, did not follow Canadian law and launched ChatGPT without fully addressing known privacy issues, CBC reported. OpenAI says commitments it made after that investigation would put it in compliance with PIPA and that it should not face a "duplicative second investigation."

The company also challenges what it calls a "sweeping" production order issued by the commissioner in September as "overbroad and unnecessary." According to OpenAI, the order demands all of Van Rootselaar's chat logs, which have already been provided to law enforcement and the province, and all of the company's records about its decision not to refer the account to police, CBC reported.

The judicial review is pending, and no court date had been set, according to the commissioner's office's listing of judicial reviews.

The privacy case is one of several. In September, the B.C. government announced it was suing OpenAI in California over the company's failure to notify police of threats made on ChatGPT before the shooting, and the company and Altman face dozens of civil suits filed on behalf of victims, survivors and witnesses, CBC reported.

Those claims are allegations. No court has found OpenAI liable, and the existence of an investigation is not a finding of wrongdoing.

The case tests whether a privacy regulator can examine not only how an AI company stores and shares data, but how it uses a user's own inputs to generate responses that may influence that user's behavior. OpenAI's position is that such questions fall outside privacy law and were already addressed. The commissioner's position, as stated, is that the appropriateness of that use is squarely a privacy question.

Regulators in the United States are pressing related questions through other routes. In October, 40 U.S. attorneys general, including Massachusetts', asked a bankruptcy court to require protections for minors' chat data in any sale of Character.AI.

If the B.C. Supreme Court quashes the investigation or narrows the production order, the commissioner's office could appeal. If the court lets it proceed, OpenAI would have to produce the requested records, and the office would eventually issue findings, which in past investigations have been published as orders or reports.