The Information Commissioner’s Office (ICO) has stated that it has concluded its investigation into Snap, Inc’s launch of the ‘My AI’ chatbot.

In June 2023, the ICO opened an investigation into ‘My AI’ following concerns that Snap had not met its legal obligation to adequately assess the data protection risks posed by the new chatbot. Snap launched ‘My AI’ for its premium Snapchat+ subscribers on 27 February 2023, before it was subsequently made available to all Snapchat users on 19 April 2023.

The investigation led to the ICO issuing a Preliminary Enforcement Notice to Snap on 6 October 2023.

The ICO’s investigation resulted in Snap taking ‘significant steps’ to carry out a more thorough review of the risks posed by ‘My AI’ and demonstrate to the ICO that it had implemented appropriate mitigations.

As such, the organisation has now said that it is satisfied that Snap has now undertaken a risk assessment relating to ‘My AI’ that is compliant with data protection law. The regulatory body will continue to monitor the rollout of ‘My AI’ and how emerging risks are addressed.

Stephen Almond, ICO executive director of regulatory risk, said: “Our investigation into ‘My AI’ should act as a warning shot for industry.

“Organisations developing or using generative AI must consider data protection from the outset, including rigorously assessing and mitigating risks to people’s rights and freedoms before bringing products to market.

Recommended reading

• Google to Release New Privacy Tools to Remove Personal Info From Search
• Third-Party Cookie Crumbles as Google Chrome Tests Phase Out
• New DLT Financial Sandbox Launched By UK Regulators

“We will continue to monitor organisations’ risk assessments and use the full range of our enforcement powers – including fines – to protect the public from harm.”

Generative AI remains a key priority for the ICO, and the regulator has launched a series of consultations on how aspects of data protection law should apply to the development and use of generative AI models, building on its guidance on data protection and AI.

“We’re pleased the ICO has accepted that we put in place appropriate measures to protect our community when using My AI,” said a Snapchat spokesperson.

They added: “While we carefully assessed the risks posed by My AI, we accept our assessment could have been more clearly documented and have made changes to our global procedures to reflect the ICO’s constructive feedback.

“We welcome the ICO’s conclusion that our risk assessment is fully compliant with UK data protection laws and look forward to continuing our constructive partnership.”