Blog

OpenAI vs ANI: A Data Protection Perspective

In August 2023, India enacted the Digital Data Protection Act, 2023, dedicated to protecting privacy and personal data of citizens. It signifies that the country is preparing for a future where technology plays a major role in all aspects of life. Though the Act introduces various obligations on companies and individuals that process this data, it has not yet been enacted, leaving citizens and companies in a limbo. They have been informed of rights and obligations that currently have no legal force behind them.

This is proving to be detrimental in the case filed against OpenAI in the Delhi High Court. ANI, an Indian news agency has filed a case against OpenAI for using its data to train its Large Language Models (LLMs)[1]. ANI also claims that ChatGPT credited it with fabricated news stories to it, leading to reputational damage. The storage and use of such data allegedly resulted in ChatGPT reproducing ANI’s data almost verbatim upon certain prompts. ANI alleged that OpenAI was generating profits on the basis of its copyrighted data, and could not take the defence of ‘fair use’ under Section 52 of the Copyright Act[2].

The case for copyright infringement is currently under consideration by the Delhi High Court. At present, copyright infringement remains the most effective argument against non-consensual use of ANI’s data, but it is imperative to understand whether any other defenses exist. Considering the rising growth of generative AI and the fact that such models use data available on the Internet for their training, it is essential to understand whether the DPDP Act, once enacted, can act as a shield against such conduct.

THE DATA PROTECTION ANGLE

OpenAI’s ‘Data Processing addendum’[3], in context of responding to consumer prompts, places itself as a ‘Data Processor’, making the Consumer a ‘Data Controller’ (‘Data Fiduciary’ under DPDP Act). This is not the scenario in the present case where OpenAI acts as a ‘Data Fiduciary’[4] as it ‘determines the purpose and means of processing of personal data’ of ANI and other citizens’. While ANI cannot qualify as a ‘Data Principal’[5] under the Act, any individual to whom the used data relates can qualify, and thus object to its use.

Currently, this addendum only recognizes European and US privacy laws under its purview of ‘Data Protection Laws’. The DPDP Act is not currently included. However, Section 3 of the DPDP Act specifies that it also applies to “processing of digital personal data outside the territory of India”[6], if it relates to offering of goods and services within the country. In the case of chatbots like ChatGPT, data used for training is collected, recorded, stored and used, bringing it well within the purview of ‘processing’[7] under the DPDP Act. It is also retrieved and shared when replies are generated to customer prompts, offering a service in India. Therefore, the DPDP Act applies to data used by OpenAI for any purpose.

Open AI
[Image Sources: Shutterstock]

The Right to Erasure, enshrined in Section 12 of the DPDP Act, applies to OpenAI. Under this provision, even previously given consent is irrelevant once the Data Principal requests to have it removed. In cases of copyrighted content being used, as with ANI, consent was never taken in the first place. Data already available online was used to train models without prior intimation[8]. Despite this, when asked to remove content by the Delhi High Court, OpenAI refused, citing conflict with its obligations under US law, which requires it to store data used for training.[9] But use of data without consent since the beginning, relating to any Data Principal, is illegal ab initio under the DPDP Act.

ACTION AGAINST OPENAI ACROSS THE GLOBE

OpenAI has also been found guilty of similar conduct in other jurisdictions, with allegations ranging from unauthorized use and reproduction of copyrighted data to failure in taking consent and providing necessary information to users. In New York, the case of The New York Times v OpenAI[10] was filed against the company in 2023 for using its articles to train AI models, allowing bypass of paywall and harming the news agency’s business. Two ongoing cases in California, Andersen v. Stability AI[11] and Kadrey v. Meta Platforms[12], are claims of copyright infringement and unjust enrichment by visual artists whose works are being used by, and reproduced to some extent, by generative AI.

A similar case has been filed in the UK against StabilityAI, where millions of copyright images were illegally collected and used by the company to train its model. The outputs generated through these models also allegedly use the trademark of the Plaintiff.[13] In Canada, several Canadian news companies have filed a case against OpenAI for ‘scraping’ their copyrighted data[14]. The facts of this case are quite similar to the ANI case, and emphasize the growing conflict between generative AI and commercial content creators (such as news agencies).

In Italy, the Italian data protection authority has also taken action against OpenAI, for not informing it of a data breach in 2023, not providing age verification mechanisms, and not maintaining transparency about its actions[15]. This highlights the potential conflicts with DPDP Act that might presently e occurring in India, and underlines the need for enforcement of the Act.

DPDPA and GDPR: A COMPARITIVE ANALYSIS

India’s DPDP Act is largely modelled upon the EU’S GDPR, which is included within OpenAI’s recognized ‘Data Privacy Laws’. Thus, to understand the future of data use by generative AI upon DPDP Act’s enforcement, it becomes essential to understand the distinctions and similarities between the two legislations. The Right to Erasure, mentioned above, is common under both Acts.

Under both legislations, Data Fiduciaries/ Controllers are required to issue notice to Data Principals/ Subjects. Under GDPR, this includes detailed information related to data processing such as details of DPO, recipients of data, retention period, purpose of processing, etc.[16] Under the DPDP Act, the requirements are a little broader, extending to their rights, and how to exercise these rights[17].

Both the Acts have a similar stance on jurisdiction, extending it to cases related to offering of goods and services within the territory. They differ, however, in context of the liability imposed upon the Data Processor. Under GDPR, the processor is separately liable from the controller[18]. However, under the DPDP Act, the Data Fiduciary is responsible for the Data Processor with whom it shares data.[19] Moreover, Data Fiduciaries under the DPDP Act are required to establish a mechanism to resolve grievance of Data Principals[20], while there is no such provision under GDPR.

Considering the extensive protection granting to personal data under the DPDP Act and its relevance in the current global scenario, it is essential, now more than ever, that the Act be enforced in India. Expanding use of AI for various purposes across the globe, and its commercialization by companies, means that there is a threat to data and creations of individuals, copyrighted or not. Indian laws must be prepared to combat these increasing challenges, with a need for strict implementation and harsh penalties for any misconduct. The creation of the draft DPDP Rules, 2025 is a strong step in this direction, with enforcement more and more crucial with increasing technologies.

Author: Rithika Sahni, in case of any queries please contact/write back to us via email to [email protected] or at Khurana & Khurana, Advocates and IP Attorney.

REFERENCES

  1. Shruti Kakkar,‘Infringement does occur’: ANI on OpenAI using its data for training, Hindustan Times (2025), https://www.hindustantimes.com/india-news/infringement-does-occur-ani-on-openai-using-its-data-for-training-101741637235991.html (last visited Mar 13, 2025).
  2. Sharveya Parasnis, ANI vs OpenAI: Is Storing Copyrighted Content An Infringement?, MEDIANAMA (Mar. 12, 2025), https://www.medianama.com/2025/03/223-ani-vs-openai-does-storing-copyrighted-content-equal-copyright-infringement/ (last visited Mar 13, 2025).
  3. Data processing addendum, OpenAI, https://openai.com/policies/data-processing-addendum/ (last visited Mar 13, 2025).
  4. Digital Personal Data Protection Act, 2023, No. 22 of 2023, Acts of Parliament (India).
  5. Jyoti Panday Jain Saumya, The Significance of ANI versus OpenAI, Internet Governance Project (Dec. 16, 2024), https://www.internetgovernance.org/2024/12/16/the-significance-of-ani-versus-openai/ (last visited Mar 13, 2025).
  6. Arpan Chaturvedi et al., Exclusive: OpenAI Tells India Court ChatGPT Data Removal Will Breach US Legal Obligations, REUTERS, Jan. 23, 2025, https://www.reuters.com/technology/artificial-intelligence/openai-tells-india-court-chatgpt-data-removal-will-breach-us-legal-obligations-2025-01-22/ (last visited Mar 13, 2025).
  7. Audrey Pope, NYT v. OpenAI: The Times’s About-Face, Harvard Law Review, https://harvardlawreview.org/blog/2024/04/nyt-v-openai-the-timess-about-face (last visited Mar 13, 2025).
  8. Zach Schor JD ’26, Andersen v. Stability AI: The Landmark Case Unpacking the Copyright Risks of AI Image Generators, NYU Journal of Intellectual Property & Entertainment Law (Dec. 2, 2024), https://jipel.law.nyu.edu/andersen-v-stability-ai-the-landmark-case-unpacking-the-copyright-risks-of-ai-image-generators/ (last visited Mar 13, 2025).
  9. Kadrey v. Meta Platforms, Inc., 3:23-cv-03417, (N.D. Cal.).
  10. Aklovya Panwar, Generative AI and Copyright Issues Globally: ANI Media v OpenAI | TechPolicy.Press, Tech Policy Press (2025), https://techpolicy.press/generative-ai-and-copyright-issues-globally-ani-media-v-openai (last visited Mar 13, 2025).
  11. Lisa R. Lifshitz, Laura Crimi, Scraping the Surface: OpenAI Sued for Data Scraping in Canada, Business Law Today (2025), https://businesslawtoday.org/2025/02/scraping-the-surface-openai-sued-for-data-scraping-in-canada/ (last visited Mar 13, 2025).
  12. My Mattsson, Data Privacy Violation: OpenAI/ChatGPT to Pay a Fine of 15 Million Euros, Rouse, https://rouse.com/insights/news/2025/data-privacy-violation-openai-chatgpt-to-pay-a-fine-of-15-million-euros/ (last visited Mar 13, 2025).
  13. General Data Protection Regulation, Regulation (EU) 2016/679 (European Union).
  14. Fair Use vs. Infringement: Understanding The Lines In The Digital Age, https://www.mondaq.com/india/copyright/1479386/fair-use-vs-infringement-understanding-the-lines-in-the-digital-age (last visited Mar 13, 2025).
  15. Elvira Pollina & Alvise Armellini, Italy fines OpenAI over ChatGPT privacy rules breach, Reuters, Dec. 20, 2024, https://www.reuters.com/technology/italy-fines-openai-15-million-euros-over-privacy-rules-breach-2024-12-20/ (last visited Mar 13, 2025).
  16. Essenese Obhan, et al, Battle over whether information public or private, India Business Law Journal, https://law.asia/copyright-infringement-ai/ (last visited Mar 13, 2025).

[1] Shruti Kakkar,‘Infringement does occur’: ANI on OpenAI using its data for training, Hindustan Times (2025), https://www.hindustantimes.com/india-news/infringement-does-occur-ani-on-openai-using-its-data-for-training-101741637235991.html (last visited Mar 13, 2025).

[2] Sharveya Parasnis, ANI vs OpenAI: Is Storing Copyrighted Content An Infringement?, MEDIANAMA (Mar. 12, 2025), https://www.medianama.com/2025/03/223-ani-vs-openai-does-storing-copyrighted-content-equal-copyright-infringement/ (last visited Mar 13, 2025).

[3] Data processing addendum, OpenAI, https://openai.com/policies/data-processing-addendum/ (last visited Mar 13, 2025).

[4] Section 2(i), Digital Personal Data Protection Act, 2023, No. 22 of 2023, Acts of Parliament (India).

[5] Section 2(j), Digital Personal Data Protection Act, 2023, No. 22 of 2023, Acts of Parliament (India).

[6] Section 3(b), Digital Personal Data Protection Act, 2023, No. 22 of 2023, Acts of Parliament (India).

[7] Section 2(x), Digital Personal Data Protection Act, 2023, No. 22 of 2023, Acts of Parliament (India).

[8] Jyoti Panday Jain Saumya, The Significance of ANI versus OpenAI, Internet Governance Project (Dec. 16, 2024), https://www.internetgovernance.org/2024/12/16/the-significance-of-ani-versus-openai/ (last visited Mar 13, 2025).

[9] Arpan Chaturvedi et al., Exclusive: OpenAI Tells India Court ChatGPT Data Removal Will Breach US Legal Obligations, Reuters, Jan. 23, 2025, https://www.reuters.com/technology/artificial-intelligence/openai-tells-india-court-chatgpt-data-removal-will-breach-us-legal-obligations-2025-01-22/ (last visited Mar 13, 2025).

[10]Audrey Pope, NYT v. OpenAI: The Times’s About-Face, Harvard Law Review, https://harvardlawreview.org/blog/2024/04/nyt-v-openai-the-timess-about-face  (last visited Mar 13, 2025).

[11] Zach Schor JD ’26, Andersen v. Stability AI: The Landmark Case Unpacking the Copyright Risks of AI Image Generators, NYU Journal of Intellectual Property & Entertainment Law (Dec. 2, 2024), https://jipel.law.nyu.edu/andersen-v-stability-ai-the-landmark-case-unpacking-the-copyright-risks-of-ai-image-generators/ (last visited Mar 13, 2025).

[12] Kadrey v. Meta Platforms, Inc., 3:23-cv-03417, (N.D. Cal.).

[13] Aklovya Panwar, Generative AI and Copyright Issues Globally: ANI Media v OpenAI | TechPolicy.Press, Tech Policy Press (2025), https://techpolicy.press/generative-ai-and-copyright-issues-globally-ani-media-v-openai (last visited Mar 13, 2025).

[14] Lisa R. Lifshitz, Laura Crimi, Scraping the Surface: OpenAI Sued for Data Scraping in Canada, Business Law Today (2025), https://businesslawtoday.org/2025/02/scraping-the-surface-openai-sued-for-data-scraping-in-canada/ (last visited Mar 13, 2025).

[15]My Mattsson, Data Privacy Violation: OpenAI/ChatGPT to Pay a Fine of 15 Million Euros, Rouse, https://rouse.com/insights/news/2025/data-privacy-violation-openai-chatgpt-to-pay-a-fine-of-15-million-euros/ (last visited Mar 13, 2025).

[16] Article 13, General Data Protection Regulation, Regulation (EU) 2016/679 (European Union).

[17] Section 5, Digital Personal Data Protection Act, 2023, No. 22 of 2023, Acts of Parliament (India).

[18] Article 24, General Data Protection Regulation, Regulation (EU) 2016/679 (European Union).

[19] Section 8, Digital Personal Data Protection Act, 2023, No. 22 of 2023, Acts of Parliament (India).

[20] Section 8(10), Digital Personal Data Protection Act, 2023, No. 22 of 2023, Acts of Parliament (India).

Related Posts

Back To Top