Violations of personal data protection laws
The Italian data protection authority, the Garante, has imposed a fine of EUR 15 million (about USD 15.6 million) on the US company OpenAI, the developer of ChatGPT, following numerous violations of the General Data Protection Regulation (GDPR) that came to light during an in-depth investigation.
The investigation was launched in March 2023, following a serious data breach and numerous reports from users. The main breach consisted of the use of personal data without users' consent to train the ChatGPT language model, contrary to the basic requirements of European law on transparency and lawfulness of data processing.
Lack of transparency and information leakage
According to the Supervisor, OpenAI did not provide users with clear information on how their data was processed, stored and used. In addition, the organisation failed to notify the Italian authorities of data breaches that had occurred in the previous year, as required by Article 33 of the GDPR, which requires such incidents to be reported within 72 hours.
Vulnerability of minors
Another important aspect of the complaints concerns the lack of a reliable system for verifying the age of users. As a result, minors were able to freely access ChatGPT and age-inappropriate content. This posed a potential threat to children and adolescents, further violating European standards.
Compulsory Information Campaign
In addition to the fine, the Garante ordered OpenAI to conduct a large-scale information campaign in Italy within six months. The aim is to explain to citizens how ChatGPT works, what data is used and what are the users' rights: deletion, rectification, limitation or opposition to data processing.
OpenAI's reply and possible appeal
In response to the Italian Garante's decision, OpenAI stated that it disagreed with the conclusions and considered the sanction excessive and disproportionate. The company's representatives emphasised their respect for local laws and their intention to maintain open communication with regulatory authorities in the countries in which they operate.
OpenAI also added that it reserves the right to challenge the decision in court, using all means permitted by law. The company expressed its willingness to continue the dialogue with the Italian Data Protection Authority, while pointing out that the implementation of technologies such as ChatGPT inevitably entails some challenges, especially in the context of the rapid development of artificial intelligence.
At the same time, OpenAI has assured that it will improve data handling processes and take into account the recommendations of European supervisory authorities to better respond to local regulations and user expectations.
Impact on the AI industry in Europe
This case could set an important precedent for other EU countries considering AI regulations. It clearly demonstrates how crucial it is to respect the principles of transparency, legality and protection of users' rights in the field of new technologies.
The decision of the Italian Garante could spur other states to tighten rules on data processing and introduce additional requirements for AI services. The growing attention to platforms such as ChatGPT is understandable, especially considering their wide use in education, business, media and even public administration.
Experts believe that the development of artificial intelligence in Europe will be accompanied not only by technical innovations, but also by the creation of a clear regulatory framework aimed at protecting the interests of users and ensuring the ethical use of intelligent systems.
