Italian DPA fines OpenAI €15M

The Garante per la Protezione dei Dati Personali (GPDP) has issued a fine of €15 million onto OpenAI for several violations of the General Data Protection Regulation (GDPR).

The Italian data protection authority (DPA) launched its investigation in March 2023 and after the European Data Protection Board (EDPB) published a document on the principles of responsibly developing artificial intelligence (AI) based services.

After 18 months of research, the GPDP has concluded that OpenAI, the developer of AI chatbot ChatGPT, has violated numerous European privacy rules. For starters, the company did not notify the authorities of a data breach that took place early 2023.

Secondly, OpenAI hadn’t implemented suitable age verification mechanisms, which could have exposed inappropriate responses to underaged users.

But most importantly, OpenAI processed users’ personal data to train ChatGPT without their consent and with no legal basis. In addition, the company failed to inform users about their rights under the GDPR.

For these violations, the Italian DPA has imposed an administrative fine of €15 million onto OpenAI. Furthermore, the company has to carry out a six month campaign in Italy on radio, television, newspaper and the internet to explain that personal data is being used to train ChatGPT.

An OpenAI spokesperson said to Reuters that the GPDP’s decision is “disproportionate” and confirmed that the company will file an appeal against the fine.

This is not the first time the GPDP has clashed with OpenAI.

In March 2023, the regulator decided to temporarily block ChatGPT in Italy. The DPA felt that OpenAI wasn’t honest about what user data was collected and processed. In addition, no age verification method was in place, potentially exposing young users to inappropriate content. Lastly, it wasn’t clear on what legal basis the company collected data to train the chatbot’s algorithm.

OpenAI took steps to comply with Europe’s privacy rules. After a month the Italian regulator decided to lift the ban.