Italy’s privacy authority has mandated OpenAI to run a six-month public campaign explaining how ChatGPT collects and processes user data.
Following a data collection investigation of the company’s flagship artificial intelligence model, Italy’s data protection agency imposed a 15 million euro ($15.7 million) sanction on OpenAI and mandated that the ChatGPT maker implement a six-month public awareness campaign.
In a statement issued on December 20, the Italian Data Protection Authority (IDPA), also known as the Garante, disclosed that its investigation determined that OpenAI failed to notify the agency of a data violation in March 2023.
The watchdog also asserted that OpenAI “processed users’ data” to train Chatbot without first identifying an “adequate legal basis” for the action, thereby violating the “principle of transparency and the related information obligations toward users.”
According to the IDPA, its investigation revealed that OpenAI lacked sufficient age verification mechanisms to prevent individuals under the age of 18 from accessing its services.
In addition, the IDPA stated that OpenAI has not implemented mechanisms for age verification, which poses a risk of exposing juveniles under 13 to responses that are inappropriate for their level of development and self-awareness.
The IDPA has directed OpenAI to implement a six-month public awareness campaign spanning radio, television, periodicals, and the internet as a corrective and sanctioning measure.
The objective of this campaign is to increase public awareness and comprehension of the operation of ChatGPT.
The IDPA specifically addressed the rights of interested parties, such as opposition, rectification, and cancellation, and the acquisition of data from users and non-users for the training of generative artificial intelligence.
The IDPA stated that users should be informed of the methods by which they can oppose the training of generative AI with their data and exercise their rights under the General Data Protection Regulation (GDPR) of the European Union after the campaign concludes.
Companies that contravene the GDPR may be subject to a fine of up to $20 million or 4% of their global turnover.
The fine’s magnitude was reduced by OpenAI’s “collaborative attitude” during the investigation, as per the IDPA.
OpenAI relocated its European headquarters to Ireland during the investigation.
According to the IDPA, the Irish Data Protection Authority (DPC) has assumed the role of the primary supervisory authority in the continued conduct of any investigations.
The IDPA initiated its investigation in March 2023 and stated that it reached its conclusion after taking into account the European Data Protection Board (EDPB) opinion on the use of personal data to develop and deploy AI models on December 18.
In March 2023, Italy became the first Western country to temporarily block ChatGPT due to privacy concerns, and the IDPA announced an investigation into suspected violations of data privacy regulations.
The prohibition of ChatGPT by Italian regulators was met with criticism.
A few weeks following the initial clampdown, they announced that the prohibition would be lifted if OpenAI adhered to several transparency measures.
The AI chatbot was reintroduced to Italy on April 29.
A request for comment was not promptly addressed by OpenAI.
