Italy’s data protection agency, the Italian Data Protection Authority (IDPA), has fined OpenAI 15 million euros ($15.7 million) and mandated the company to launch a six-month public awareness campaign. This action follows an investigation into OpenAI’s flagship artificial intelligence model, ChatGPT, regarding data collection practices.
In a statement released on December 20, the IDPA stated that OpenAI failed to inform the agency of a data breach that occurred in March 2023. Furthermore, the investigation revealed that OpenAI processed users’ personal data for training Chatbot without establishing a legal basis for this action. This violation of transparency principles and user information obligations led to the fine.
The IDPA also found that OpenAI lacked adequate age verification mechanisms to prevent minors from using its services. This oversight exposed children under the age of 13 to unsuitable responses that were not appropriate for their level of development and self-awareness.
As part of the corrective measures, the IDPA has ordered OpenAI to conduct a six-month public awareness campaign through various media channels, including radio, television, newspapers, and the internet. The purpose of this campaign is to promote public understanding and awareness of ChatGPT’s functioning, particularly regarding data collection from users and non-users for the training of generative artificial intelligence. The campaign will also inform users about their rights, including the right to oppose the training of generative AI with their data and exercise their rights under the European Union’s General Data Protection Regulation (GDPR).
After the completion of the campaign, users should be well-informed on how to oppose the training of generative AI with their data and exercise their GDPR rights. It is important to note that companies found in violation of the GDPR can face fines of up to $20 million or 4% of their global turnover.
The IDPA acknowledged OpenAI’s cooperative approach during the investigation, which resulted in a reduced fine. Additionally, OpenAI relocated its European headquarters to Ireland during the investigation, making the Irish Data Protection Authority (DPC) the lead supervisory authority for any ongoing investigations.
The IDPA initiated its investigation in March 2023 and considered the European Data Protection Board’s (EDPB) opinion on the use of personal data for developing and deploying AI models, which was issued on December 18. In March 2023, Italy became the first Western country to temporarily block ChatGPT due to privacy concerns, prompting the IDPA to launch an investigation into potential data privacy breaches. The ban on ChatGPT was lifted in Italy on April 29, after OpenAI complied with transparency measures.
OpenAI has not yet responded to requests for comment.