Italy Declares ChatGPT in Violation of Data Privacy Laws: The End of the Road?

After a lengthy investigation spanning nearly a year, Italy’s data protection authority has determined that ChatGPT has violated EU data protection laws. The Garante per la protezione dei dati personali, Italy's regulatory body, reported that the platform was found in breach of the General Data Protection Regulation (GDPR), a pivotal framework governing how online platforms can collect and manage user data. The GDPR serves as a blueprint for privacy regulators worldwide, emphasizing the importance of ensuring user privacy.

Initially, on March 30, the Italian data authority imposed a ban on ChatGPT. The agency asserted that the chatbot unlawfully gathered personal information from users and lacked adequate measures to verify the age of its users. Although the ban was lifted a few weeks later, the DPA committed to a deeper investigation into the potential violations related to data privacy.

In today’s announcement, the DPA did not disclose specific details regarding the alleged breaches but noted that it would consider the findings from a task force established last year to examine the practices of ChatGPT. Following this ruling, OpenAI is now required to submit counterclaims within 30 days, facing the possibility of substantial penalties if found guilty of breaching the GDPR. Organizations in violation of these regulations may incur fines of up to 4% of their global revenue.

In response to the ruling, a spokesperson from OpenAI expressed their belief that the company's operations comply with GDPR and other privacy regulations. “We take additional measures to safeguard individuals' data and privacy,” the spokesperson stated. They emphasized their commitment to ensuring that the AI is trained on general knowledge rather than private information, mentioning, “We actively work to minimize personal data in our training systems like ChatGPT, which also denies requests for private or sensitive information about individuals. We intend to continue collaborating positively with the Garante.”