Italy’s data protection agency, the Italian Data Protection Authority (IDPA), has fined OpenAI 15 million euros ($15.7 million) and mandated the company to launch a six-month public awareness campaign following an investigation into the data collection practices of its flagship artificial intelligence model, ChatGPT.
The IDPA stated in a December 20th statement that OpenAI failed to inform the agency about a data breach that occurred in March 2023. Additionally, the watchdog found that OpenAI processed users’ personal data in order to train the Chatbot without establishing a proper legal basis for doing so. This violated the principle of transparency and the related obligations to provide information to users.
The investigation also revealed that OpenAI lacked adequate age verification mechanisms to prevent minors from using its services. The IDPA expressed concerns about the risk of exposing children under the age of 13 to content that may be unsuitable for their level of development and self-awareness.
As part of the corrective measures, the IDPA has instructed OpenAI to conduct a comprehensive public awareness campaign lasting six months. This campaign will be carried out across various media platforms, including radio, television, newspapers, and the internet, with the aim of promoting public understanding and awareness of how ChatGPT operates. The campaign will specifically focus on data collection from users and non-users for the training of generative artificial intelligence, as well as the rights that individuals have, such as the right to object, rectify, and delete their data.
Following the conclusion of the campaign, users will be informed about how they can oppose the training of generative AI with their data and exercise their rights under the European Union’s General Data Protection Regulation (GDPR).
It is important to note that violations of the GDPR can result in fines of up to $20 million or 4% of a company’s global turnover. The IDPA acknowledged OpenAI’s cooperative attitude during the investigation, which contributed to the reduction in the amount of the fine.
During the investigation, OpenAI relocated its European headquarters to Ireland. As a result, the IDPA stated that the Irish Data Protection Authority (DPC) has become the supervisory authority responsible for any ongoing investigations.
The IDPA’s investigation commenced in March 2023 and took into account the European Data Protection Board’s (EDPB) opinion on the use of personal data for the development and deployment of AI models, which was issued on December 18th.
In March 2023, Italy became the first Western country to temporarily ban ChatGPT due to privacy concerns. The IDPA initiated an investigation into suspected breaches of data privacy regulations. The ban was subsequently lifted, subject to OpenAI meeting certain transparency requirements. As a result, the AI chatbot became available once again in Italy on April 29th.
OpenAI has not yet responded to requests for comment.