Excerpt from Cointelegraph Article, Published on Dec 19, 2024.
Italy’s Data Protection Authority (IDPA), also known as the Garante, has fined OpenAI $15.7 million (15 million euros) for breaches of data protection laws, citing inadequate transparency, data misuse, and failure to meet legal obligations under the European Union’s General Data Protection Regulation (GDPR). The fine is accompanied by a mandate for OpenAI to launch a six-month public awareness campaign to educate users on how ChatGPT collects and uses their data.
The investigation revealed that OpenAI failed to notify the IDPA of a data breach in March 2023 and lacked a legal basis for processing users’ personal data to train its ChatGPT model. The Garante also found that OpenAI did not provide clear information about data collection practices, violating GDPR’s transparency principles. Furthermore, the absence of proper age verification mechanisms allowed minors under 13 to use the platform, exposing them to potentially inappropriate content. The IDPA’s corrective measures include requiring OpenAI to conduct a public awareness campaign across radio, television, newspapers, and digital platforms. The campaign aims to inform users and non-users about their rights, including the ability to oppose, rectify, or delete their data from the system. By the campaign’s conclusion, users should fully understand how their data is processed and how to exercise their rights under GDPR.
This fine follows Italy’s temporary ban on ChatGPT in March 2023 due to privacy concerns. While the ban was lifted in April after OpenAI implemented certain transparency measures, the latest action reflects ongoing regulatory scrutiny. The IDPA noted OpenAI’s cooperative attitude during the investigation, which led to a reduced fine. OpenAI has since moved its European headquarters to Ireland, transferring supervisory responsibilities to the Irish Data Protection Authority (DPC) for any future investigations. The IDPA’s decision aligns with guidance from the European Data Protection Board (EDPB), which emphasizes stricter oversight of AI companies.
To delve deeper into this topic, please read the full article Cointelegraph.
