By Paolo Maria Gangi, ECTA Data Committee Member, Studio Legale Gangi, IT


The Italian Data Protection Supervising Authority (Italian SA) issued on 23 March 2023 an order of temporary limitation of data processing of Italian data subjects by the US company OpenAI in relation to the well-known AI software ChatGPT. Although ChatGPT has raised a number of legal and ethical questions in many jurisdictions, this appears to be the first decision ever issued by a regulator or a tribunal in relation to this cutting-edge software.

The Italian SA has identified OpenAI as the controller (Article 24 GDPR) of data processing by the AI system ChatGPT and has held that this AI technology infringes Articles 5, 6, 8, 13 and 25 of the General Data Protection Regulation (‘GDPR’).

In particular, the decision of the Italian SA is based on the following:

• No information is provided to users and data subjects;
• There is no legal basis for the collection and processing of personal data to ‘feed/train’ the algorithms on which the AI software relies;
• The information made available by ChatGPT does not always match factual and specific circumstances, so there is the risk of processing inaccurate personal data;
• Finally, the Italian SA emphasizes that the lack of whatever age verification mechanism exposes children to the danger of receiving responses by ChatGPT that are absolutely inappropriate to their age and awareness, even though the service is allegedly addressed to users aged above 13, according to OpenAI’s terms of use.

OpenAI is based in the US and does not have a subsidiary or a branch in the EU, but has designated a representative in the European Economic Area. At this point, ChatGPT will have to notify to the Italian SA within 20 days the measures implemented to comply with the decision, otherwise a fine of up to EUR 20 million or 4% of the total worldwide annual turnover may be imposed.

On April 5th, the Italian SA held a meeting online with OpenAI top management (including Sam Altman, CEO, and Che Chang Deputy General Counselor) where OpenAI, although stressing to believe to not be infringing any law, confirmed its willingness to cooperate with the Italian SA. On April 8th, the Italian SA released another official communication where it said that the Authority started to analyse the documents sent by OpenAI after the online meeting and that there will be another internal meeting of the Authority today, April 11th.

The Authority will likely communicate its final decision (i.e. whether or not to confirm the ban on ChatGPT) in the next weeks.

-----

The views expressed are those of our members and not necessarily of ECTA as an association. The content has not been subjected to a verification process, the accuracy of the information contained in the article is responsibility of the author.