Italy’s regulator announces a ChatGPT ban and investigation until OpenAI complies with GDPR
Italy’s privacy regulator announced a temporary ban on the popular artificial intelligence conversation app ChatGPT, developed by American AI technology company OpenAI, citing allegations of privacy violations.
The duration of the ban remains unclear, as the Italian privacy regulator stated that it would be launching an investigation into OpenAI.
The primary reason for the ChatGPT ban and investigation is the Italian privacy regulator’s belief that OpenAI has not adhered to the European Union’s General Data Protection Regulation (GDPR) when handling the data of Italian users. For example, the regulator contends that OpenAI lacks a legal basis to justify the extensive collection and storage of personal data to train ChatGPT’s algorithm (i.e., not proving its necessity) and accuses OpenAI of inaccurately processing user data.
The Italian regulator also mentioned the data leak issue that arose with ChatGPT last week, when system issues inadvertently exposed chat session titles for some users and a small portion of users’ payment information.
Photo by Jonathan Kemper on Unsplash
A key issue that may draw the shared concern of other EU member states is that ChatGPT does not require age verification during account registration, meaning minors can sign up and access content without age-appropriate filtering, potentially exposing them to unsuitable material.
In the EU, protecting minors’ data is a priority, as demonstrated by Germany’s Hesse state data regulator’s ban on Microsoft 365 due to the collection and transfer of student user data to the United States.
OpenAI has no EU offices but does have a dedicated representative within the European Economic Area. This representative will have 20 days to communicate to the regulator how the company plans to bring ChatGPT into compliance with GDPR privacy protection requirements.
Should OpenAI fail to respond or make necessary adjustments within the deadline, the EU may impose a hefty fine of up to €20 million or 4% of global revenue, whichever is greater. OpenAI has not yet issued a response regarding this matter.
