Italy’s Data Protection Authority (DPA) has concluded that OpenAI’s artificial intelligence-powered chatbot, ChatGPT, violates data protection rules, citing concerns about collecting personal data and age protections.
The DPA initiated an inquiry into ChatGPT’s data privacy practices and found evidence pointing to EU General Data Protection Regulation (GDPR) breaches.
Italy had taken a strong stance on data protection concerns associated with ChatGPT, becoming the first Western country to block the chatbot in March 2023.
It was reinstated approximately four weeks after OpenAI claimed to have addressed the issues raised. The DPA, however, continued its fact-finding activity, leading to the recent conclusion of data privacy violations.
The violations are linked to the mass collection of user data, which is utilized to train ChatGPT’s algorithm.
The DPA is also concerned about the potential exposure of younger users to inappropriate content generated by the chatbot. Under the GDPR, companies breaching data protection rules can face fines of up to 4 percent of their global turnover.
Italy’s DPA collaborates with the European Data Protection Board, which established a special task force to monitor ChatGPT in April 2023.
While welcoming the measures OpenAI took during ChatGPT’s reinstatement, the DPA called for more compliance, including implementing an age verification system and an information campaign for Italians to opt out of personal data processing for training algorithms.
OpenAI, closely tied to tech giant Microsoft, has yet to respond to the recent findings. Microsoft has heavily invested in OpenAI and integrated AI into its products, such as the Bing search engine and Office 365 apps.
The 30-day deadline has been set for OpenAI to present its defense against the DPA’s findings.
