Italian DPA Accuses OpenAI of GDPR Violations
The Italian Data Protection Authority has recently declared that OpenAI is not in compliance with the General Data Protection Regulation (GDPR), the European Union’s stringent data protection laws. This development follows a temporary ban on OpenAI in March 2023 due to concerns that the organization was not meeting EU data regulation requirements. Although the ban was lifted after just a month, subsequent investigations have led the Italian authority to conclude that OpenAI violated GDPR provisions. Initially, the Italian DPA had accepted OpenAI’s compliance measures, but further investigation has reversed this position.
OpenAI, known for creating ChatGPT and other generative pre-trained transformers, is now facing significant challenges under GDPR. The Italian DPA’s concerns include the company’s collection of personal data without a clear legal basis, the models’ tendency to generate inaccurate information, and issues regarding child safety. With GDPR regulations allowing for fines up to €20 million or 4% of global annual turnover, whichever is higher, the stakes are high for OpenAI. Moreover, GDPR has the authority to mandate changes in data handling practices or potentially ban companies from the European market for non-compliance.
The heart of the issue lies in the methods used by OpenAI to gather and process personal data. The company has been accused of scraping vast amounts of data from the internet, including personal information, without obtaining web users’ consent. This practice makes it challenging to track the data’s origin and to justify that the data harvesting serves a legitimate interest, which would allow individuals to object to their data being used.
OpenAI has been given a thirty-day period to respond to the allegations, during which the Italian DPA will also consider ongoing efforts by the EU task force monitoring AI developments. This situation underscores the tension between technological innovation and privacy rights, highlighting the need for AI companies to align with GDPR to operate within the EU.
Source: Italian DPA says OpenAI in breach of GDPR
