Italy Fines OpenAI €15 Million for Violating GDPR

The Italian Data Protection Authority, Il Garante, fined OpenAI €15 million for violating the General Data Protection Regulation (GDPR). This is the first major punitive action a Western country has taken against the ChatGPT maker.

Il Garante opened an investigation into OpenAI in March 2023, when it banned ChatGPT amid privacy concerns. The investigation revealed that OpenAI violated the GDPR on multiple counts. The AI startup failed to notify Il Garante about a data breach it suffered in March 2023, breaking transparency obligations. It also processed data without valid legal grounds and used it to train its generative AI models without users’ consent.

Il Garante also found that OpenAI lacked effective age verification measures, which allowed children under 13 to access the chatbot. That exposure led to potentially harmful and inappropriate responses.

Alongside the fine, Il Garante instructed OpenAI to conduct a six-month nationwide transparency campaign. It invoked Article 166, paragraph 7 of Italy’s Privacy Code, enabling it to require a public communication effort.

The proposed campaign involves radio, TV, newspaper, and internet coverage to explain how ChatGPT works, including details about data collection practices and users’ rights under the GDPR. OpenAI must also develop educational resources so users and non-users understand their rights to oppose, correct, and delete their data.

The campaign aims to help individuals make informed decisions about how their data is used and empower them to opt out of letting OpenAI train its models on their data.

During the investigation, OpenAI set up a European headquarters in Ireland to fulfill the GDPR’s one-stop shop requirement. Il Garante passed the case to the Irish Data Protection Commission (DPC), which now serves as the lead supervisory authority. The DPC recently fined Facebook owner Meta 251 million euros for violating the GDPR.

OpenAI objected to the €15 million fine, calling it “disproportionate” and saying it would appeal. The company stated that the amount is nearly 20 times the revenue it made in Italy during the relevant period.

“This highlights the scale of the fine compared to OpenAI’s financial interests within the Italian market,” a spokesperson for OpenAI said. The company added that it is open to collaborating with global privacy authorities to comply with data privacy laws.