- Italy fines OpenAI 15 million euros for violating privacy laws.
- OpenAI must launch a six-month campaign on AI data collection.
- Lack of age verification prompts fines for OpenAI’s ChatGPT service.
OpenAI is under fire after Italy’s data protection authority imposed a €15 million fine for violating GDPR rules. Apart from the fine, OpenAI is ordered to run a six-month campaign on AI data rights and transparency.
Italy Fines OpenAI 15 Million Euros for Data Breach
Italy’s data protection authority, the Garante, has fined OpenAI 15 million euros ($15.7 million) after an investigation into personal data violations. The investigation revealed that OpenAI processed personal user data to train its ChatGPT model without a valid legal basis, thus breaching EU privacy laws.
The investigation which started in March 2023 also found that OpenAI failed to inform the Italian data authority, Garante about a data breach earlier that year. This breach added to concerns over the company’s violation of transparency and its failure to meet obligations users outlined in the EU’s General Data Protection Regulation (GDPR).
OpenAI Ordered to Launch Awareness Campaign
The Garante has ordered OpenAI to carry out a six-month public awareness campaign. The campaign is part of its corrective measures following the violation of data privacy requirements. The campaign will focus on educating the public about ChatGPT’s data collection practices and the rights of users under GDPR regulation.
OpenAI must spread the message through various media channels such as television, radio and the internet. The purpose of this media campaign is to inform both users and non-users about the data collection involved in generative AI and how individuals can exercise their privacy rights such as opting in or out as well as requesting for deletion of their data.
Garante Fines OpenAI Over Lack of Age Verification System
The Garante also criticized OpenAI for failing to implement proper age verification mechanisms for ChatGPT users. This issue raised concerns about minors accessing the service and being exposed to content that may not be suitable for their age or development.
The lack of an age verification system means minors under 13 could potentially interact with AI-generated content that is not appropriate for their maturity level. The lack of safeguards led to further scrutiny and contributed to the decision to fine OpenAI.
OpenAI reaction and legal battles
OpenAI stated that the fine was excessive and said that it would appeal the decision. The company emphasized its commitment to working with privacy authorities globally to ensure its AI respects privacy rights. OpenAI pointed out that the fine is much higher than its revenue in Italy during the relevant period.
The Garante noted that OpenAI’s cooperation throughout the investigation led to a reduction in the fine. However, OpenAI has since moved its European headquarters to Ireland and the Irish Data Protection Authority (DPC) will now handle the investigations.
Italy’s decision follows broader scrutiny of AI systems like ChatGPT, as regulators in both Europe and the U.S. examine their data practices. The EU’s AI Act, which aims to regulate artificial intelligence has mainly influenced these investigations.