On 30 March 2023, the Italian Data Protection Authority (DPA) issued an order blocking OpenAI's platform ChatGPT from processing the data of Italian users with immediate effect. The DPA stated that it opened the investigation into the platform ChatGPT due to a data breach reported on 20 March 2023, which led to the loss of data regarding conversations and subscribers' payment data. Furthermore, the DPA stated that OpenAI does not have a legal basis for collecting and processing personal data through ChatGPT for the purpose of "training" its artificial intelligence algorithm and failed to inform users of the purpose of data collection. Finally, the DPA stated that OpenAI failed to implement its terms of service due to the lack of a system that would verify the age of users, exposing users younger than 13 years old to unsuitable content for their age. The DPA required OpenAI to provide evidence of the order's implementation within 20 days. In case of non-compliance, OpenAI faces a fine of EUR 20 million or 4% of its global turnover.
Original source