Description

Issued DPA order blocking OpenAI ChatGPT due to alleged non-compliance with data protection regulation

On 30 March 2023, the Italian Data Protection Authority (DPA) issued an order blocking OpenAI's platform ChatGPT from processing the data of Italian users with immediate effect. The DPA stated that it opened the investigation into the platform ChatGPT due to a data breach reported on 20 March 2023, which led to the loss of data regarding conversations and subscribers' payment data. Furthermore, the DPA stated that OpenAI does not have a legal basis for collecting and processing personal data through ChatGPT for the purpose of "training" its artificial intelligence algorithm and failed to inform users of the purpose of data collection. Finally, the DPA stated that OpenAI failed to implement its terms of service due to the lack of a system that would verify the age of users, exposing users younger than 13 years old to unsuitable content for their age. The DPA required OpenAI to provide evidence of the order's implementation within 20 days. In case of non-compliance, OpenAI faces a fine of EUR 20 million or 4% of its global turnover.

Original source

Scope

Policy Area
Data governance
Policy Instrument
Data protection regulation
Regulated Economic Activity
ML and AI development
Implementation Level
national
Government Branch
executive
Government Body
data protection authority

Complete timeline of this policy change

Hide details
2023-03-30
under investigation

On 30 March 2023, the Italian Data Protection Authority (DPA) issued an order blocking OpenAI's pla…

2023-04-11
under investigation

On 11 April 2023, the Italian Data Protection Authority (DPA) announced it would suspend its order …

2023-04-28
in force

On 28 April 2023, the Italian Data Protection Authority (DPA) announced that OpenAI’s platform Chat…

2024-01-29
under investigation

On 29 January 2024, the Italian Data Protection Authority (DPA) issued a notice of objection to Ope…

2024-12-20
in force

On 20 December 2024, the Italian Data Protection Authority (DPA) published its ruling specifying th…

We use cookies and other technologies to perform analytics on our website. By opting in, you consent to the use by us and our third-party partners of cookies and data gathered from your use of our platform. See our Privacy Policy to learn more about the use of data and your rights.