Italy: Issued interim ruling in GPDP investigation into agreements between GEDI Gruppo Editoriale SpA and OpenAI

On 27 November 2024, the Italian Data Protection Authority (GPDP) issued an interim ruling to GEDI Gruppo Editoriale SpA and its subsidiaries pertaining to their agreement with OpenAI. The agreement relates to sharing editorial content, including personal data, for artificial intelligence (AI) training and service improvement. The GPDP identified potential violations of the General Data Protection Regulation, specifically pertaining to the legal basis for processing sensitive data, inadequate transparency, and ineffective mechanisms to protect individuals’ rights. The agreement relies on legitimate interest, which the GPDP deemed insufficient for such processing, and the accompanying data protection impact assessment was found lacking. The order requires GEDI to address these issues to ensure compliance.