ChatGPT’s Data Collection Under Fire: OpenAI Fined €15 Million in Italy

The Italian Data Protection Authority has imposed a fine on OpenAI for violations related to the processing of personal data by the ChatGPT chatbot. The company has been ordered to pay a penalty of €15 million and to conduct a six-month informational campaign in Italian media, aimed at explaining how ChatGPT operates, with a particular emphasis on data collection practices.

The sanctions were based on OpenAI’s failure to address the regulator’s notification regarding a March 2023 data breach. The investigation revealed that OpenAI had utilized user data to train ChatGPT without adequate legal justification. Furthermore, the principles of transparency and the obligation to inform users were found to be insufficiently upheld.

The regulator also highlighted the lack of age verification mechanisms, which poses a significant risk of children under 13 accessing inappropriate responses unsuited to their developmental stage.

Additionally, the case materials have been forwarded to the Irish Data Protection Commission, which serves as the primary supervisory authority under the EU General Data Protection Regulation (GDPR). The Irish regulator will continue investigating potential violations following the establishment of OpenAI’s European office.

This development emerged a day after the European Data Protection Board (EDPB) published a document addressing the use of personal data in the development and deployment of AI models.