The future of ChatGPT in Italy: OpenAI, the company behind the AI tool ChatGPT, has been ordered by the Italian Data Protection Authority (Garante) to comply with measures regarding transparency, data subjects’ rights, and the legal basis of processing users’ data by April 30th.
UPDATE
ChatGPT is accessible again in Italy. After a meeting with the Garante Privacy, OpenAI has introduced new data protection measures, as required by the Italian authority.
In particular, OpenAI has published a notice, dedicated to all users and non-users, in which it explains which personal data are processed for algorithm training and in what manner. European users are also given the right to object to the processing of their personal data. Regarding the minimum age requirement, OpenAI has included the requirement to confirm the date of birth on the service sign-up page, and provided a block on registration for users under thirteen years of age.
You can access the official press release here.
In short, the requirements imposed by the Garante on ChatGPT include:
- Having a correct and complete privacy policy for the OpenAI/ChatGPT site.
- Subjecting the use of the service to having read the privacy policy.
- Verifying the age of users.
- Adding tools for users to request opposition to the indexing or modification/cancellation of their personal data from the OpenAI services.
- Adding tools for users to request opposition to the use of their personal data for training the algorithm.
- Undertaking an information campaign towards the public.
- Using the legitimate interest as a legal basis for training the algorithm using personal data, in addition to consent.
🔎 The Details
OpenAI is required to draft and make available an information notice on its website that describes the data processing arrangements and logic required for ChatGPT’s operation, along with the rights of data subjects. Users from Italy must be presented with this notice before completing their registration, and registered users will have to be presented with the notice when accessing the service.
OpenAI is required to implement an age gating system and submit a plan for an age verification system by September 30, 2023, to filter out users aged below 13 and users aged 13 to 18 for whom no consent is available by the holders of parental authority. The company must also promote an information campaign in agreement with the Garante to inform individuals about the use of their personal data for training algorithms.
OpenAI must make available easily accessible tools for data subjects, including non-users, to obtain rectification of their personal data or to have that data erased if rectification is technically unfeasible.
The Garante has allowed OpenAI to use personal data to train the algorithm using legitimate interest as the legal basis, similar to the approach used by search engines when they index the web. This provision carries the ball forward for OpenAI, but the Garante reserves the right to evaluate the merit of using legitimate interest as the legal basis in the future.
The Garante will continue to investigate possible infringements of the legislation in force and may decide to take additional or different measures if necessary upon completion of the fact-finding exercise.
🗣️ OpenAI’s Response
In response, OpenAI has decided to start a constructive dialogue with the Garante, which has been very pragmatic in finding a solution that is feasible for OpenAI.
This is a win-win situation for everyone: OpenAI obtains reasonable guidelines directly from the authority within which to operate in compliance with GDPR, the Garante is satisfied with substantial compliance with the rules, and citizens’ rights are protected.
📬 Want the latest news on Data Protection and Privacy delivered to your inbox? Join the list @ dponewsletter.com