The Garante per la Protezione dei Data Personali (GPDP) has contacted OpenAI. Investigations allegedly show that the U.S. tech company is violating European privacy laws with ChatGPT. OpenAI has 30 days to respond to the allegations. The Italian regulator reported this in a press statement.
This is a preliminary conclusion of a GPDP investigation into ChatGPT. Because it is a draft report, the findings of the investigation have not been made public. All that the Italian regulator would like to say about this at the moment is that there are indications that OpenAI is guilty of violating the General Data Protection Regulation (AVG).
OpenAI has 30 days to defend itself against the Italian regulator's accusations. If the company is indeed found to be in violation of European privacy laws, it could face a hefty fine. This could amount to up to €20 million, or 4 percent of global turnover, whichever is higher.
This is not the first time the GPDP has clashed with OpenAI. In March 2023, the regulator decided to block ChatGPT in Italy. The privacy watchdog felt that OpenAI was not honest about what user data the developer collects and what it does with that data. It also lacked an age filter, potentially exposing young people to inappropriate content. Furthermore, it was unclear on what legal basis the company collected data to train the chatbot's algorithm.
After OpenAI took steps to comply with privacy rules, the regulator decided to lift the ban. The developer of ChatGPT had drafted a privacy policy to provide more clarity on the collection and processing of personal data. Furthermore, the technology company built in a system for age verification. Finally, users could now indicate that they do not want their data to be collected and used for algorithm training purposes.
The GPDP is not the only one concerned about possible privacy violations by OpenAI. French regulator CNIL announced last April that it was launching an investigation into ChatGPT. In a statement, CNIL said it has received multiple complaints about alleged privacy violations. The report is still pending.
The Autoriteit Persoonsgegevens has also asked questions of OpenAI. The privacy watchdog wants to know whether people's questions are used to train the algorithm, and if so, in what way. Also, the regulator has questions about how the developer collects and uses personal data from the Internet.
Finally, the regulator has questions about the way ChatGPT generates responses. The answers may be inaccurate, as well as outdated, inappropriate, offensive or objectionable. The regulator wants to know how OpenAI rectifies or deletes that data.
