OpenAI’s ChatGPT breaches privacy rules says Italian data protection watchdog

Italy’s Data Protection Authority (DPA) has concluded that OpenAI’s artificial intelligence-powered chatbot, ChatGPT, violates data protection rules, citing concerns related to the collection of personal data and age protections.

The DPA initiated an inquiry into ChatGPT’s data privacy practices and found evidence pointing to breaches of the EU General Data Protection Regulation (GDPR).

Italy had taken a strong stance on data protection concerns associated with ChatGPT, becoming the first Western country to block the chatbot in March 2023.

It was reinstated approximately four weeks later after OpenAI claimed to have addressed the raised issues. The DPA, however, continued its fact-finding activity, leading to the recent conclusion of data privacy violations.

The violations are linked to the mass collection of user data, which is utilized to train ChatGPT’s algorithm.

The DPA is also concerned about the potential exposure of younger users to inappropriate content generated by the chatbot. Under the GDPR, companies found in breach of data protection rules can face fines of up to 4 per cent of their global turnover.

Italy’s DPA collaborates with the European Data Protection Board, which established a special task force to monitor ChatGPT in April 2023.

While welcoming the measures taken by OpenAI during ChatGPT’s reinstatement, the DPA called for more compliance, including the implementation of an age verification system and an information campaign for Italians to opt-out of personal data processing for training algorithms.

OpenAI, closely tied to tech giant Microsoft, has yet to respond to the recent findings. Microsoft has heavily invested in OpenAI and integrated AI into its products, such as the Bing search engine and Office 365 apps.

The 30-day deadline has been set for OpenAI to present its defence against the DPA’s findings.

(With inputs from agencies)