15 million fine to OpenAI for ChatGPT by the Guarantor

OpenAI will have to carry out a six-month information campaign and pay a fine of 15 million euros. This was established by the Privacy Guarantor in relation to the management of the ChatGPT service. The provision, which ascertains the violations previously alleged against the Californian company, comes as a result of an investigation started in March 2023 and after the EDPB (European Data Protection Board) published the opinion with which identifies a common approach to some of the most relevant issues relating to the processing of personal data in the context of the design, development and distribution of services based on artificial intelligence. According to the Guarantor, the US company, which created and manages the generative artificial intelligence chatbot, “in addition to not having notified the Authority of the data breach suffered in March 2023”, processed “users’ personal data to train ChatGPT without first having identified an adequate legal basis e violated the principle of transparency and the related information obligations towards users“. Furthermore, OpenAI “has not provided mechanisms for verifying age, with the consequent risk of exposing children under 13 to responses that are unsuitable for their level of development and self-awareness”.

The Authority with the aim of “guarantee, first of all, effective transparency in the processing of personal data“, ordered OpenAI – using for the first time the new powers provided for in article 166, paragraph 7, of the Privacy Code – to carry out a 6-month institutional communication campaign on radio, television, newspapers and the Internet. The contents, to be agreed with the Guarantor, will have to promote public understanding and awareness on the functioning of ChatGPT, in particular on the collection of data from users and non-users for the training of generative artificial intelligence and the rights exercisable by interested parties, including those of opposition, rectification and cancellation.

Thanks to this communication campaign, users and non-users of ChatGPT will have to be made aware of how to oppose the training of generative artificial intelligence with their personal data and, therefore, be effectively placed in a position to exercise their rights pursuant to of the GDPR. As for the fifteen million euro fine, the Guarantor explains that it was also calculated taking into account the collaborative attitude of the company. Finally, taking into account that the company, during the investigation, established its European headquarters in Ireland, the Guarantor, in compliance with the so-called ‘one stop shop’ rule, forwarded the documents of the proceedings to the Regulatory Authority Irish data protection (DPC, which has become the lead supervisory authority pursuant to the GDPR, to “continue the investigation in relation to any violations of a continuous nature which were not exhausted before the opening of the European establishment”.