Italy data protection agency opens ChatGPT probe on privacy concerns
reuters.com
reuters.com
Press release https://www.garanteprivacy.it/home/docweb/-/docweb-display/d...
Order https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb...
Google translation of excerpts of the order
> [The Authority orders to] Openai L.L.C., the US company developer and managers of Chatgpt, as owner of the processing of personal data carried out through this application, the measure of the provisional limitation, of the processing of the personal data of the established interested parties in the Italian territory;
> [The Authority] invites the data controller to the recipient of the provision, within 20 days from the date of receipt of the same, to communicate which initiatives have been undertaken in order to implement what is prescribed and to provide any element deemed useful to justify the violations above highlighted
The European Parliament and Council regulation (EU) 2016/679, along with the Code regarding the protection of personal data (Legislative Decree 30 June 2003, n. 196), have raised concerns regarding the ChatGPT service provided by OpenAI L.L.C. The concerns include:
Lack of information provided to users and data subjects whose data have been collected and processed by the ChatGPT service. Absence of an appropriate legal basis for the collection of personal data and their processing for the purpose of training the algorithms. Incorrect processing of personal data, resulting in ChatGPT providing inaccurate information. Absence of age verification for users, potentially exposing children under 13 to unsuitable content. The processing of personal data is considered in violation of Articles 5, 6, 8, 13, and 25 of the Regulation. As a result, the Guarantor orders a provisional limitation on processing personal data of users within Italian territory, effective immediately upon receipt of the order. OpenAI L.L.C. is invited to communicate the measures taken to implement the provisions within 20 days and provide any useful elements to justify the violations. Failure to comply may result in criminal penalties and administrative sanctions. An opposition can be lodged against this measure within 30 days from the date of communication.