ITALY Trends and Developments Contributed by: Paolo Balboni, Luca Bolognini, Davide Baldini and Nicolò Maria Salvi, ICT Legal Consulting
also a public area (including a public park). According to the GPDP, the placement of the cameras violated the principle of lawfulness, as the data controller failed to show a legitimate interest capable of justifying the recording of public areas and conversations through the audio system, as well as the principle of data mini - misation. The decision is also interesting because it clarifies that, while domestic surveillance systems are generally exempt from having to comply with the GDPR, such exemption does not apply when involving public or third parties’ properties. The GPDP issued a mere reprimand against the data controller, consid - ering that the individual promptly rectified the situa - tion by replacing the camera and redirecting it solely towards the entrance of their home. In June 2023, the GPDP issued a sanction of EUR20,000 against an Italian employer for, inter alia, having installed a video-surveillance system in its premises without having obtained the prior approval of the workers’ council or of the public labour author - ity, as required by Article 4 of Law No 300/1970 (the so-called “Workers’ Statute”). Moreover, no privacy notice had been drafted and made available to the workers. More recently, in July 2024, the GPDP ordered the Turin municipality to share further infor - mation relating to the use of AI-powered “smart CCT - Vs”, which would allegedly help local police forces to understand whether their intervention is needed in emergency situations, in order for the GPDP to be able to investigate the system’s compliance with the GDPR. Lastly, a field where the GPDP has focused much of its attention since early 2023 is that of artificial intel - ligence (AI), as shall be seen specifically in the follow - ing section. The GPDP at the Forefront of AI Enforcement During the last couple of years, the GPDP has taken noteworthy initiatives in the context of AI, including by means of enforcement actions against major provid - ers of generative AI systems and models. As a result, the GPDP has accredited itself as one of the most active EU supervisory authorities on the regulation of AI vis-à-vis the GDPR and the Italian Data Protec - tion Law. The following provide a brief overview of the
most important initiatives undertaken by the GPDP in the AI field. Enforcement action against OpenAI In late March 2023, only a few months after its launch, the GPDP identified several violations of the GDPR and the Italian Data Protection Law regarding the famous and widespread generative AI system Chat - GPT. According to the GPDP, OpenAI failed to dem - onstrate the presence of a valid legal basis for col - lecting and processing personal data for the purposes of training ChatGPT, and the information provided to users and individuals whose data was used for train- ing the generative AI system was incomplete. Moreo - ver, individuals whose data was used for training the AI system had no easy way to exercise their data protection rights, including the rights of access, rec - tification and objection. Interestingly, the GPDP also noted that ChatGPT’s responses to users’ prompts often deviated from reality (so-called “hallucinations”), thereby violating the accuracy principle established by the GDPR when such responses concerned another individual. The ChatGPT case further underscores, once again, the GPDP’s scrutiny of data process - ing concerning children: in this respect, the author - ity questioned whether the platform’s outputs might result in inappropriate responses for children, even if the service is purportedly aimed at users above the age of 13, as stated in OpenAI’s terms of service. As a result, the GPDP required OpenAI to implement a suitable age verification system. On 28 April 2023, the GPDP lifted the ban, as it con - sidered the measures adopted by OpenAI to ade - quately address the data protection issues raised by the authority and which underpinned the ban. Such measures included updating ChatGPT’s privacy poli - cy, implementing adequate age-verification systems, and implementing measures to enable individuals to exercise their data protection rights. However, the GPDP reserved its powers to fully investigate the underlying shortcomings that led to it issuing the ban in the first place and, if necessary, issuing any rel - evant sanction in a separate decision after having fully investigated the facts. The final decision was issued on 2 November 2024. In its ruling, the GPDP imposed a EUR15 million fine
216 CHAMBERS.COM
Powered by FlippingBook