ITALY Trends and Developments Contributed by: Paolo Balboni, Luca Bolognini, Davide Baldini and Nicolò Maria Salvi, ICT Legal Consulting
on OpenAI and mandated the company to launch a six-month public awareness campaign. The campaign should be aimed at educating the public about the collection of personal data for training its generative AI model ChatGPT, and informing individuals about their data protection rights (such as the right to opt out). The amount of the fine was due to the following data protection infringements by OpenAI. • Processing personal data without having previously identified a suitable legal basis. • Lack of age-verification mechanisms. When the service launched, there were no effective measures to verify users’ ages. • Failure to implement the campaign to raise aware - ness in the way prescribed by the GPDP within the 2023 provisional decision. • Provision of insufficient information to users within ChatGPT’s privacy notice, especially as regards the failure to inform data subjects about how their personal data was processed, including its use for training the AI model. • Violation of the accuracy principle, as ChatGPT’s responses often result in incorrect information about individuals. The fine considered OpenAI’s co-operative approach, acknowledging the implementation of several meas - ures requested by the GPDP. OpenAI was given 30 days to pay the fine and 60 days to submit a detailed plan for the required awareness campaign to the GPDP. The GPDP–OpenAI saga has garnered widespread attention, not only within the Italian data protection community but also in the general public of both Italy and Europe, given that it is one of the first enforcement initiatives to have targeted a generative AI system. The GPDP activity goes to show the GDPR potential of regulating specific aspects relating to generative AI, as well as the GPDP’s willingness to lead the way in this respect. Finally, given that during the investigation OpenAI established its EU headquarters in Ireland, the Irish Data Protection Commissioner (DPC) was brought into focus as the lead supervisory authority for Ope -
nAI. In line with the GDPR’s one-stop-shop mecha - nism, the GPDP has forwarded the case documents to the DPC, which will now be responsible for investigat - ing any further data protection infringements involving OpenAI. Enforcement action against DeepSeek DeepSeek entered the global AI market in January 2025, attracting widespread attention as the first large-scale Chinese generative AI model capable of competing with leading US providers. Its launch was widely perceived as a turning point in the AI mar - ket, both for its technological ambitions and for the broader geopolitical implications of a non-US model achieving comparable performance and, in some cas - es, adoption at international level. The GPDP once again positioned itself at the fore - front of regulatory enforcement in the AI sector. The authority promptly initiated supervisory action against the companies operating the service, confirming its determination to play a leading role in asserting the application of EU data protection rules to global AI providers, irrespective of their place of establishment. In January 2025, a few days after DeepSeek’s launch, the GPDP adopted urgent measures against Hang - zhou DeepSeek Artificial Intelligence Co, Ltd and Bei - jing DeepSeek Artificial Intelligence Co, Ltd, the Chi - nese companies operating the generative AI service known as DeepSeek. The service is offered through a website, applications and related software, and allows users to access AI-driven functionalities after registra - tion. The case originated from a formal request for informa - tion sent by the GPDP to the companies on 28 Janu - ary 2025. In their reply, they stated that DeepSeek had not entered, nor intended to enter, the Italian market and that the application had been removed from Ital - ian app stores. The companies also argued that the GDPR did not apply to their processing activities. Fol - lowing a rapid investigation, the GPDP established that, although DeepSeek’s mobile app was no longer available on the Apple and Google App Stores in Italy, the underlying service remained accessible to Italian users through its website. In addition, users who had previously registered were still able to log in and use
217 CHAMBERS.COM
Powered by FlippingBook