ITALY Trends and Developments Contributed by: Paolo Balboni, Luca Bolognini, Davide Baldini and Nicolò Maria Salvi, ICT Legal Consulting
quate age-verification systems, and implement - ing measures to enable individuals to exercise their data protection rights. The Garante, how - ever, reserved its powers to fully investigate the underlying shortcomings that have led it to issue the ban in the first place and, if necessary, issue any relevant sanction in a separate decision after having fully investigated the facts. The final decision was finally issued on 2 Novem - ber 2024. In its ruling, the GPDP imposed a EUR15 million fine on OpenAI and mandated the company to launch a six-month public aware - ness campaign. The campaign shall be aimed at educating the public about the collection of personal data for training its generative artificial intelligence model GPT, and informing individu - als about their data protection rights (such as the right to opt out). The amount of the fine was due to the follow - ing data protection infringements by OpenAI, including: • processing personal data without having pre - viously identified a suitable legal basis; • lack of age-verification mechanism (when the service launched, there were no effective measures to verify users’ age); • failure to implement the campaign to raise awareness in the way prescribed by the GPDP in the 2023 provisional decision; • provision of insufficient information to users in ChatGPT’s privacy notice, especially as regards the failure to inform data subjects about how their personal data was pro - cessed, including its use for training the AI model; and • violation of the accuracy principle, as Chat - GPT’s responses often result in incorrect information about individuals.
The fine considered OpenAI’s co-operative approach, acknowledging the implementation of several measures requested by the GPDP. Ope - nAI has been given 30 days to pay the fine and 60 days to submit a detailed plan for the required awareness campaign to the GPDP. The Garante-OpenAI saga has raised wide - spread attention not only within the Italian data protection community, but also among the gen - eral public of both Italy and Europe, given that it is one of the first enforcement initiatives to have targeted a generative AI system. The GPDP’s intervention highlights the GDPR’s potential to regulate specific aspects of generative AI and underscores the Garante’s willingness to lead the way in this respect. Finally, given that during the investigation Ope - nAI established its EU headquarters in Ireland, the Irish Data Protection Commissioner (DPC) is brought into focus as the lead supervisory authority for OpenAI. In line with the GDPR’s one-stop shop mechanism, the GPDP has for - warded the case documents to the DPC, which will now be responsible for investigating any further data protection infringements involving OpenAI. Inquiry and guidance on data mining for the training of AI systems On 22 November 2023, the GPDP launched a survey aimed at both public and private web - sites to assess the implementation of effective security measures against the widespread col - lection of personal data (so-called web scraping) for training third-party AI algorithms. The investigation covers all entities, acting as data controllers, based in Italy or providing ser - vices in Italy, that allow personal data to be freely accessible online, including by means of the
242 CHAMBERS.COM
Powered by FlippingBook