Italy's data protection agency, known as Garante, has specified the actions OpenAI must take to revoke the order imposed on ChatGPT. The order was issued in March 2023. Regulators suspect the artificial intelligence (AI) chatbot service violated the European Union's General Data Protection Regulation (GDPR) and ordered the US company to stop processing data belonging to individuals residing in the EU country.
The regulator's press release requires OpenAI to increase transparency and issue an information notice providing a comprehensive overview of its data handling practices. Additionally, the statement calls for OpenAI to immediately implement age-restriction measures to prevent minors from using its technology, and to adopt stricter methods of age verification. OpenAI must specify the legal basis it relies on for processing personal data to train its AI, and cannot rely on contract performance. This means OpenAI has to choose between obtaining user consent or relying on legitimate interests. OpenAI's privacy policy currently refers to three legal bases, but it seems to place more emphasis on contract performance when providing services such as ChatGPT.
In addition, OpenAI must allow users and non-users to exercise their rights with respect to personal data, including requesting correction of any misinformation generated by ChatGPT or deletion of their data. Additionally, regulators have asked OpenAI to allow users to object to the processing of their data to train its algorithms. In addition, OpenAI needs to run a campaign in Italy to inform individuals that their information is being processed to train its AI.
Garante set an April 30 deadline for OpenAI to complete most of these tasks. OpenAI has been given additional time to meet the additional needs of migrating from existing age-restricted child safety techniques to a more resilient age-verification system. Specifically, OpenAI has until May 31 to submit a plan outlining the implementation of age-verification technology to screen out users under the age of 13 (and those aged 13 to 18 without parental consent). The deadline for deploying this more robust system has been set for September 30.
Microsoft-backed OpenAI took ChatGPT offline in Italy on Friday, March 31, after national data protection agencies raised concerns about possible privacy violations and the inability to verify users' ages.
