The Italian data protection authority (Garante) has just struck a major blow in the world of artificial intelligence by condemning OpenAI, the company behind ChatGPT, to a record fine of 15 million euros. This important decision, announced on December 20, 2024, marks a turning point in the regulation of generative AI in Europe.
A series of GDPR violations
The investigation, initiated in March 2023, revealed numerous serious breaches of the General Data Protection Regulation (GDPR). OpenAI was notably criticized for the unauthorized use of users’ personal data for training its AI models.
The regulator also points out the lack of notification of a data leak that occurred in March 2023, as well as non-compliance with the principle of transparency and information obligations. Even more worrying, the lack of an age verification mechanism potentially exposes minors under the age of 13 to inappropriate content. This decision follows a first strong action by the Italian regulator which temporarily blocked access to ChatGPT in Italy for four weeks in April 2023.
A sanction with a unique educational dimension
Beyond the financial fine, the Italian authority is innovating by imposing an unprecedented communication obligation on OpenAI. The company will have to carry out an institutional information campaign for six months on all media, including radio, television, the written press and the internet. This campaign, the content of which must be validated by the regulator, will aim to explain the functioning of ChatGPT, the methods of collection and use of data, as well as the rights of users in terms of opposition, rectification and deletion of data.
For Theodore Christakis, professor of European law cited by 01netthis decision could set a precedent while fourteen other investigations into ChatGPT are underway in Europe. The rest of this file will now be followed in Ireland, where OpenAI has established its European headquarters. This case recalls the challenges faced by Apple with its Siri assistant and Apple Intelligence, also subject to the strict rules of the GDPR regarding the protection of personal data. The Cupertino company has also had to adapt its practices in Europe to comply with these requirements.
