Italy\u2019s data protection agency, the Italian Data Protection Authority (IDPA), has fined OpenAI \u20ac15 million ($15.7 million) for privacy violations. The agency also ordered OpenAI to conduct a six-month public awareness campaign to educate users on how ChatGPT collects and processes personal data.<\/p>\n\n\n\n
The IDPA\u2019s investigation revealed that OpenAI failed to notify authorities about a data breach in March 2023. The watchdog also found that the company processed personal data to train its AI model without establishing a valid legal basis, violating transparency obligations under Europe\u2019s General Data Protection Regulation (GDPR).<\/p>\n\n\n\n
The investigation found OpenAI lacked proper age verification mechanisms, potentially exposing children under 13 to inappropriate content. The IDPA emphasized that this oversight could harm minors who are not developmentally equipped to engage with such technology responsibly.<\/p>\n\n\n\n
The watchdog stated, \u201cOpenAI has not provided mechanisms for age verification, with the consequent risk of exposing minors under 13 to responses that are unsuitable for their level of development and self-awareness.\u201d<\/p>\n\n\n\n
As part of its corrective measures, the IDPA required OpenAI to launch a six-month public awareness campaign through radio, television, newspapers, and online platforms. The campaign must inform users and non-users about how ChatGPT collects and uses data and explain the rights available under GDPR, including the ability to oppose data usage, request corrections, or demand data deletion.<\/p>\n\n\n\n
At the end of the campaign, the IDPA expects users to understand how they can exercise their rights to protect their personal data.<\/p>\n\n\n\n
The IDPA noted OpenAI\u2019s cooperative behavior during the investigation, which contributed to a reduced fine. Despite this, the agency underscored the importance of adhering to GDPR standards.<\/p>\n\n\n\n
Following the investigation, OpenAI relocated its European headquarters to Ireland. Future inquiries will now fall under the jurisdiction of the Irish Data Protection Commission (DPC), which serves as the lead supervisory authority.<\/p>\n\n\n\n
This case serves as a reminder of the potential consequences for companies that violate GDPR regulations, with penalties reaching up to \u20ac20 million or 4% of global annual revenue.<\/p>\n","protected":false},"excerpt":{"rendered":"
Italy\u2019s data protection agency, the Italian Data Protection Authority (IDPA), has fined OpenAI \u20ac15 million ($15.7 million) for privacy violations. The agency also ordered OpenAI to conduct a six-month public awareness campaign to educate users on how ChatGPT collects and processes personal data. The IDPA\u2019s investigation revealed that OpenAI failed to notify authorities about a […]<\/p>\n","protected":false},"author":13,"featured_media":11869,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2,43],"tags":[],"class_list":{"0":"post-12837","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-featured","8":"category-general-news"},"acf":[],"yoast_head":"\n