DATA PROTECTION | The Italian DPA fines OpenAI 15 million euros

On 2 November 2024, the Italian Data Protection Authority (Italian DPA) imposed a 15 million euros fine on OpenAI, the company behind the widely known ChatGPT, for the unlawful processing of personal data. The fine relates to several violations of the GDPR which, according to the Italian DPA, were committed by the company prior to December 2023, the date on which OpenAI established a subsidiary in Europe. Investigations into alleged violations that occurred after that date will be handled by the Irish DPA, under the one-stop shop mechanism. The main reasons for the decision include OpenAI’s failure to notify the Italian DPA of a data breach, the processing of users’ personal data to train the AI without a valid legal basis, breach of transparency and information obligations, and the failure to implement an age verification mechanism. In addition to the fine, OpenAI has been ordered to conduct a six-month awareness campaign, subject to the prior approval by the Italian DPA, to educate the public about the risks of using ChatGPT. The campaign should provide clear information on how generative AI collects data from users and non-users for training purposes, and outline the rights available to data subjects, including the right to object, rectify and delete.

Newsletter n. 103 – January 2025