OpenAI L.L.C. (the Controller) – Violation Found (Italy, 2023)

Following the decision of the Italian DPA to impose a temporary limitation on the processing activities of OpenAI L.L.C. (the controller) regarding ChatGPT, the controller contacted the DPA to express its willingness to cooperate and requested it to lift the temporary limitation. The Italian DPA argued that it would re-assess its decision on condition that the controller put in place concrete measures to protect the rights and freedoms of those whose data was used to train ChatGPT’s algorithms and those who are users of the service. These measures include: 1) Preparing and publishing an information notice on the controller's website which explains that the data collected from the data subjects (users and non-users of the service) is used to train ChatGPT’s algorithms, and also includes information on how the processing is carried out, the logic behind the processing as necessary for the operation of the service, data subjects' rights and any other information required by the GDPR. 2) Putting in place a tool, which could be accessible on the controller’s website, by which data subjects who log in from Italy can exercise their right to object to the processing of their personal data obtained from third parties, when the processing is carried out for purposes of algorithm training and provision of the service. 3) Making available on the controller's website a tool by which data subjects can request and obtain the correction of their data which was inaccurately processed in the generation of contents or, where this is not possible according to the state-of-the-art technology, erasure of such personal data. 4) Including a link to the privacy policy which shall be displayed before proceeding to registration. This link shall also appear prior to the reactivation of the service. 5) Modifying the legal basis for processing personal data for purposes of algorithm training. In particular, the controller shall not invoke the performance of a contract as an appropriate legal basis but shall instead base its processing on consent or legitimate interest. 6) Implementing, on the controller's website, a tool that allows data subjects to object to the processing of their personal data collected during their use of Chat GPT, when data are processed to train the algorithms on the basis of a legitimate interest of the controller. This tool shall be easily accessible. 7) Putting in place an age gate system to filter out minors on the basis of the age declared by the data subject. 8) Submitting a plan to the Italian DPA by 31 May 2023 for the implementation of age verification tools which would prevent data subjects aged under 13 from using ChatGPT alongside with data subjects aged under 18 in the absence of a clear affirmative act of consent by the person holding parental responsibility over the latter. 9) Launching an information campaign, without promoting its services, on the main Italian mass communication channels to inform data subjects that there is a high probability that their personal data was collected for the purposes of algorithm training and the controller published an information notice and provided a tool by which data subjects can request and obtain the erasure of their personal data. Moreover, pursuant to Article 58(1) GDPR, the Italian DPA asked the controller to communicate by 30 April 2023 the initiatives it took to put in place the measures 1 to 7. It also asked the controller to indicate the steps it took to implement the measures 8 and 9.