OpenAI – €15,000,000 Fine (Italy, 2024)

On 20 March 2023, a technical bug on the ChatGPT service caused users to view the chat history of other users instead of their own for a limited amount of time. The controller, OpenAI, publicly acknowledged the issue and confirmed that the exposed data included names, surnames, email addresses, and the last four digits and expiration dates of credit cards used for the ChatGPT Plus (the paid version of the service). Following this data breach, the Italian DPA started an ex officio investigation. First, the DPA considered whether the one-stop-shop mechanism would apply. More specifically, the DPA considered that, at the time of the alleged violations, the controller was established in California and did not have any indicated establishment in the EU. In fact, ChatGPT has been available in the EU since 30 November 2022, as also confirmed by the controller. The controller had an establishment in Ireland only from the 15 February 2024. Therefore, the DPA found that, for every alleged violation of the GDPR happened before the 15 February 2024, the one-stop-shop mechanism does not apply and the DPA has jurisdiction to rule on the matter. Second, the Italian DPA concluded its investigation and held that: Violation of Article 33(1) GDPR The controller is under the obligation to notify any data breach to the DPA within 72 hours according to Article 33(1) GDPR. The controller states that it notified the data breach to the Irish DPA, as it was in the process of setting up its Irish registered office when the breach happened. The DPA considered that, during the breach, the controller was based in the U.S.A and did not have any establishment in the EU. The DPA highlighted that, where a proprietor does not have an establishment in the EU, Article 56 GDPR does not apply in favour of the general rule laid out in Article 55(1) GDPR, according to which each supervisory authority is competent to execute the tasks assigned to it and to exercise the powers conferred upon it under the GDPR in the territory of the respective Member State. The DPA further considered that the decision could not be transferred to the Irish DPA as the alleged violations happened before the establishment for the controller in Ireland. Thus, the controller violated Article 33(1) GDPR, as it failed to notify the Italian DPA, instead of the Irish one. Violation of Articles 5(2) and 6 GDPR The DPA considered that, in relation to the data processing to train the models underlying the ChatGPT service, that the data processing started much earlier than the service they were intended for. This means that, during that period, the controller should have defined the legal basis for such processing, which it did not. This is in line with Article 5(2) GDPR establishing the accountability principle of the controller. Considering that the controller failed to correctly identify an adequate legal basis before the data processing took place, they violated Article 6(1) GDPR. Violation of Articles 5(1)(a), 12 and 13 GDPR When analyzing the controller´s privacy policy, the DPA found that twp types of data processing: the processing of users´ data to be able to use the controller´s service, and the processing of non-users´ data to train the models underlying the ChatGPT service. The GDPR, under Article 5, as well as Article 12 and 13, establishes some transparency obligations in this regard, namely that both users, as well as third parties whose data is being used, are correctly informed of the processing. The DPA found that various elements indicate that these obligations were not respected: first, the privacy policy was only available in English; and, second, it was not easily reachable on the controller´s website. From a content standpoint, the privacy policy did not contain any information about the data processing of non-users´ data, that are used to train the models underlying the ChatGPT service. Therefore, the controller violated Article 5(1)(a), Article 12 and Article 13 GDPR. Violation of Article 24 and 25 GDPR The DPA recalled that Recital 38 GDPR highlights the need for specific protection of minor´s data protection. As per Article 24(1) GDPR, the controller should put into place adequate technical and organizational measures. Moreover, Article 25 GDPR highlights that the controller must adopt such measures taking into account the state of the art and the costs of implementation, as well as the nature, scope, context and purposes of the processing, as well as the risks having different probability and severity for the rights and freedoms of natural persons posed by the processing. The controller did not implemented any mechanism to verify the age of users when registering for the ChatGPT service, even though the terms of service conditions of service (ToS) identified minors among potential users, stating that, for the purposes of a valid contractual relationship contractual bond, users aged between 13 and 18 require the consent of the holder of parental responsibility. The documentation on file shows that the controller has expressed its commitment to consider the implementation of age verification mechanisms only following the [https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9874702 corrective measure imposed by the DPA decision no. 9874702]. Moreover, the DPA considered that the corrective measures imposed on the 11 April 2023 in the context of the [https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9874702 DPA decision no. 9874702], were disregarded by the controller. Therefore, the controller violated Articles 24 and 25 GDPR. Violation of Article 5(1)(d) GDPR The DPA found various issues related to the accuracy of the data prompted out by ChatGPT. This raises questions as per the compliance of ChatGPT with Article 5(1)(d) GDPR. However, considering that such questions of accuracy are yet to be resolved, and thus ongoing after the date 14 February 2024, the DPA found it appropriate to apply the one-stop-shop mechanism and refer such questions to the Irish DPA. Use of Article 166(7) of the Privacy Code The DPA exercised for first time its new powers under [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2003-06-30;196!vig=~art166 Article 166(7) of the Privacy Code] and ordered OpenAI to carry out a six-month institutional communication campaign aimed at enhancing transparency in the processing of personal data. The campaign, which must be broadcast across radio, television, newspapers, and the internet, will focus on informing the public about ChatGPT's data practices, specifically the collection of both user and non-user data for AI model training. The content of the campaign, to be agreed upon with the Authority, must educate individuals about their rights under the GDPR, including the right to object, rectify, and delete personal data. The goal is to enable users and non-users to better understand how to exercise their rights and to oppose the use of their data for training generative AI models. Imposition of a fine In light of the aforementioned violations, the Italian DPA imposed a fine of € 15,000,000 on OpenAI, for the numerous violations of the GDPR.