GEDI Gruppo Editoriale S.p.A. and the participating GEDI companies – Warning (Italy, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
GEDI Gruppo Editoriale S.p.A. received a warning from Italy's data protection authority for a contract with OpenAI that raised concerns about data sharing. The authority found that GEDI did not fully consider the legal requirements for processing personal data. This warning highlights the importance of clear data handling practices when working with third-party service providers.
What happened
GEDI Gruppo Editoriale S.p.A. was warned for inadequately addressing data protection rules in its contract with OpenAI.
Who was affected
Visitors and users of GEDI's content who may have their data shared with OpenAI.
What the authority found
The authority determined that GEDI lacked sufficient legal basis for processing personal data under GDPR, particularly regarding sensitive data.
Why this matters
This case emphasizes the need for companies to thoroughly assess their data-sharing agreements and ensure compliance with GDPR. It serves as a reminder that even large companies must be cautious about how they handle personal data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Entities Involved
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
GEDI Gruppo Editoriale S.p.A., the parent company of the editorial group GEDI, the controller, concluded a contract with OpenAI, with the objective of “bringing Italian-language content from GEDI's portfolio of high-quality news agencies to OpenAI users", who "will have access to attributed quotes, contents and links to GEDI publications, including La Repubblica and La Stampa". This contract will last for three years and entails a remuneration that GEDI will receive upon sharing editorial content with OpenAI. OpenAI in turn commits to use such content to allow users to do real-time research, and to have available a summary right away, comprising a hyperlink to such news. A DPIA was conducted and transmitted to the Italian DPA stating that the data processing will happen on the basis of Article 6(1)(f) GDPR, namely the legitimate interest to exercise the profession of journalist in innovatively. The DPA started this ex officio procedure on the basis of Article 58(1)(a) GDPR due to some alarming preliminary considerations. First, the party to the contract with the controller is OpenAI OpCo LLC, while according to the contract the data will be shared to OpenAI Ireland Ltd. Moreover, the contract is made with GEDI Gruppo Editoriale S.p.A., however the editorial content referred to belong to subsidiaries to GERI. Second, the legal basis for the processing, namely the transfer of data from GEDI to OpenAI, was Article 6(1)(f) GDPR. However, considering that the data processing will be of “large scale” and of “particular nature”, the DPIA did not sufficiently consider this in the context of Article 9 and 10 GDPR. Third, it is unclear how the claimed legal basis would also be relevant to train OpenAI’s artificial intelligence operations. Fourth, the transparency requirements as per Article 13 and 14 GDPR were not met. In light of all these considerations, under Article 58(1)(a) GDPR, the DPA deemed it fit to issue a warning for the plausible violations of Article 9,
Outcome
Warning
A formal warning issued by a DPA without a monetary penalty.
Related Enforcement Actions (0)
No other enforcement actions found for GEDI Gruppo Editoriale S.p.A. and the participating GEDI companies in IT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. GEDI Gruppo Editoriale S.p.A. and the participating GEDI companies - Italy (2024). Retrieved from cookiefines.eu
Last updated: