ChatGPT is a software, known to all by now, developed in 2022 by an American research company, OpenAI L.L.C, which simulates human conversations (so-called chatbot), based on artificial intelligence and machine learning through algorithms which elaborate data.
The Italian DPA provision
On 30th march 2023, the Italian Data Protection Authority urgently intervened with provision no. 112 to order a temporary limitation to Open AI, as controller of the processing of personal data of the data subjects in the Italian territory and managed within ChatGPT, blocking the service operation.
During the meeting between the Italian Authority and OpenAI, the latter requested the revocation of the above-mentioned limitation, showing to be open to put in action a number of effective measures in order to protect the rights and freedoms of the software users at issue.
Then, the Italian DPA, with provision of 11th April 2023, suspended the effectiveness of its prior provision of temporary limitation and, at the same time, disposed a series of prescriptions that it appears to have been respected by OpenAI within the imposed deadline of the 30th April.
Requests of the Italian DPA
The prescriptions ordered by the Italian DPA to OpenAI concern, first of all, the draft of an adequately transparent notice indicating the method and the logic underlying the data processing necessary to the functioning of ChatGPT, as well as the rights to which users and interested non-users are entitled to. The notice should be easily accessible before proceeding with the possible registration to the service.
As for the legal basis of the data processing of users’ data for algorithm training purposes, the Italian DPA ordered OpenAI to subordinate the use of users’ data to their consent or legitimate interest.
Other requirements concern the provision by OpenAI of useful tools to allow the data subjects, even non-users, to ask for the correction or the cancellation of personal data from the software.
OpenAI, moreover, must allow interested non-user to exercise, easily and accessibly, the right to object the processing of their personal data.
One of the most important prescriptions is the verification of the age of the users or, anyway, the existence of the parental control for minors aged at least 13.
OpenAI has to promote, together with the Italian DPA and by May 15th 2023, an information campaign via radio, television, newspaper and internet, to inform people on the use of their personal data to train algorithms.
It is intended that the Italian Authority will continue to assess the infringement of the regulation in force that Open AI may possibly have carried out and it reserved the right to adopt any other or different measure that would be necessary.
The European Task Force on ChatGPT
After the Italian Data protection Authority, which was the first to take action, also the European Authorities gathered in the European Data Protection Board (EDPB) decided to create a task force to monitor ChatGPT.
The goal is to promote cooperation and information exchange on possible actions taken by Data Protection Authorities to apply the General Data Protection Regulation with regards to the artificial intelligence service.
Elena Bandinelli