Italy’s data protection authority has given OpenAI a list of changes it says are needed before ChatGPT can become available in the country again. The measures follow the authority’s order limiting the processing of Italian users’ data amid suspected breaches of the EU’s General Data Protection Regulation (GDPR).
Transparency and user rights come first
Most measures have an April 30 deadline. OpenAI must publish an information notice explaining how ChatGPT processes data, how that processing works, and what rights people have. The notice must be easy to find and available before someone signs up.
The requirements cover both users and non-users. People must have accessible ways to seek corrections or deletion of personal data, including when ChatGPT generates false information about them. If correcting that information is technically unfeasible, the authority says OpenAI must offer a way to delete the person’s data.
People must also be able to object to the use of their personal data to train OpenAI’s algorithms. The authority says non-users need a way to exercise that right, and users must also have it if OpenAI chooses legitimate interests as its legal basis for processing their data.
OpenAI must clarify why it uses data for training
The Italian authority has narrowed the legal bases OpenAI may cite for processing people’s data to train its algorithms: consent or legitimate interests. It says OpenAI must remove references to performance of a contract as a basis for that processing.
The authority has not yet decided whether either of the remaining grounds can lawfully support OpenAI’s purposes. Its request for OpenAI to choose between them is a compliance demand, while its investigation into possible GDPR infringements continues.
New age checks are required
OpenAI must immediately add an age gate to prevent minors from accessing ChatGPT. Italian users must confirm they are over 18 before signing up. People who registered before the order must see the information notice and pass through an age gate when the service is reactivated.
The authority has also set a longer timetable for stronger age verification. OpenAI must submit a plan by May 31 for technology that filters out users below age 13 and users aged 13 to 18 who have not obtained parental consent. The deadline to have that system in place is September 30.
Deadlines shape the path back to Italy
The authority says OpenAI must complete most of the measures by April 30 for it to lift the temporary limitation on processing Italian users’ data. A local awareness campaign about the company’s use of information to train its AI has a later deadline: May 15. The campaign is to use radio, TV and the internet.
The measures are based on the authority’s preliminary concerns, and the formal investigation is still underway. The Garante said it could impose additional or different measures after its fact-finding is complete. The article reported that OpenAI had not replied to TechCrunch’s request for comment by press time.