Italy, first country to temporarily ban ChatGPT for breaching privacy regulations

Italy, first country to temporarily ban ChatGPT for breaching privacy regulations

Why has ChatGTP been banned in Italy?

Italy proceeded to temporarily ban the tool, considering that it carries out data processing contrary to the European Data Protection Regulation (GDPR), in breach of Articles 5, 6, 8, 13 and 25. Specifically, the Garante per la Protezione dei Dati Personali, considers it invalid to use the execution of the contract as the basis of legitimacy for the collection of personal data of users, at least of the free tool. Furthermore, the Italian Authority considers that there is a breach of the duty to provide information, hindering the exercise of the rights of data subjects, as well as the lack of systems for verifying the age of users, allowing underage users to use the platform.

• Regarding the lawfulness of processing users’ personal data for the purpose of training AI algorithms and language, the Italian Authority considers that the reference to the performance of a contract is unacceptable, and OpenIA as Data Controller must justify the processing to an adequate basis of legitimacy.

• Regarding the exercise of data subjects’ rights, both for users and non-users, there should be a way to request the cancellation, erasure and/or rectification of personal data. Perhaps, where the matter becomes more challenging for OpenAI is that it should not only find a way to allow the exercise of these rights for users of the tool, but also for any person requesting the opposition to the processing of their personal data when these have been provided by a third party to ChatGPT.

• Due to the lack of age verification systems, despite the fact that the tool has a disclaimer on the minimum age for its use in its terms and conditions of use of service, it does not carry out any measure for the verification of the said minimum 13 years of age, and therefore could not only be processing the data of minors, but also exposing them to content that is unsuitable or inappropriate for their age.

This is not the first time that Italy has made use of the urgency procedure provided for in the GDPR, according to which the supervisory authority concerned may, under exceptional circumstances and when it considers that it is urgent to intervene to protect the rights and freedoms of data subjects, immediately adopt provisional measures intended to produce legal effects in its own territory, with a specified period of validity that may not exceed three months.

On the basis of this mechanism, the Garante per la Protezione dei Dati Personali already temporarily blocked TikTok in 2021 for lacking adequate age verification systems, following the death of a 10-year-old Italian girl who was participating in a challenge on the platform.

 Responsibility of ChatGTP after blocking

Thanks to the ban, it seems that OpenIA has modified and improved the privacy of the tool, at least for the user. The deadline given by the Italian Authority to OpenIA to remedy and comply with the checklist provided expired on 30 April, facing a possible penalty of 4% of its annual turnover or 20 million. It seems that the measures implemented are positive and that from now on the ChatGPT user will be able to delete the conversation history as well as configure the conversation history to restrict the use of the data and information included in the conversations in the training of the tool. As for the questioned basis of legitimacy, it has been modified to protect the processing of data under the umbrella of legitimate interest.

It remains to be seen the development of the required media awareness campaign (radio, television and Internet) whose deadline expires on May 15, as the last of the ”duties” imposed by the Italian Authority to OpenIA.

What are the implications of this ban?

On the other hand, it has been a call for proactivity from other Authorities, in particular the European Data Protection Board. Given the recent action of the Italian authority against Open AI, the members of the EDPB have agreed to create a specific Task Force to resolve issues related to ChatGPT and OpenIA. Moreover, the European Parliament itself has accelerated the reaching of a political agreement on the proposed Artificial Intelligence Regulation. Similarly, other European Data Protection Authorities have started their own investigations, such as the Spanish Data Protection Agency (AEPD).

Beyond the European Union, Japan is publishing a White Paper on Artificial Intelligence and Data Protection that develops policies for the use of AI in public and private sector environments. On the other side of the pond, Joe Biden and his administration are working towards a proposed law to regulate AI, although the concern beyond privacy protection appears to be labour market protection.

What does it mean for the development of artificial intelligence?

While the focus of attention this time is on OpenIA, developer of ChatGPT, the Data Protection Supervisory Authorities will be watching closely how the big platforms incorporate Artificial Intelligence into their tools, for example Microsoft and Bing.

On the other hand, and moving away from a legal opinion, from the business and entrepreneurial sector, the temporary block of the tool by Italy represents a denial and hindrance to innovation, especially in view of the fact that many companies are implementing this tool in part of their production processes or business activity. The Italian business community has reacted negatively on social networks to this temporary blocking, since from a commercial perspective, banning the tool only means denying the new reality and imposing obstacles and delays to innovation on Italian companies, suggesting that behind the excuse of privacy lies a concern for the danger to jobs and the well-being of the Italian economy.

The threat to employment positions by AI is not a trivial matter. On 22 March 2022, a Group of Experts published an Open Letter to request a halt to AI development for at least 6 months in order to study, reach a consensus and legislate the development of AI in our society. Specifically, they warn of the risks of allowing biased tool training and 

spread of deepfakes in our democratic society, allowing the development of intelligence that surpasses human intelligence and can undeniably replace us, as well as warning of the loss of control of society as a consequence of allowing technology companies themselves to determine the development of AI. For the time being, with insufficient signature gathering to effectively halt this innovation phenomenon that many are already calling the fourth industrial revolution.

Be that as it may, what is undeniable is that Artificial Intelligence is here to stay and its rapid development requires not only quick decisions to be taken by the Authorities to impose limits or control its development, but also Authorities that have sufficient technical knowledge in Artificial Intelligence and the law.

For any questions about Artificial Intelligence or its implementation in your company, do not hesitate to contact Letslaw by RSM. We will be glad to advise you!