ChatGPT Resumes Service in Italy with Privacy Disclosures for Compliance
OpenAI, the company behind ChatGPT, has recently announced the resumption of its chatbot services for users in Italy. This comes after the company added privacy disclosures to meet the initial set of conditions set by the local data protection authority. The Italian data protection authority, Garante, previously had concerns regarding the services' compliance with the EU data protection laws. Hence, the regulator ordered a temporary stop-processing order on ChatGPT, resulting in geoblocking of Italian IP addresses at the start of April.
However, following OpenAI's implementation of the ordered measures, the Garante has lifted the suspension order and allowed ChatGPT to resume service for Italian users. Upon clicking the "I meet OpenAI's age requirements" button, users must confirm they are 18+ or 13+ with consent from a parent or guardian to use the service.
OpenAI has expanded its privacy policy and provided users and non-users with more information about the personal data it has been processing to train its algorithms. The company has also added mechanisms to enable data subjects to obtain erasure of information that is considered inaccurate and to have their data deleted. Users wanting to opt-out from the processing of their personal data for training AI can do so by a form OpenAI has made available.
Privacy Controls for ChatGPT
OpenAI's dedication to protecting user's privacy has led to the following changes in how ChatGPT presents its services to Europeans:
- Age-gating to prevent minors from accessing the service
- Expansion of the privacy policy
- Providing users with more information about the personal data being processed
- Offering the right to opt-out of processing data for training algorithms
- Adding mechanisms to enable data subjects to obtain erasure of information that is considered inaccurate
- Providing a form to opt-out from the processing of personal data for training AI
OpenAI's endeavour to satisfy the Italian data protection authority's conditions has resulted in notable changes to the level of control ChatGPT offers Europeans. However, it remains unclear whether the tweaks OpenAI has implemented will resolve all the GDPR concerns being raised. Specifically, it is still unknown whether Italians' personal data that was used to train its GPT model historically was processed with a valid lawful basis, or whether data used to train models previously will or can be deleted if users request their data deleted now.
OpenAI appears to be hoping to bound the objections being raised about what it's been doing with Europeans' information by providing some limited controls now, applied to new incoming personal data, in the hopes this fuzzes the wider issue of all the regional personal data processing it's done historically.
