Italy’s Data Protection Authority (Garante) has fined OpenAI €15.58 million over violations of data protection laws. The investigation scrutinised the handling of personal data by ChatGPT, citing concerns about transparency and the legal justification for processing user information.
First GDPR Penalty Against OpenAI in Europe
The Italian watchdog’s decision, announced on December 20, 2024, marks the first significant General Data Protection Regulation (GDPR) penalty against a major player in the generative AI sector in Europe. According to Garante’s findings, OpenAI had processed users’ personal data for training ChatGPT without an adequate legal basis, thus violating principles of transparency and failing to meet information obligations towards users.
Transparency and Compliance Issues
The investigation also found the company failed to comply with transparency requirements and lacked an effective age verification system to shield children under 13 from potentially harmful content. In addition to the fine, OpenAI has been ordered to run a six-month public awareness campaign in Italian media, detailing how ChatGPT collects and uses data from both users and non-users to train its algorithms.
OpenAI described the decision as ‘disproportionate” and announced plans to appeal. The company stated that the fine exceeds its revenue from Italy during the relevant period and emphasised its cooperation with the regulator along with efforts to address prior privacy concerns.
Enforcement and Cooperation
The investigation began in 2023 after Italy’s watchdog, known as Garante, temporarily banned ChatGPT for breaching EU privacy rules. The ban was lifted after OpenAI implemented changes, including allowing users to opt out of their data being used for algorithm training. The €15 million penalty is part of GDPR enforcement, which allows fines up to €20 million or 4% of a company’s global turnover.
Garante stated that OpenAI’s cooperative stance was considered when determining the penalty, suggesting it could have been higher. OpenAI recently concluded its ‘12 Days of OpenAI’ by launching the next-generation frontier models o3 and o3 Mini.
