ChatGPT back up and running in Italy: the Garante’s demands

Index

In an increasingly digital world, chatbots such as ChatGPT are becoming more prevalent in a variety of industries. These technologies enable personalized and automated interactions with users, improving the conversational experience and streamlining business processes. However, the use of GPT-based chatbots requires special attention to user privacy and compliance with data protection regulations. In this context, the Garante della Privacy ordered last March 20 that ChatGPT be blocked in Italy because it was not in line with the GDPR. A measure that ended only a few days ago, following the company’s adherence to the Guarantor’s requests. But now, then, is ChatGPT compliant with the GDPR? Let’s find out in this article.

Chat GPT: why it had been blocked in Italy

As we mentioned, the Italian Privacy Guarantor last March 20 ordered with immediate effect, the temporary restriction of the processing of Italian users’ data against OpenAI, the U.S. company that developed and operates the platform.

In the order, the Guarantor notes the lack of information aimed at users and all data subjects whose data are collected by OpenAI, but more importantly, the absence of a legal basis to justify the massive collection and storage of personal data.

Finally, despite the fact that, according to OpenAI’s published terms, the service is aimed at those over the age of 13, the Authority points out that the absence of any filter for verifying the age of users exposes minors to responses that are totally unsuitable with respect to their level of development and self-awareness.

As a result, the company disabled the service in our country, at least until last week, when it became available again after acceding to the requests of the Guarantor.

The requests of the Privacy Guarantor

To make ChatGPT available again in Italy, the Garante della Privacy has issued guidelines and guidance for the use of GPT-based chatbots. In particular, the Supervisor required Open AI to comply with privacy regulations, take measures to ensure the security of user data, and provide detailed disclosures. In this way, the Guarantor sought to promote responsible use of ChatGPT so as to ensure the protection of users’ personal data and the quality of conversations.

Below are the main requests of the Guarantor:

  • Child protection: Open AI had to implement an age verification system when registering for the service. In fact, to access ChatGPT, as of now, you will have to declare that you are either over 18 or over 13, but with parental consent. This implementation must be submitted by September 30, 2023.
  • Data processing notice: the notice must provide information on the purpose of data processing, the categories of data processed, the recipients of the data, the rights of users and how to exercise these rights. In addition, the notice must be provided in a clear and understandable manner to users, so as to ensure transparency and correct information about the management of their personal data.
  • Legal basis: Open AI must identify a valid legal basis for processing users’ personal data, such as users’ explicit consent or the need to fulfill a contractual obligation. In addition, companies must take steps to ensure that the processing of personal data is consistent with the identified legal basis and is limited to the specific purposes for which it was collected.
  • Exercise of data usage rights: users have the right to access their personal data, to request rectification or deletion, to object to the processing of data for certain purposes, and to request data portability. In this way, users can exercise control over their personal data and ensure that their privacy is protected. Open AI will have to promote an information campaign in the media by May 15, 2023.

Conclusions

In conclusion, as of today, Open AI’s use of ChatGPT is still not fully compliant with the Italian GDPR. However, after the service was blocked in Italy, the Privacy Guarantor provided the U.S. company with some guidelines to follow and temporarily suspended the measure by making the service available again in our country. For its part, Open AI will have to act quickly to adhere to all requests and avoid further blockages.

If you would like more information on this topic or need advice on how to implement or use Open AI’s ChatGPT within your company, facility or website, please do not hesitate to contact us.

Request information