Italian privacy regulator bans ChatGPT

19 comments
  1. We should embrace technology instead of regulating it to death.

    We really risk being left behind.

  2. What a smooth brain move. Ban access to the new big thing and let the rest of the world gain advantage over you.

  3. Vertebrate cell culture-derived synthetic foods first, now AI chatbots Seems like Italian businesses are heading for some rough times. Bright minds in Italy will end up leaving quicker than they already are.

  4. > In a statement, the Italian National Authority for Personal Data Protection said that ChatGPT had “suffered a data breach on March 20 concerning users’ conversations and payment information of subscribers to the paid service”.

    > The Italian data regulator, however, criticised ChatGPT for not providing an information notice to users whose data is collected by OpenAI. It also took issue with “the lack of a legal basis justifying the collection and mass storage of personal data with the aim of ‘training’ the algorithms that run the platform”.

    This has really nothing to do with it being a AI Chatbot. Rather it is yet another “US company offers internet services to Europe, Data Protection Authority in Europe goes *So how is your GDPR compliance…. Oh it isn’t. You are banned until GDPR compliance appears*”.

    * (as I read the part about disclosure) OpenAI didn’t give timely notice of data breach to users in sufficient way (GDPR demands notifying each customer affected, not just general public notice. Which also would mean scoping who are potentially affected)
    * OpenAI doesn’t have necessary correct legal framework in place to get consent for collection and processing of Personally Identifiable data, very common for US companies not European centric. It’s a whole process of making Privacy policies, Transparency statements, identifying under which legal regime each piece of information is.

    Since as is known Personally Identifiable information can be rather expansive category. Depending how they rule it, for example every chat log with the bot might count. For which *proper GDPR compliant* permission must be collected.

    So to me this looks like, the March 20 data breach acted as a triggering motivation for Italian Data Protection Authority and then upon looking in they go “these guys doesn’t seem to even base level compliant, halt data processing”. *Command authority, which GDPR gives to DPA*. Often the harshest possible ruling is not fines, it is exactly finding of non-compliance and order of **halting processing of data until company is in compliance and presents evidence of such to the DPA**.

    As such this has nothing to do with “We are in principle against AI and it will be forever banned”. Rather “American internet company, get your consumer privacy protection sh*t together, you are playing fast and loose with GDPR obligations”.

    > will result in “the **temporary limitation** of the processing of Italian users’ data vis-à-vis [ChatGPT’s creator] OpenAI,” the watchdog said.

    So once OpenAI gets themselves a Data Protection Officer, makes a Data protection plan, implements it and goes with stack of papers and reports to Italian DPA, the ban will be lifted.

  5. As far as I can tell, this is because they aren’t following the law regarding GDRP, not because it is “AI” and they don’t understand what it is.

    Follow the law, as they should, and you can have chatGPT working again.

  6. Very ambiguous title, in reality the European headquarters have 20 days to remedy all the deficiencies on data regulation, under penalty of a fine for a small percentage of turnover.

  7. I am sure that ChatGPT is able to figure out how to implement measures and become GDPR compliant. Would be hilarious if the regulators would end up having conversations with ChatGPT 😀

  8. Italian excessive bureaucracy and regulation getting in the way of economic growth, technological development and job creation, no wonder the country is dying and getting rolled over other dynamical countries

Leave a Reply