Italy's data protection authority temporarily banned ChatGPT over privacy violations including lack of legal basis for data collection, a data breach exposing user conversations and payment information, and inadequate age verification for minors.
In March 2023, Italy's data protection authority (Garante) issued a temporary ban on OpenAI's ChatGPT chatbot over alleged violations of the EU's General Data Protection Regulation (GDPR). The regulator found that OpenAI lacked legal basis for the 'mass collection and storage of personal data' used to train ChatGPT's algorithms and processed data inaccurately. Additionally, ChatGPT suffered a data breach that exposed users' conversations and payment information. The authority also cited OpenAI's failure to verify user ages, exposing minors to inappropriate content. OpenAI was given 20 days to bring ChatGPT into compliance or face penalties up to 4% of global revenue. Following the ban, OpenAI disabled access to ChatGPT in Italy but disagreed with the findings, stating they believed they complied with GDPR. By April 28, 2023, ChatGPT was reactivated in Italy after OpenAI addressed the concerns by implementing age verification tools, providing greater visibility of privacy policies, offering user content opt-out forms, and creating mechanisms for EU users to object to personal data use in model training. OpenAI also introduced an 'incognito mode' that doesn't save conversation history and planned a business subscription with additional data controls.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
AI system
Due to a decision or action made by an AI system
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
No population impact data reported.