The News: Last week Italy’s data protection authority (DPA) ordered OpenAI to immediately stop processing Italians’ data for the ChatGPT service with concerns that ChatGPT is breaching the European Union’s General Data Protection Regulation (GDPR). Italy issued the order to temporarily block ChatGPT over concerns OpenAI has unlawfully processed user data, as well as over the lack of any system to prevent minors from accessing the tech. Read more from Tech Crunch.
Italy DPA Announces Ban of OpenAI’s ChatGPT, Will Other EU Countries Follow Suit?
Analyst Take: In what was pretty big news this last week, the wildly popular ChatGPT by OpenAI has been temporarily banned in Italy by Italy’s data protection authority (DPA), also known as Garante.
The Italian DPA said that it is concerned that OpenAI’s ChatGPT is breaching the EU’s General Data Protection Regulation (GDPR), opening an investigation. Specifically, the Garante has issued the order to block ChatGPT over concerns OpenAI has unlawfully processed Italian user data, as well as due to concerns about the lack of any system to prevent minors from accessing the tech. Valid concerns, and not surprising given the EU’s more stringent approach to user data privacy and protections.
When Moving Fast Can Sometimes Spell Trouble
In the tech industry, moving fast is a common tactic, and it often happens without a variety of factors that later turn out to be important being taken into consideration. And it can often result in trouble down the line. I think it’s safe to say that the prevailing attitude of many tech startups is to just do it and face the consequences later. This mindset can often cause trouble down the line, which is where it appears we are with OpenAI and ChatGPT in Italy. It’s those consequences that we are now starting to see.
The Garante’s concerns are valid. These are the early days of ChatGPT and this is very much uncharted territory. But with the massive adoption of ChatGPT by users the world over, concerns are quickly rising. According to a statement made by the Garante there “appears to be no legal basis underpinning the massive collection and processing of personal data in order to ‘train’ the algorithms on which the platform relies.” Oops.
Garante also noted concerns about how the chatbot can, in many instances, serve factually incorrect information in its responses. ChatGPT and other generative AI chatbots are known to sometimes produce erroneous information about named individuals, which AI makers refer to as “hallucinating.” In the EU, this is more than a little problematic since the GDPR provides individuals with a suite of rights over their information including a right to rectification of erroneous information. Currently, it is not clear if OpenAI has a system in place where users can ask the chatbot to fix inaccurate information about them, but if I was a betting person, I’d bet the answer to that one is a solid no.
Also problematic: OpenAI does not appear to have informed anyone whose online data it found and which has been or is being used to train the technology, such as scraping information from internet forums about the use of their data. Nor has OpenAI been entirely open about the data it is processing, particularly not for ChatGPT-4. While the training data OpenAI used may have been public (posted online), the GDPR still requires users and people whose data has been scraped to be informed of that use.
OpenAI has geoblocked ChatGPT in Italy and the company has 20 days to respond to the order. OpenAI risks a hefty fine of 20 million euros ($21.8 million), or 4% of its global annual revenue if it doesn’t come up with remedies to the situation in 20 days.
The European Union and AI
Italy isn’t the only country grappling with the rapid pace of AI progression and its implications for society. Other governments are coming up with their own rules for AI, which no doubt will include generative AI, the set of AI technologies that generates new content based on prompts from users. It is more advanced than previous iterations of AI, thanks to new large language models, which are trained on vast quantities of data.
The European Union (EU), often at the forefront when it comes to tech regulation, has proposed groundbreaking legislation on AI known as the European AI Act which will heavily restrict the use of AI in critical infrastructure, education, law enforcement, and the judicial system. The draft of the proposed legislation considers ChatGPT to be a form of general purpose AI used in high-risk applications. High-risk AI systems are defined by the EU Commission as those that could affect people’s fundamental rights or safety. These systems would face measures including tough risk assessments and a requirement to stamp out discrimination arising from the datasets feeding algorithms.
Privacy regulators in France and Ireland have reached out to their counterparts in Italy to find out more about the basis of the ban and it’s been reported that Germany could follow in Italy’s footsteps by blocking ChatGPT over data security concerns. However, the privacy regulator in Sweden said it did not plan to ban ChatGPT nor was in contact with the Italian regulator. Spain’s regulator said it had not received any complaint about ChatGPT but did not rule out a future investigation.
It’s clear that we are in the early days of the transformative power of generative AI and regulators are playing a frantic game of catch-up as it relates to concerns around data privacy and how this technology plays with existing legislation designed to protect user privacy. Italy is the first to take action, but it feels inevitable that others, certainly in the EU, will follow.
Disclosure: Futurum Research is a research and advisory firm that engages or has engaged in research, analysis, and advisory services with many technology companies, including those mentioned in this article. The author does not hold any equity positions with any company mentioned in this article.
Analysis and opinions expressed herein are specific to the analyst individually and data and other information that might have been provided for validation, not those of Futurum Research as a whole.
Other insights from Futurum Research:
Microsoft Rolls Out Teams Premium Infused with OpenAI’s GPT-3.5
Microsoft and OpenAI Deepen Partnership
Microsoft and OpenAI Announce Expanded Partnership with Multi-Billion Dollar Investment
Image Credit: ChatGPT
Author Information
Shelly Kramer is a Principal Analyst and Founding Partner at Futurum Research. A serial entrepreneur with a technology centric focus, she has worked alongside some of the world’s largest brands to embrace disruption and spur innovation, understand and address the realities of the connected customer, and help navigate the process of digital transformation. She brings 20 years' experience as a brand strategist to her work at Futurum, and has deep experience helping global companies with marketing challenges, GTM strategies, messaging development, and driving strategy and digital transformation for B2B brands across multiple verticals. Shelly's coverage areas include Collaboration/CX/SaaS, platforms, ESG, and Cybersecurity, as well as topics and trends related to the Future of Work, the transformation of the workplace and how people and technology are driving that transformation. A transplanted New Yorker, she has learned to love life in the Midwest, and has firsthand experience that some of the most innovative minds and most successful companies in the world also happen to live in “flyover country.”
