The legal aspects of AI - The Italian ChatGPT Case

In terms of personal data protection, the procedure and decision of the Italian data protection authority regarding ChatGPT are significant. In the spring of 2023, a data protection incident occurred with the Italian ChatGPT service, resulting in the leakage and availability of users' personal data to other users. OpenAI, the operator of ChatGPT, did not report the incident to the authority, prompting an immediate ban on the service within Italy, which OpenAI promptly complied with.

In its decision containing the temporary measures, the Italian authority also found that the service provider does not provide its users adequate information about the data and its sources used during the system's training, the legal basis for data processing, does not ensure the accuracy of the data, and does not implement any age verification solutions. The resumption of the service was made conditional, among other things, on the provider adequately and clearly fulfilling its information obligations, providing a tool for exercising data subjects' rights, and firstly introducing an age-related question during registration.

After OpenAI complied with the authority's requirements, ChatGPT was allowed to resume operations in Italy. However, the Italian authority imposed further long-term obligations for continued operation: firstly, a solution must be found to verifiably prevent users under the age of 13 from accessing the service, and ensure that users aged 13 to 18 can only access ChatGPT with parental consent. Secondly, the provider had to conduct an information campaign in the Italian mass media, in a form and content pre-approved by the authority.

The compliance procedure regarding the service's operation continued following the temporary decision by the Italian authority. In connection with this, other data protection authorities also initiated proceedings to investigate ChatGPT, and the European Data Protection Board established a taskforce aimed at examining data protection compliance, within which the various EU data protection authorities are cooperating.

In our new series, Lawyer Dr. Gábor Keszey gatheres the most important legal aspects of using AI in the creative industry, in the first part he introduces the topic, then he explains the current ruling of the European Union, then he presents the data privacy aspects.  On our weKNOW content platform we dicuss the ethical problems appearing aroud using AI, but we also show what you can expect in the digital and creative advertising in 2024 and how weCAN agencies have been using AI in their dialy work, both the media and creative side too.