DeepL vs ChatGPT
99 removals
51 lines
93 additions
49 lines
Provision of March 30, 2023
Decision of March 30, 2023
Register of Measures
Register of decisions No. 112 of March 30, 2023
No. 112 of March 30, 2023
THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA
THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA
HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter, "Regulation");
HAVING REGARD to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, "Regulation");
HAVING ALSO CONSIDERED the Personal Data Protection Code (Legislative Decree No. 196 of June 30, 2003);
HAVING REGARD also to the Personal Data Protection Code (Legislative Decree No. 196 of June 30, 2003);
TAKEN NOTE of the numerous media interventions regarding the operation of the ChatGPT service;
TAKING NOTE of numerous media interventions concerning the functioning of the ChatGPT service;
NOTED, from a verification carried out in this regard, that no information is provided to users, nor to data subjects whose data were collected by OpenAI, L.L.C. and processed through the ChatGPT service;
HAVING FOUND, from a verification carried out in this regard, that no information is provided to users, nor to the data subjects whose data have been collected by OpenAI, L.L.C. and processed through the ChatGPT service;
NOTED that there is no suitable legal basis in relation to the collection of personal data and their processing for the purpose of training the algorithms underlying the operation of ChatGPT;
HAVING FOUND the absence of a suitable legal basis concerning the collection of personal data and their processing for the purpose of training the algorithms underlying the functioning of ChatGPT;
NOTED that the processing of personal data of data subjects is inaccurate in that the information provided by ChatGPT does not always correspond to the actual data;
HAVING FOUND that the processing of personal data of the data subjects is inaccurate as the information provided by ChatGPT does not always correspond to the actual data;
NOTED, moreover, the absence of any verification of the age of users in relation to the ChatGPT service which, according to the terms published by OpenAI L.L.C., is reserved for individuals who are at least 13 years old;
HAVING FOUND, furthermore, the absence of any age verification of users concerning the ChatGPT service which, according to the terms published by OpenAI L.L.C., is reserved for persons who have reached at least 13 years of age;
WHEREAS, the absence of filters for children under the age of 13 exposes them to responses that are totally unsuitable with respect to their degree of development and self-awareness;
CONSIDERING that the absence of filters for minors under the age of 13 exposes them to absolutely unsuitable responses concerning their level of development and self-awareness;
CONSIDERED, therefore, that in the situation outlined above, the processing of personal data of users, including minors, and data subjects whose data are used by the service is in violation of Articles 5, 6, 8, 13 and 25 of the Regulations;
DEEMED, therefore, that in the situation outlined above, the processing of personal data of users, including minors, and of the data subjects whose data are used by the service is in violation of Articles 5, 6, 8, 13, and 25 of the Regulation;
WHEREAS, therefore, it is necessary to order, pursuant to Article 58(2)(f) of the Regulation - as a matter of urgency and pending the completion of the necessary preliminary investigation with respect to what has emerged thus far with respect to OpenAI L.L.C., the U.S. developer and operator of ChatGPT, the measure of provisional restriction of processing;
HAVING FOUND, therefore, the need to arrange, pursuant to Article 58, paragraph 2, letter f), of the Regulation - urgently and pending the completion of the necessary investigation concerning what has emerged so far against OpenAI L.L.C., a US company that develops and manages ChatGPT, the measure of the temporary limitation of processing;
CONSIDERED that, in the absence of any mechanism for verifying the age of the users, as well as, in any case, the totality of the violations detected, said provisional limitation should be extended to all the personal data of the interested parties established in the Italian territory;
CONSIDERED that, in the absence of any age verification mechanism for users, and, in any case, of the complex of the violations found, such temporary limitation must extend to all personal data of data subjects established in Italian territory;
CONSIDERING it necessary to order the aforementioned limitation with immediate effect as of the date of receipt of this measure, reserving any other determination upon the outcome of the definition of the preliminary investigation initiated on the case;
CONSIDERED it necessary to arrange the aforementioned limitation with immediate effect from the date of receipt of this decision, reserving any other determination at the conclusion of the investigation initiated on the case;
RECALLED that, in the event of non-compliance with the measure ordered by the Guarantor, the criminal sanction provided for in Article 170 of the Code and the administrative sanctions provided for in Article 83, par. 5, letter e), of the Regulations shall apply;
RECALLED that, in the event of non-compliance with the measure ordered by the Guarantor, the criminal sanction referred to in Article 170 of the Code and the administrative sanctions provided for by Article 83, paragraph 5, letter e), of the Regulation shall apply;
CONSIDERED, on the basis of the above, that the conditions for the application of Article 5, paragraph 8, of Regulation no. 1/2000 on the organization and functioning of the office of the Guarantor, which provides that "In cases of particular urgency and unavailability that do not allow the convening of the Guarantor in due time, the president may adopt the measures within the competence of the body, which cease to be effective from the moment of their adoption if they are not ratified by the Guarantor in the first useful meeting, to be convened no later than the thirtieth day."
DEEMED, based on the above description, that the conditions for the application of Article 5, paragraph 8, of Regulation No. 1/2000 on the organization and functioning of the Guarantor's office are met, which provides that "In cases of particular urgency and necessity that do not allow the timely convening of the Guarantor, the president may adopt the measures of competence of the body, which cease to have effect from the moment of their adoption if they are not ratified by the Guarantor in the first useful meeting, to be convened within thirty days";
HAVING REGARD to the documentation on file;
HAVING SEEN the documentation on file;
WHEREAS, THE GUARANTOR:
HAVING SAID ALL OF THIS, THE GUARANTOR:
(a) Pursuant to Article 58(2)(f) of the Regulation, orders, as a matter of urgency, against OpenAI L.L.C., a U.S. company developer and operator of ChatGPT, in its capacity as the owner of the processing of personal data carried out through that application, the measure of provisional limitation, of the processing of personal data of data subjects established in the Italian territory;
a) pursuant to Article 58, paragraph 2, letter f), of the Regulation, orders, as a matter of urgency, against OpenAI L.L.C., a US company that develops and manages ChatGPT, as the data controller of the personal data processed through such application, the measure of temporary limitation of processing of personal data of data subjects established in Italian territory;
(b) the aforementioned limitation shall take effect immediately from the date of receipt of this measure, subject to any other determination upon the outcome of the definition of the preliminary investigation initiated on the case.
b) the aforementioned limitation takes immediate effect from the date of receipt of this decision, reserving any other determination at the conclusion of the investigation initiated on the case.
The Guarantor, pursuant to Article 58(1) of Regulation (EU) 2016/679, invites the data controller addressee of the measure, also, within 20 days from the date of receipt of the same, to communicate what steps have been taken in order to implement the prescribed and to provide any element deemed useful to justify the violations highlighted above. Please note that failure to respond to the request pursuant to Article 58 is punishable by the administrative sanction set forth in Article 83(5)(e) of Regulation (EU) 2016/679.
The Guarantor, pursuant to Article 58, paragraph 1, of Regulation (EU) 2016/679, invites the data controller recipient of the decision, also, within 20 days from the date of receipt of the same, to communicate what initiatives have been taken to implement the prescribed measures and to provide any element deemed useful to justify the violations highlighted above. It should be noted that failure to respond to the request pursuant to Article 58 is punishable with the administrative sanction referred to in Article 83, paragraph 5, letter e), of Regulation (EU) 2016/679.
Pursuant to Article 78 of the Regulation, as well as Articles 152 of the Code and 10 of Legislative Decree No. 150 of September 1, 2011, against this measure may be appealed to the ordinary judicial authority, with an appeal filed with the ordinary court of the place where the data controller resides, within the term of thirty days from the date of communication of the measure itself, or sixty days if the applicant resides abroad.
Pursuant to Article 78 of the Regulation, as well as Articles 152 of the Code and 10 of Legislative Decree No. 150 of September 1, 2011, an appeal against this decision may be lodged with the ordinary judicial authority, with an application filed with the ordinary court of the place where the data controller resides, within thirty days from the date of communication of the decision itself, or sixty days if the applicant resides abroad.
In Rome, March 30, 2023
In Rome, March 30, 2023
THE CHAIRMAN
THE PRESIDENT Stanzione
Stanzione