The block (and unblocking) of ChatGPT in Italy: causes, changes and solutions adopted.

ChatGPT is a language model developed by OpenAI based on the GPT-4 architecture. It is designed to understand and generate text in a similar way to humans, making it possible to create smooth and coherent conversations. However, on 30 March 2023, the use of ChatGPT was blocked in Italy due to concerns about user privacy and data protection. In this article, we will explore the reasons for the block, the changes requested by the Garante Privacy to OpenAI and the solutions that have been implemented to solve the problem and protect the privacy of Italian citizens.

The ChatGPT blockade in Italy

The blocking of ChatGPT in Italy, self-imposed by OpenAI itself, had been caused by a measure of the Garante (Italian Data Protection Authority) that had ordered the platform to temporarily restrict the processing of Italian users’ data until it complied with Italian and European privacy regulations. The Garante, in an emergency measure, had found that the use of ChatGPT could violate privacy regulations, such as the European Union’s General Data Protection Regulation (GDPR), which provides for strict protection of individuals’ personal data.

The reason for the blockade

In its decision of 30 March, the Garante per la Protezione dei Dati Personali had identified several reasons for concern regarding the use of ChatGPT in the country. Among these, the main ones were:

• the lack of information to users and all stakeholders whose data are collected by OpenAI, 
• the absence of a legal basis justifying the massive collection and storage of personal data for the purpose of ‘training’ the algorithms underlying the operation of the platform;
• incorrect processing of personal data due to the plaintiff’s inaccurate information provided by ChatGPT 
• the absence of any filter for verifying the age of users, which exposed minors to answers that were totally unsuited to their level of development and self-awareness.

Required changes to OpenAI

To address these concerns, the Garante requested OpenAI to make a number of changes and interventions to the platform on which ChatGPT operates in order to ensure greater protection of users’ privacy. Among the main changes, the Garante requested to:

1. Set up an information notice on the site to explain data processing and the rights of data subjects, including non-users of ChatGPT.
2. Provide a tool to exercise the right to object to the processing of data for algorithm training.
3. Allow the correction or deletion of inaccurate personal data through a tool on the site.
4. Insert a link to the information during registration, visible before completing the process.
5. Change the legal basis of data processing for algorithm training from contract to consent or legitimate interest.
6. Provide a means to exercise the right to object to the processing of data for algorithm training, if based on legitimate interest.
7. Implement an age gate for Italian users, excluding minors.
8. Submit a plan to the Supervisor for the adoption of age verification tools by 31 May 2023, with implementation by 30 September 2023.
9. Promote an information campaign by 15 May 2023, agreed with the Garante, to inform about data collection and the tools available to delete personal data.

Changes implemented by OpenAI

In response to the Garante’s requests, OpenAI implemented a number of changes to ChatGPT to ensure greater privacy protection for Italian users. Among the main changes adopted are:

1. The provision of information accessible to both European and non-European users and non-users concerning the processing of personal data for algorithm training and the right to object to such processing.
2. The expansion of the data processing information for users by making it accessible in the registration mask before a user registers for the service.
3. The right to object to the processing of personal data for algorithm training can also be exercised by non-users resident in Europe by providing an easily accessible, online form.
4. The introduction of a welcome screen when ChatGPT is reactivated in Italy, with references to the new privacy policy and how personal data are processed for algorithm training.
5. The provision was made for those concerned to have any information they considered to be incorrect deleted. In addition, however, OpenAI declared itself technically unable to correct the errors.
6. Explaining, in the user information, the legal basis for the processing of personal data for algorithm training and the proper functioning of the service.
7. The implementation of a form allowing all European users to exercise their right to object to the processing of their personal data and thus be able to exclude conversations and their history from the training of their algorithms.
8. The inclusion in the welcome screen reserved for Italian users who are already registered a button through which, in order to re-access the service, they will have to declare that they are of age or over 13 and, in this case, have parental consent.
9. Inclusion of the date of birth request in the service registration mask, with a block on registration for users under 13 years of age and the need to confirm parental consent for users over 13 years of age but under 18.

The above actions were welcomed by the Garante, which suspended the personal data processing restriction order against OpenAI and, at the same time, reopened the platform to Italian users.