Rationale and Impact of the Italian Ban on ChatGPT

by Matilde Serena

ChatGPT is a large language model created by OpenAI. This model is designed to process and respond to natural language queries by users. In practice. ChatGPT can generate text based on a large corpus of data that it has been trained on by means of Reinforcement Learning from Human Feedback. This tool was created with the purpose to assist users in generating human-like responses to their questions and facilitate communication by engaging in a conversation. At the present stage, ChatGPT is an increasingly safe and useful AI system. Thus, it comes with some limitations. For instance, ChatGPT sometimes generates plausible-sounding yet incorrect answers. Moreover, ChatGPT may give different answers to the same question phrased in different ways. Instead of asking the users for clarifications, ChatGPT often guesses what they intended. Another issue is that ChatGPT could potentially respond to harmful instructions or present biased answers due to the fact that, at this stage, the model is not able to refuse inappropriate requests. Moderation API works to block unsafe content and collects users’ feedback in this regard. At the present stage, ChatGPT is available in more than 160 countries and banned in more than 30. Main reasons behind ChatGPT’s bans are heavy traffic, misuse by users and security concerns. On this note, in late March, the Italian guarantor for the protection of personal data (“Garante”) asked the OpenAI Support Team to disable ChatGPT based on Article 58(2)(f) GDPR allowing national supervisory authorities to exercise their correcting powers to impose a temporary limitation e.g. based on privacy and users’ safety concerns. When communicating this to ChatGPT users, the OpenAI support Team re-stated OpenAI’s commitment to protect users’ privacy and upheld ChatGPT compliance with the General Data Protection Regulation (GDPR). This paves the way for several subquestions (1) Why was ChatGPT banned in Italy?, (2) What are the Garante’s requests?, (3) What is the impact of the ban on other countries?

Why was ChatGPT banned in Italy?

ChatGPT was banned in Italy on the grounds that (1) it did not properly informed users on the collection of their personal data, (2) it did not provide a legal reason for the collection of such data, (3) it allegedly processed personal information inaccurately, (4) it did not require users’ age verification despite generating content intended for users over 13 year old. Although the OpenAI CEO admitted in late March that a bug in an open source library (software that is free to reuse, modify and publish) allowed some users to see the titles of conversations of other users on ChatGPT, this does not seem one of the Garante’s reasons for the ban. However, the bug has now been resolved.

When examining the applicable national law, it emerges that the Italian Data Protection Code is mainly modelled after the GDPR. Therefore, there are good chances that if the Garante was to prove an infringement on the relevant Italian law, ChatGPT could be easily accused not to be in compliance with the GDPR. This could be the case based on the fact that (1) ChatGPT stores EU users’ input as a part of its training process including their personal information, (2) ChatGPT trainers have access to users’ conversations, (3) Open AI allows users to delete their accounts but not specific prompts i.e. the sentences used by users to initiate a conversation with ChatGPT. The relevant provision of the GDPR are Articles 13 and 14 for transparent information notice, Article 8 for age-verification, Article 6 (a), (b) and (f) for the legal basis pre-requisite, Articles 16-17 for data rectification of incorrect generated data and data erasure.

It is interesting to note that the Italian ban did not come without criticism in the country. For instance, some politicians claim that the Garante’s decision is rather disproportionate and that it disregards the fact that many other services based on artificial intelligence e.g. Bing’s chat seem to present the same privacy issues.

What are the requests of the Garante?

ChatGPT may be available again in Italy upon meeting the relevant privacy requirements agreed upon between OpenAI and the Garante. Moreover, the Garante required that OpenAI verifies the age of ChatGPT users and clearly explains how the personal data is collected and processed. In practice, this entails asking users for consent or legitimate interest to collect and process personal data.

Additionally, OpenAI will have to engage in an information campaign via radio, websites, newspapers and national television to explain to the public how the ChatGPT algorithm is fed and trained with users’ personal data.

What is the impact of the ban on other countries?

On the one hand, the Garante’s decision suggests that the GDPR and the existing legislation might be suitable to regulate Artificial Intelligence. On the other hand, the Italian ban caught the interest of privacy regulators of other EU Member States. Germany, for instance, might follow Italy’s footsteps by disabling ChatGPT over data security concerns, according to a spokesperson of the German federal Commissioner for Data Protection. Nevertheless, a potential ban seems to encounter resistance from the Digital Ministry of Head of Department who does not consider a ban to be a suitable solution to achieve democracy and transparency in Artificial Intelligence. Other privacy regulators in the EU, such as the French, Irish and Spanish ones, have decided to dive deeper into the issue and do not exclude the possibility of engaging in investigations.

To conclude, this post shows that concerns regarding the treatement of personal data and safety of ChatGPT’s users expressed by the Garante suggest that ChatGPT might reflect an infringement on GDPR provisions. Moreover, several national authorities are following the Italian exemple and investigating this issue. It is, nevertheless, questionable whether a ban would be disproportionate and the most suitable remedy to regulate ChatGPT.

Sources:

A Nwaokocha, ‘Italian regulator draws criticism for blocking AI chatbot ChatGPT (Cointelegraph, 3 April 2023) <https://cointelegraph.com/news/italian-regulator-draws-criticism-for-blocking-ai-chatbot-chatgpt> accessed 23 April 2023.

B Gillmann et al, ‘Man kann Technologie nicht mit Verboten aufhalten’: Diskussion um ChatGPT Regulierung in Deutschland’ (Handelsblatt, 3 April 2023) <https://www.handelsblatt.com/politik/deutschland/nach-vorstoss-in-italien-man-kann-technologie-nicht-mit-verboten-aufhalten-diskussion-um-chatgpt-regulierung-in-deutschland/29075002.html > accessed 23 April 2023.

GPDP Provvedimento del 30 Marzo 2023 [9870832]

<https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9870832> accessed 23 April 2023.

K Hines, ‘Exploring Italy’s ChatGPT Ban And Its Potential Impact’ (Search Engine Journal, 6 April 2023) <https://www.searchenginejournal.com/chatgpt-ban-italy/484157/> accessed 23 April 2023.

L Kayali et al, ‘ChatGPT could come back to Italy by the end of April’ (POLITICO, 12 April 2023) <https://www.politico.eu/article/chatgpt-italy-lift-ban-garante-privacy-gdpr-openai/> accessed 23 April 2023.

Open AI, ‘Introducing ChatGPT’ (openai.com, 30 November 2022) <https://openai.com/blog/chatgpt> accessed 23 April 2023.

R Browne, ‘OpenAI CEO admits a bug allowed some ChatGPT users to see others’ conversation titles’ (CNBC, 23 March 2023) <https://www.cnbc.com/2023/03/23/openai-ceo-says-a-bug-allowed-some-chatgpt-to-see-others-chat-titles.html> accessed 23 April 2023.

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) OJ L 119.

S Mukherjee, ‘Italy’s ChatGPT ban attracts EU privacy regulators’ (Reuters, 3 April 2023) <https://www.reuters.com/technology/germany-principle-could-block-chat-gpt-if-needed-data-protection-chief-2023-04-03/> accessed 23 April 2023.