Italy’s data protection agency announced Wednesday that it will lift the country’s ban on OpenAI LP’s artificial intelligence chatbot ChatGPT if the company agrees to enforce a set of rules that will protect users’ privacy by April 30.

The Guarantor for the Protection of Personal Data, or GPDP, ordered OpenAI to suspend operations in Italy two weeks ago after citing concerns that the company did not comply with the General Data Protection Regulation, the European Union’s privacy protection law.

Officials cited concerns that the company was processing the personal information of Italian citizens at a large scale without a legal basis. The regulator expressed concerns that to train the AI, sensitive information about citizens was being swept up, such as phone numbers and addresses, which could put citizens and users at risk.

The regulators also noted that these AI models, which can answer questions and reply to prompts with human-like conversation, are prone to “hallucinations,” which can create false information. This could lead to them making up fake but realistic-sounding stories about actual people whose information was scraped from the internet.

In its statement, the GPDP said “several concrete measures will have to be implemented” by OpenAI including informing people on its website on its logic and processing and crucially age-gating to prevent underage users from accessing the site.

“OpenAI will have to draft and make available, on its website, an information notice describing the arrangements and logic of the data processing required for the operation of ChatGPT along with the rights afforded to data subjects (users and non-users),” the regulator said.

All registered users will be presented with this notice after registration, and will also be required to declare that they are above the age of 18.

The regulator will also require the platform to allow users to remove their personal data from the training data of the AI, including nonusers who have had their data scraped or if it was generated incorrectly. OpenAI will have to make the tools easily accessible to anyone to either erase their personal data or correct inaccurate information.

Finally, once OpenAI agrees to all of the above provisions will have to promote the fact that it is doing this with the GPDP in a national advertising campaign “through radio, TV, newspapers and the internet.” This will be done to inform people about the tools needed to remove their personal information from the training set for the AI.

The Italian regulator added that it will continue its probe into OpenAI’s operations it began after it ordered the ban two weeks ago and “may decide to take additional or different measures” if it discovers further infringements of the law.

Italy isn’t the only country taking an eye to the problems that generative AI such as ChatGPT and other models could create and the mass collection of data that’s required. Regulators in the U.S. and China have begun seeking public comment in order to craft future rules regarding AI regulation and the Office of the Privacy Commissioner of Canada launched an investigation into OpenAI after complaints that the company was collecting private information without consent.

Image: OpenAI