Italy’s data protection authority has OpenAI’s ChatGPT lined up in its sights: After briefly banning the service from being used last year because of alleged privacy violations, the Garante today formally filed charges against the artificial intelligence developer.

According to TechCrunch, the Garante hasn’t publicly disclosed the exact nature of the claims being made against OpenAI. What it did say is that the charges stem from a months-long investigation into the company’s data practices, and OpenAI has been given 30 days to respond to them. The company reportedly faces a fine of up to €20 million or 4% of its global annual revenue, as mandated by Europe’s General Data Protection Regulation.

It’s said that the Garante’s investigation is related to concerns that were first raised last year, when regulators said ChatGPT was in potential violation of the GDPR from the way it processed the personal information of Italians at large scale without any legal basis to do so. Under GDPR rules, companies must also properly disclose their practices around data collection and storage to EU users, which OpenAI doesn’t seem to do satisfactorily.

Following last year’s brief ban, OpenAI agreed to add a new page and form to its website that provided more transparency around its data practices. ChatGPT was then made available once more in Italy, pending the outcome of a more thorough investigation.

That investigation appears to have culminated with the official charges against OpenAI, and it’s believed one of the main concerns relates to the way the company scrapes data from the public internet to train its chatbots. According to TechCrunch, the issue is that even public data can contain a lot of personal information. In the EU, processing such data can only be done if a company has a “valid legal basis” to do so, and even if that criteria is met, companies must also ask for permission.

The GDPR stipulates six possible situations under which companies can legally collect such data, but most are not relevant in the case of OpenAI. The only one that really fits is the claim of “legitimate interests”, but whether the Garante will agree that it’s justifiable isn’t clear. It’s notable that the European Union’s top court previously ruled against Meta Platforms Inc.’s claim that it was in the legitimate interest of the public to track and profile individuals to power its behavioral advertising algorithms.

OpenAI is also likely to run afoul of the GDPR because it has never sought to obtain the consent of millions of EU citizens to ingest and process their personal data to train its AI models. Under the GDPR, companies must not only do this, but also provide an easy way for those who own that data to opt out and prevent their information from being processed.

It remains to be seen how OpenAI will respond to the charges, but the company’s chief executive officer Sam Altman has previously threatened to quit operating in the EU altogether if it decides it cannot comply with its regulations.

Family-friendly GPTs

In related news, OpenAI is making efforts elsewhere to win over the trust of not only politicians, but also parents. In an announcement today, it said it’s partnering with a nonprofit organization called Common Sense Media, which has the mission of reviewing and rating the suitability of various media and technology for children.

Under the partnership, OpenAI and Common Sense Media will work together to curate “family-friendly” GPTs that will be based on Common Sense Media’s ratings and standards, and made available in the company’s marketplace, the GPT Store. They’ll also work to establish AI guidelines and create educational materials for parents, educators and young adults, OpenAI said.

“AI offers incredible benefits for families and teens, and our partnership with Common Sense will further strengthen our safety work, ensuring that families and teens can use our tools with confidence,” Altman said in a statement.

Image: OpenAI