Submitted by Captain_Calamari_ t3_127ia2r in technology
JustLTU t1_jeekbct wrote
Reply to comment by demilitarizdsm in Italian regulators order ChatGPT ban over alleged violation of data privacy laws by Captain_Calamari_
This ban has nothing to do with AI as a technology, and nothing to do with AI at all. This is a temporary ban because openAI, as a company, does not handle users private data (the data it collects from users who are using chatgpt, not the AI training data) in a GDPR compliant way.
They also broke GDPR in regards to informing users what personal data of theirs was impacted in a security breach that openAI had recently.
While Italy is more aggressive in chasing down GDPR violations than most other EU countries, openAI should get their data handling into compliance, because the current product they sell (and by product, I once again am not talking about the AI model itself, but the chatgpt platform through which registered users can use it), is technically breaking the law EU-wide.
almcchesney t1_jeemsb1 wrote
Oh man I can see this getting expensive for them
> For especially severe violations, listed in Art. 83(5) GDPR, the fine framework can be up to 20 million euros, or in the case of an undertaking, up to 4 % of their total global turnover of the preceding fiscal year, whichever is higher.
quettil t1_jefmzk0 wrote
What if they just stop doing business in Italy?
Ambitious-Position25 t1_jeftp0o wrote
They would have to drop all of EU.
Limp_the_Pimp_ t1_jegdbtn wrote
Wait, why? Is this an EU thing?
maru11 t1_jegodpu wrote
> The General Data Protection Regulation (GDPR) is the toughest privacy and security law in the world. Though it was drafted and passed by the European Union (EU), it imposes obligations onto organizations anywhere, so long as they target or collect data related to people in the EU. The regulation was put into effect on May 25, 2018. The GDPR will levy harsh fines against those who violate its privacy and security standards, with penalties reaching into the tens of millions of euros.
[deleted] t1_jegkjyv wrote
[removed]
eagreeyes t1_jegdg0f wrote
They just did. ChatGPT just blocked italian traffic.
Psionatix t1_jegpl6h wrote
That doesn’t make them GDPR compliant for the rest of Europe
EmbarrassedHelp t1_jeeppoy wrote
The article also says that the Italian agency is mad that OpenAI isn't collecting a lot more private data to determine the age of users.
Educational-Ice-319 t1_jeetpgx wrote
I can’t ever see GDPR as being construed as to mandate more Personal Information collection in order to comply. That’s a crazy argument from Italian regulators. Shame it’s coupled with a legitimate, critical ruling.
EclecticKant t1_jeg1xl5 wrote
It sounds crazy because it's not what it's being asked of openAI, the regulator complain that openAI hasn't put anything in place to check if the user is a minor, which is a reasonable complaint. They are not asking openAI to collect more data for the sake of it, but to refuse access to minors
MornwindShoma t1_jeh1pj4 wrote
Age verification is permitted even under GDPR. The fuck you talking about lol.
Educational-Ice-319 t1_jeh1sck wrote
The fact that collecting it puts companies at further risk and GDPR doesn’t require it? The fuck you on about?
MornwindShoma t1_jeh2nqq wrote
Lol? You definitely don't get the point of GDPR. "Getting more data" isn't the issue, it's "getting it without permission", "leaking" or "storing it improperly".
Educational-Ice-319 t1_jeh2rp9 wrote
You don’t get the point of infosec and data protection. Minimizing risk is critical. Stop talking about shit you don’t understand please :)
MornwindShoma t1_jeh30p4 wrote
GDPR ain't infosec lol.
Educational-Ice-319 t1_jeh34gh wrote
Lmfao. GDPR is compliance and infosec. Quick quiz: what’s GRC stand for buddy?
MornwindShoma t1_jeh3uco wrote
https://www.europarl.europa.eu/RegData/etudes/ATAG/2023/739350/EPRS_ATA(2023)739350_EN.pdf
>The GDPR requires the use of verification with regard to age and parental consent.
Lol. This guy.
Educational-Ice-319 t1_jeh4rgr wrote
Lmfao. Nice job, let’s read the whole thing shall we?
> Processing shall be lawful only if and to the extent that at least one of the following applies:
> the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
> processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
> processing is necessary for compliance with a legal obligation to which the controller is subject; processing is necessary in order to protect the vital interests of the data subject or of another natural person;
> processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
> Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old.
> 2Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.
> 3Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.
Taken together, the company is only requires to get consent if 1) it processes the information, and 2) it is directly done for services direct to children.
So no mandatory consent or age verification across the board. You wanna try again bud?
DrQuantum t1_jefvw5g wrote
If storing data for children has different compliance laws then you have to collect that data to store any data at all and remain in compliance.
Educational-Ice-319 t1_jefw6dy wrote
Not necessarily. COPPA has no such requirement, for example. Instead, it applies if you know or reasonably suspect a child under a specific age could or is using the platform. It’s sort of a “don’t ask don’t tell” dilemma here.
Kittylaser t1_jeg4o90 wrote
COPPA is American law though, not European regulation.
Educational-Ice-319 t1_jeg5y5b wrote
It is an example of how laws may not require active collection of personal data.
JustLTU t1_jeg05q7 wrote
That might be an individual Italian law, or atleast something besides GDPR. GDPR has no such mandate.
Viewing a single comment thread. View all comments