Italy's privacy regulator fined OpenAI €15 million over ChatGPT data handling
Italy's data protection authority fined OpenAI €15 million, finding among other things that it did not notify the authority of the March 2023 data breach and trained ChatGPT on personal data without an adequate legal basis. OpenAI appealed; the Garante's own notice says the decision was later overturned by the Court of Rome (March 2026).
What went wrong
Regulators examined how an AI provider collected and used people's data and how it handled a breach. The case is still a reminder that what happens to data after you paste it is decided by the provider, not by you.
What to do
- Read your AI provider's data and training policy before staff use it for work.
- Turn off model training where the tool allows it.
- Keep a record of which AI tools your firm uses, as part of your security plan.
Sources
- gpdp.it — https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10085432
- apnews.com — https://apnews.com/article/italy-privacy-authority-openai-chatgpt-fine-6760575ae7a29a1dd22cc666f49e605f