ROME (AP) — Italy is temporarily blocking the artificial intelligence software ChatGPT in the wake of a data breach as it investigates a possible violation of stringent European Union data protection rules, the government's privacy watchdog said Friday.
The Italian Data Protection Authority said it was taking provisional action “until ChatGPT respects privacy,” including temporarily limiting the company from processing Italian users' data.
It would be “the first nation-scale restriction of a mainstream AI platform by a democracy,” said Alp Toker, director of the advocacy group NetBlocks, which monitors internet access worldwide.
U.S.-based OpenAI, which developed ChatGPT, didn’t return a request for comment Friday.
While some public schools and universities around the world have blocked ChatGPT from their local networks over student plagiarism concerns, it was not immediately clear when or how Italy would block it at a nationwide level. Toker said that as of Friday night in Italy, NetBlocks had not yet found evidence of any technical restriction limiting access to OpenAI's website.
The move also is unlikely to affect applications from companies that already have licenses with OpenAI to use the same technology driving the chatbot, such as Microsoft’s Bing search engine.
The AI systems that power such chatbots, known as large language models, are able to mimic human writing styles based on the huge trove of digital books and online writings they have ingested.
The Italian watchdog said OpenAI must report within 20 days what measures it has taken to ensure the privacy of users' data or face a fine of up to either 20 million euros (nearly $22 million) or 4% of annual global revenue.
The agency's statement cites the EU's General Data Protection Regulation and noted that ChatGPT suffered a data breach on March 20 involving “users' conversations" and information about subscriber payments.
OpenAI earlier announced that it had to take ChatGPT offline on March 20 to fix a bug that allowed some people to see the titles, or subject lines, of other users’ chat history.
“Our investigation has also found that 1.2% of ChatGPT Plus users might have had personal data revealed to another user,” the company said. “We believe the number of users whose data was actually revealed to someone else is extremely low and we have contacted those who might be impacted.”
Italy's privacy watchdog lamented the lack of a legal basis to justify OpenAI's “massive collection and processing of personal data” used to train the platform's algorithms and that the company does not notify users whose data it collects.
The agency also said ChatGPT can sometimes generate — and store — false information about individuals.
Finally, it noted there's no system to verify users' ages, exposing children to responses "absolutely inappropriate to their age and awareness.”
The watchdog's move comes as concerns grow about the artificial intelligence boom. A group of scientists and tech industry leaders published a letter Wednesday calling for companies such as OpenAI to pause the development of more powerful AI models until the fall to give time for society to weigh the risks.
The president of Italy's privacy watchdog agency told Italian state TV Friday evening he was one of those who signed the appeal. Pasquale Stanzione said he did so because “it's not clear what aims are being pursued" ultimately by those developing AI.
If AI should “impinge" on a person's “self-determination” then “this is very dangerous,'' Stanzione said. He also described the absence of filters for users younger than 13 as ”rather grave."
Others were citing concerns, too.
“While it is not clear how enforceable these decisions will be, the very fact that there seems to be a mismatch between the technological reality on the ground and the legal frameworks of Europe” shows there may be something to the letter's call for a pause “to allow for our cultural tools to catch up,” said Nello Cristianini, an AI professor at the University of Bath.
San Francisco-based OpenAI's CEO, Sam Altman, announced this week that he’s embarking on a six-continent trip in May to talk about the technology with users and developers. That includes a stop planned for Brussels, where European Union lawmakers have been negotiating sweeping new rules to limit high-risk AI tools, as well as visits to Madrid, Munich, London and Paris.
European consumer group BEUC called Thursday for EU authorities and the bloc’s 27 member nations to investigate ChatGPT and similar AI chatbots. BEUC said it could be years before the EU's AI legislation takes effect, so authorities need to act faster to protect consumers from possible risks.
“In only a few months, we have seen a massive take-up of ChatGPT, and this is only the beginning,” Deputy Director General Ursula Pachl said.
Waiting for the EU’s AI Act “is not good enough as there are serious concerns growing about how ChatGPT and similar chatbots might deceive and manipulate people.”
