ChatGPT banned in Italy: Is Germany facing a similar decision?

Users of the ChatGPT service received the news from Italy at the end of last week that the use of the AI has been blocked there until further notice. It remains to be seen how other European countries react to this decision and to what extent they share the assessment of the Italian authority.

In a press release dated March 31, 2023, the Italian data protection authority GPDP announced "an immediate temporary limitation on the processing of Italian users’ data by OpenAI”, resulting in an immediate blocking of the service ChatGPT in Italy and the opening of an investigation procedure.

ChatGPT is the most popular relational AI application that can simulate and process human conversations. The application is already blocked in a number of countries, including China, Iran, North Korea and Russia. Italy is the first European country to block the application.

The rationale of the GPDP

The Italian data protection authority emphasizes that users whose data is collected by OpenAI are not sufficiently informed about the processing of their data. In addition, there is no legal basis for the extensive collection and processing of personal data for training the algorithms. The consent of users, which is possible in principle as a legal basis, currently fails due to the lack of transparency. A filter for the protection of minors, which is supposed to protect young people under the age of 13 from content that is not suitable for minors, has also not been adequately implemented.

Guido Scorza, one of four board members of the Italian data protection authority, justifies the decision in the F.A.Z. by saying that people would use ChatGPT like a personal advisor, sometimes unconsciously communicating medical, psychological or legal information about themselves, for example, without being sufficiently informed about the data processing and without the possibility of consenting or objecting to it. However, this is not the final end for ChatGPT in Italy. They want to enter into a dialog with OpenAI and force the company to be transparent, so that users are sufficiently informed about the processing of their data and also have the option to opt out.

OpenAI is not based in the EU and has therefore appointed a representative in the European Economic Area. The latter must notify the Italian data protection authority within 20 days of the measures implemented to comply with the order. Failure to do so could result in a fine of up to 20 million euros or 4% of annual global turnover.

Only recently, Italy had imposed a similar ban against the chatbot "Replika". At the end of March, more than 1,000 people from the tech industry and academia - including well-known entrepreneurs such as Elon Musk and Apple co-founder Steve Wozniak - called for a six-month pause in the development of large language models of AI technology in order to develop a joint strategy for further action. Intervention by governments is also called for in the final step.

What does this mean for other European countries?

OpenAI is based in the U.S., so any European data protection supervisory authority can in principle take independent action against the company. German data protection supervisory authorities have also requested information about the investigations of their Italian colleagues. The German Federal Ministry of the Interior has already expressed interest in the action taken by the Italian authorities, and according to a spokeswoman for the Federal Commissioner for Data Protection, such action is also possible in principle in Germany. However, only the respective state data protection authorities can make the final decision in Germany. Stefan Brink, the data protection commissioner of Baden-Württemberg, who left office at the beginning of 2023, believes that the legitimate interest of developers regularly outweighs the individual need for protection in this case, as he told Handelsblatt. The decision of the Italian authority has also triggered discussions in other European countries, but there are currently no official statements.

The German Federal Ministry of Digital Affairs and Transport also took a clear stand against blocking ChatGPT in Germany, seeing Europe as a "global pioneer for trustworthy AI" and calling for the search for a common path. At the EU level, there has been discussion for some time about regulating AI, the use of which would pose particular risks to EU citizens. However, the draft AI Regulation ("AI Act") presented in 2022 focused solely on relatively narrowly defined use scenarios of AI and excluded precisely such cross-cutting technologies and AI products as ChatGPT from regulation to the greatest extent possible. The discussion of how to include "general AI" under the risk-based regulation approach has just begun and is now being conducted frantically at many levels. This also leads to the fact that an adoption of the AI Regulation is at best realistic until the end of 2023. From then on, the member states would have two years to implement the regulation nationally. Considering the rapid development that the topic of AI regulation has taken since the introduction of ChatGPT in November 2022, the question arises as to whether the legislation here can keep up with the speed of technological development. The Bavarian State Ministry for Digital Affairs presented a study at the end of March 2023 that criticizes precisely the "risk-fixated" regulatory approach of the AI Regulation and warns that overregulation is slowing down innovation in the EU. Instead, the task of regulation should be to eliminate existing uncertainty and ambiguity for companies in the development and use of AI through standards, guidelines and the formulation of uniform definitions.

In the short term, it is initially up to the individual authorities to make a guiding decision here - whether in agreement or independently. So far there is no concerted action, e.g. at the level of the European Data Protection Board, to deal with ChatGPT and comparable "General AI". In any case, the next two weeks will determine for Italy whether OpenAI's transparency efforts are sufficient and whether the deployment will be reopened. This decision is also likely to have a significant influence on the assessment of other European authorities.