Cybersecurity Policy Report, Italian Publisher’s Data Agreement With OpenAI Prompts Warning, (Dec 2, 2024)

By Tony Foley

Garante, the Italian data protection authority, issued a warning last week to publishing group Gedi urging the company to be careful about selling personal data contained in its newspaper archive to artificial intelligence developer OpenAI for use in training OpenAI’s algorithms.

In a Friday news release, Garante noted that digital newspaper archives stored the stories of millions of people, with information, details, and even extremely sensitive personal data that cannot be licensed for use by third parties to train AI without due precautions. If Gedi, in an agreement signed with OpenAI in September, communicated such data from its archives, Garante said the sale could violate the provisions of the European Union’s General Data Protection Regulation (GDPR), with all consequences, including sanctions, available to the regulator.

Garante issued a formal warning to Gedi and several of its subsidiaries that are parties to the agreement with OpenAI after an investigation initiated by Garante. Gedi’s agreement with OpenAI involves a large volume of personal data, and the impact assessment carried out by the company insufficiently analyzed the legal basis under which Gedi could transfer or license the personal data in its archive, Garante said.

The warning also highlights how the information and transparency obligations towards the data subjects do not appear to have been fulfilled and adds that Gedi is not in a position to guarantee these parties’ rights under the GDPR, in particular the right to object to the use of their personal information in OpenAI’s processing activities.

News: InternationalLegislation LitigationEnforcement DataPrivacy GDPR AINews