OpenAI OpCo LLC

What happened

The DPA fined OpenAI €15,000,000 for the non-transparent processing of personal data without correctly identifying an adequate legal basis. It also mandated a six-month public campaign to raise awareness about ChatGPT’s data processing practices and user rights under the GDPR.

Summary from the GDPRhub page for this decision, written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

• Art. 5Principles relating to processing of personal data5(1)(a) · 5(2)Read →
• Art. 6Lawfulness of processingRead →
• Art. 12Transparent information, communication and modalities for the exercise of the rights of the data subjectRead →
• Art. 13Information to be provided where personal data are collected from the data subjectRead →
• Art. 24Responsibility of the controllerRead →
• Art. 25Data protection by design and by defaultRead →
• Art. 32Security of processingRead →

• Accountability
• Data principles
• Data security
• Transparency
• Unlawful processing