On November 29, 2024, the Italian data protection authority (Garante) announced that it sent a formal warning to Gedi News Network S.p.A., Gedi Periodi e Servizi S.p.A., Gedi Digital S.r.l., Monet S.r.l., and Alfemminile S.r.l. (collectively, GEDI) concerning the sharing of personal data to OpenAI, OpCo, LLC.

The Garante noted that GEDI announced that it had signed an agreement with OpenAI to share with the latter GEDI's editorial content in order to promote freedom of information. The Garante further stated that it received a Data Protection Impact Assessment (DPIA) on November 19, 2024, which demonstrated that personal data, including sensitive data and data about criminal convictions, would be communicated to OpenAI Ireland Ltd. (OpenAI IE).

Furthermore, the Garante was of the view that legitimate interest was not a valid legal basis legitimizing the data processing activity, as identified by GEDI in the DPIA. In particular, the Garante highlighted that it was not sufficiently clear how the legal basis of the legitimate interest used by GEDI for the processing of data for journalistic purposes could also be a suitable legal basis to allow GEDI to share the personal data included in the editorial content to OpenAI, as well as for training operations of OpenAI's artificial intelligence (AI) applications.

In light of the above, the Garante warned GEDI that the sharing of editorial data with OpenAI could likely violate the provisions of Articles 9, 10, 13, and 14 of the General Data Protection Regulation (GDPR). The formal warning was adopted as part of the investigation started by the Garante.

You can read the press release here and the formal warning here, both only available in Italian.