Italy’s DPA launches investigation into data collection for AI training

Italy’s Data Protection Authority (DPA) has initiated a fact-finding investigation into collecting large amounts of personal data online for training AI algorithms. The investigation aims to determine whether online platforms have implemented adequate measures to prevent AI platforms from scraping data, which involves the collection of significant amounts of personal data. The investigation will apply to all public and private data controllers established in Italy or offering services in the country.

AI experts, academics, and consumer groups are also participating in the investigation process and will share their views within a 60-day period. While there was no reference to any specific company to which the investigation would be conducted, the DPA stated that they reserve the right to take the necessary steps following the investigation. ‘

Why does it matter?

Since the temporary ban in March 2023 on OpenAI’s ChatGPT over privacy concerns, Italy has been among the most proactive DPAs in assessing AI compliance with the General Data Protection Regulation (GDPR). Additionally, Italy is seen to play a significant role in the finalisation of the EU AI Act as earlier this week, together with France and Germany, they reached an agreement on regulating AI.

The three countries highlighted that the risks lie in the application of AI systems rather than in the technology itself, proposing mandatory self-regulation through codes of conduct for advanced AI foundation models. At the same time, this contradicts EU’s position, which is to impose an obligation for foundation models within the EU AI Act, stressing that ‘ not having any obligation for foundation models is not considered an option.’ Therefore, if there is no compromise between the three countries and the EU, there is a risk of the EU AI Act not being implemented.