Law note · Italy
GDPR Article 22 and the Garante's OpenAI/ChatGPT Enforcement
Individuals in Italy have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. The Garante's ChatGPT/OpenAI matter is Italy's leading automated-processing enforcement episode: a provisional order suspending OpenAI's processing of Italian users' personal data on 30 March 2023, and a formal notice of violation on 29 January 2024.
A further EUR 15 million fine (December 2024) and the Court of Rome's annulment of that fine on a one-stop-shop competence ground (18 March 2026, once OpenAI's Irish establishment shifted lead-authority jurisdiction to Ireland's DPC) were not independently re-verified this session and are carried from the derivation package's own sourcing rather than confirmed here.
What it asks of an app
- Give a person in Italy a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.
- Expect the Garante to scrutinize a generative AI service's lawful basis and transparency toward Italian users, as it did against OpenAI from March 2023.
When LexLint raises it
Declared activities: high_risk_decisions, deploys_chatbot, generates_content, trains_models
Primary source: Garante notice of violation, 29 January 2024 (direct read)
GDPR Art. 22