Garante per la protezione dei dati personali (Italy) - 10077129
From GDPRhub
| Garante per la protezione dei dati personali - 10077129 | |
|---|---|
 | |
| Authority: | Garante per la protezione dei dati personali (Italy) |
| Jurisdiction: | Italy |
| Relevant Law: | Article 6(1)(f) GDPR Article 9(1) GDPR Article 9(2) GDPR Article 10 GDPR Article 13 GDPR Article 14 GDPR Article 58(1)(a) GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | |
| Published: | 27.11.2024 |
| Fine: | n/a |
| Parties: | Gedi OpenAI |
| National Case Number/Name: | 10077129 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Italian |
| Original Source: | Garante (in IT) |
| Initial Contributor: | elu |
The DPA issued a warning to the publisher GEDI after it agreed to provide OpenAI with news content that will be used to train OpenAI’s AI models. The DPA considered the imposed legitimate interest was insufficient as a legal basis and that information obligations were not met.
English Summary
Facts
GEDI Gruppo Editoriale S.p.A., the parent company of the editorial group GEDI, the controller, concluded a contract with OpenAI, with the objective of “bringing Italian-language content from GEDI's portfolio of high-quality news agencies to OpenAI users", who "will have access to attributed quotes, contents and links to GEDI publications, including La Repubblica and La Stampa". This contract will last for three years and entails a remuneration that GEDI will receive upon sharing editorial content with OpenAI.
OpenAI in turn commits to use such content to allow users to do real-time research, and to have available a summary right away, comprising a hyperlink to such news.
A DPIA was conducted and transmitted to the Italian DPA stating that the data processing will happen on the basis of Article 6(1)(f) GDPR, namely the legitimate interest to exercise the profession of journalist in innovatively.
Holding
The DPA started this ex officio procedure on the basis of Article 58(1)(a) GDPR due to some alarming preliminary considerations.
First, the party to the contract with the controller is OpenAI OpCo LLC, while according to the contract the data will be shared to OpenAI Ireland Ltd. Moreover, the contract is made with GEDI Gruppo Editoriale S.p.A., however the editorial content referred to belong to subsidiaries to GERI.
Second, the legal basis for the processing, namely the transfer of data from GEDI to OpenAI, was Article 6(1)(f) GDPR. However, considering that the data processing will be of “large scale” and of “particular nature”, the DPIA did not sufficiently consider this in the context of Article 9 and 10 GDPR.
Third, it is unclear how the claimed legal basis would also be relevant to train OpenAI’s artificial intelligence operations.
Fourth, the transparency requirements as per Article 13 and 14 GDPR were not met.
In light of all these considerations, under Article 58(1)(a) GDPR, the DPA deemed it fit to issue a warning for the plausible violations of Article 9, 10, 13 and 14 GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
SEE ALSO: - Press release of 29 November 2024 - Press release of 26 September 2024 [web doc. no. 10077129] Measure of 27 November 2024 Register of measures no. 741 of 27 November 2024 THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA IN today's meeting, attended by Prof. Pasquale Stanzione, President, Dr. Agostino Ghiglia and the lawyer Guido Scorza, members, and Councillor Fabio Mattei, Secretary General; HAVING SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, “Regulation”); HAVING SEEN the Personal Data Protection Code, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 (Legislative Decree 30 June 2003, no. 196, as amended by Legislative Decree 10 August 2018, no. 101, hereinafter “Code”); HAVING SEEN the Guidelines 1/2024 on the processing of personal data based on Article 6, paragraph 1, letter f, of the Regulation, adopted by the European Data Protection Board on 8 October 2024; HAVING SEEN the Rules of Ethics relating to the processing of personal data in the exercise of journalistic activity published pursuant to art. 20, paragraph 4, of Legislative Decree 10 August 2018, no. 101 of 29 November 2018; WHEREAS with the press release of 26 September 2024 GEDI Gruppo Editoriale S.p.A. (hereinafter “GEDI” or the “Company”) announced the signing of an agreement with the company OpenAI “to bring Italian language content from GEDI’s portfolio of high-quality news agencies to OpenAI users”, who “will have access to attributed quotes, content and links to GEDI publications, including La Repubblica and La Stampa”; WHEREAS, following a request for information from the Authority pursuant to the combined provisions of Articles 58, paragraph 1, letter a) and b) of the Italian Legislative Decree no. a) of the Regulation and 157 of the Code, GEDI reported that the object of the agreement consists in the "communication of editorial content by some GEDI Group newspapers to OpenAI, with the aim of protecting the industrial and intellectual property rights of the GEDI Group (both moral and patrimonial) by promoting freedom of information through the dissemination of current and quality content, as well as verified according to the rules applicable to the journalistic profession and this, naturally, to reduce the risk of spreading fake news"; NOTING that the Company declared that the agreement was concluded with OpenAI OpCo, LLC, based in the USA, on 24 September 2024 and will last 3 years and that GEDI will receive, in exchange for sharing the editorial content, remuneration; ACKNOWLEDGING that the Company has declared that the launch of the initiative is scheduled for November 30, 2024, and that the same will begin with the communication to OpenAI, one-off and in a single solution, of the contents of the archive published up to November 29, 2024 and will continue with the subsequent communication, "in an almost contextual and immediate manner", of the contents published starting from November 30, 2024; NOTING that the Company has made known that the newspapers whose contents will be communicated to OpenAI are: • GEDI News Network S.p.A., with registered office in Via E. Lugaro, 15 – 10126 Turin, publisher of the contents present on the sites www.repubblica.it, www.lastampa.it, www.laprovinciapavese.gelocal.it and www.lasentinella.gelocal.it; • GEDI Periodici e Servizi S.p.A., with registered office in Via E. Lugaro, 15 – 10126 Turin, publisher of the contents present on the site www.limesonline.com; • GEDI Digital S.r.l., with registered office in Via E. Lugaro, 15 – 10126 Turin, publisher of the contents present on the sites www.huffingtonpost.it and www.formulapassion.it; • Monet S.r.l., with registered office in Via Cristoforo Colombo, 90 - 00147 Rome, publisher of the contents present on the site www.mymovies.it; • Alfemminile S.r.l., with registered office in Via A. Massena, 2 - 20145 Milan, owner of the contents present on the site www.alfemminile.com; NOTING that the Company has specified that “all editorial content will be used by OpenAI to allow users [of the ChatGPT service, editor’s note] to search for current news in real time, with the simultaneous provision of a summary (generated by OpenAI artificial intelligence systems) and a direct link to the news item itself” and that “all editorial content will also be used by OpenAI to improve its services and train its artificial intelligence algorithms”; NOTING that the data protection impact assessment (hereinafter “DPIA”), including the “concurrent balancing of the legitimate interest pursuant to Article 6 and Article 35 of the Regulation”, was transmitted to the Authority on 19 November 2024, as it had not yet been completed at the time of the response to the request for information pursuant to Articles 58, paragraph 1, letter a) of the Regulation and 157 of the Code; CONSIDERING that the DPIA shows that the “Processing of so-called common personal data is based on the legitimate interest of the Data Controller pursuant to art. 6 par. 1, letter f) GDPR (considered prevalent, as specified below) to exercise journalistic activity according to innovative methods and capable of preserving the capacity and informative function of editorial content” and that the “Processing of personal data belonging to particular categories and relating to criminal convictions and (residual) crimes, is carried out in compliance – in particular – with art. 136 and 137 of the Privacy Code and the provisions contained within the Deontological Rules”; CONSIDERING, from a formal perspective, that from the documentation in the files it emerges that the contractual counterparty of the agreement stipulated by GEDI is the US company OpenAI OpCo LLC, while from the same files it appears that the communication of personal data will be made to OpenAI Ireland Ltd. (hereinafter “OpenAI IE”); CONSIDERING also that the agreement was entered into by GEDI, but that the editorial contents refer to GEDI News Network S.p.A., GEDI Periodici e Servizi S.p.A., GEDI Digital S.r.l., Monet S.r.l. and Alfemminile S.r.l., qualified as independent data controllers; CONSIDERING that the legal basis of the processing was identified by GEDI in the legitimate interest of each data controller to exercise journalistic activity in innovative ways, preserving the capacity and informative function of the editorial contents; CONSIDERING that the processing activities can be classified as “large scale” given that they are intended to involve a large volume of personal data, including of a particular nature, in particular those contained in the GEDI archives as of 29 November 2024 and those contained in the articles that will be published after 30 November 2024; CONSIDERING that the legal basis relating to the communication to OpenAI of editorial content that includes data of a particular nature pursuant to Articles 9 and 10 of the Regulation, a processing activity carried out by the Company as part of the exercise of journalistic activity pursuant to Articles 136 and 137 of the Code, is not, at present, sufficiently analysed in the DPIA, in particular in light of the provisions of Article 137, paragraph 3, of the Code which provides that "in the event of dissemination or communication of data for the purposes referred to in Article 136, the limits of the right to report remain in place to protect the rights referred to in Article 1, paragraph 2, of the Regulation and Article 1 of this Code and, in particular, that of the essentiality of the information regarding facts of public interest"; CONSIDERING that legitimate interest is not a condition legitimizing the processing of personal data of a particular nature since, Article 9 of the Regulation, in its second paragraph, identifies such "legal bases" as exceptions to the general rule of the first paragraph, according to which: "It is prohibited to process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as to process genetic data, biometric data intended to uniquely identify a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation."; CONSIDERING that it does not appear sufficiently clear how the legal basis of the legitimate interest used by GEDI, in the terms described above, for the processing of data for journalistic purposes, could also be a suitable legal basis to allow GEDI to communicate the personal data included in the editorial content to OpenAI, including for "training" operations of its own artificial intelligence applications; the latter activity, as GEDI itself reports, "completely removed from the participation and control of GEDI and the GEDI Group's newspapers"; CONSIDERING that individuals whose personal data, both common and particular, contained in the archives and articles that will be communicated to OpenAI, cannot reasonably expect such communication and that the supplementary paragraph of the privacy notices published on the websites of the newspapers involved, produced by GEDI, does not appear sufficient to consider the transparency obligation pursuant to Articles 13 and 14 of the Regulation fulfilled, given that to date this paragraph has not yet been published (e.g. the privacy notice of La Repubblica is updated to December 2023) and that it is addressed to users registered with the aforementioned newspapers and not to the interested parties whose data are communicated to OpenAI; CONSIDERING ALSO that, although in the integration to the privacy information mentioned above the Company states that “Each interested party may always, at any time, exercise the right to oppose the communication of data to OpenAI and the other rights recognized by the applicable legislation (as also described in other sections of this information) by means of a communication to be sent to the publisher, at the following address: [_].To the same addresses, requests for further details on the legitimate interest pursued by the publisher as well as on the subjects involved in the processing may also be sent”, and that the same Company in the DPIA declares that “it will implement suitable procedures to guarantee the fulfillment of the obligations deriving from the applicable legislation including those referred to in Article 19 GDPR”, GEDI is not in a position to guarantee the rights of the interested parties; in fact, both with reference to the journalistic archives that will be communicated en bloc on 30 November 2024, and in cases in which the communication to OpenAI will take place at the same time as the publication of the individual articles, the exercise of the right of opposition towards the GEDI group newspapers involved does not appear to be effective given that, in such cases, the exercise of the rights referred to in Chapter III of the Regulation may take place exclusively towards OpenAI IE; CONSIDERING that the DPIA shows that “The GEDI Group newspapers are not and will not be, therefore, responsible in any way for the operation or set of operations of processing of personal data carried out by OpenAI, not even with reference to the personal data included in the content communicated to OpenAI under the Agreement”; CONSIDERING that, under the Agreement, it is expected that OpenAI acts as “independent data controller and may use such content (and, therefore, the personal data included therein) for the purposes of training its own artificial intelligence systems, and for the purposes of improving its services, such as improving the accessibility of content when users search for such information using ChatGPT”; CONSIDERING, therefore, the need to address, pursuant to art. 58, paragraph 2, letter a), of the Regulation and art. 154, paragraph 1, letter c), of the Regulation, f), of the Code, a warning to GEDI Gruppo Editoriale S.p.A and all companies party to the editorial content communication agreement stipulated with OpenAI, namely GEDI News Network S.p.A., GEDI Periodici e Servizi S.p.A., GEDI Digital S.r.l., Monet S.r.l. and Alfemminile S.r.l., as data controllers, that the communication of the editorial content of the aforementioned GEDI Group publications to OpenAI could likely constitute a violation of the provisions of Articles 9, 10, 13, 14 and Chapter III of the Regulation, with all the consequences, including sanctions, provided for therein; SEEN the documentation in the files; SEEN the observations formulated by the Secretary General pursuant to Article 15 of Regulation No. 1/2000; REPORTER Prof. Pasquale Stanzione; NOW, GIVEN THE FOREGOING, THE GUARANTOR: a) pursuant to art. 58, par. 2, letter a), of the Regulation and art. 154, paragraph 1, letter f), of the Code, warns GEDI Gruppo Editoriale S.p.A., with registered office in Turin, via Ernesto Lugaro 15 and all the companies party to the editorial content communication agreement stipulated with OpenAI, specifically GEDI News Network S.p.A., GEDI Periodici e Servizi S.p.A., GEDI Digital S.r.l., Monet S.r.l. and Alfemminile S.r.l., as data controllers of the personal data, that the communication of the editorial content of the aforementioned GEDI Group publications to OpenAI could likely violate the provisions of arts. 9, 10, 13, 14 and Chapter III of the Regulation. Rome, 27 November 2024 THE PRESIDENT Stanzione THE REPORTER Stanzione THE GENERAL SECRETARY Mattei SEE ALSO: - Press release of 29 November 2024 - Press release of 26 September 2024 [web doc. no. 10077129] Measure of 27 November 2024 Register of measures no. 741 of 27 November 2024 THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA IN today's meeting, attended by Prof. Pasquale Stanzione, president, Dr. Agostino Ghiglia and the lawyer Guido Scorza, members, and Councillor Fabio Mattei, general secretary; HAVING SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, the “Regulation”); HAVING SEEN the Personal Data Protection Code, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 (Legislative Decree 30 June 2003, no. 196, as amended by Legislative Decree 10 August 2018, no. 101, hereinafter the “Code”); HAVING SEEN the Guidelines 1/2024 on the processing of personal data based on Article 6, paragraph 1, letter f, of the Regulation, adopted by the European Data Protection Board on 8 October 2024; HAVING SEEN the Rules of Ethics relating to the processing of personal data in the exercise of journalistic activity published pursuant to art. 20, paragraph 4, of Legislative Decree no. 101 of 29 November 2018 of 10 August 2018; NOTING that with the press release of 26 September 2024, GEDI Gruppo Editoriale S.p.A. (hereinafter “GEDI” or the “Company”) announced the signing of an agreement with the company OpenAI “to bring Italian-language content from GEDI’s portfolio of high-quality news agencies to OpenAI users”, who “will have access to attributed quotes, content and links to GEDI publications, including La Repubblica and La Stampa”; NOTING that, following a request for information from the Authority pursuant to the combined provisions of art. 58, paragraph 1, letter a), a) of the Regulation and 157 of the Code, GEDI reported that the object of the agreement consists in the "communication of editorial content by some GEDI Group newspapers to OpenAI, with the aim of protecting the industrial and intellectual property rights of the GEDI Group (both moral and patrimonial) by promoting freedom of information through the dissemination of current and quality content, as well as verified according to the rules applicable to the journalistic profession and this, naturally, to reduce the risk of spreading fake news"; NOTING that the Company declared that the agreement was concluded with OpenAI OpCo, LLC, based in the USA, on 24 September 2024 and will last 3 years and that GEDI will receive, in exchange for sharing the editorial content, remuneration; ACKNOWLEDGING that the Company has declared that the launch of the initiative is scheduled for November 30, 2024, and that the same will begin with the communication to OpenAI, one-off and in a single solution, of the contents of the archive published up to November 29, 2024 and will continue with the subsequent communication, "in an almost contextual and immediate manner", of the contents published starting from November 30, 2024; NOTING that the Company has made known that the newspapers whose contents will be communicated to OpenAI are: • GEDI News Network S.p.A., with registered office in Via E. Lugaro, 15 – 10126 Turin, publisher of the contents present on the sites www.repubblica.it, www.lastampa.it, www.laprovinciapavese.gelocal.it and www.lasentinella.gelocal.it; • GEDI Periodici e Servizi S.p.A., with registered office in Via E. Lugaro, 15 – 10126 Turin, publisher of the contents present on the site www.limesonline.com; • GEDI Digital S.r.l., with registered office in Via E. Lugaro, 15 – 10126 Turin, publisher of the contents present on the sites www.huffingtonpost.it and www.formulapassion.it; • Monet S.r.l., with registered office in Via Cristoforo Colombo, 90 - 00147 Rome, publisher of the contents present on the site www.mymovies.it; • Alfemminile S.r.l., with registered office in Via A. Massena, 2 - 20145 Milan, owner of the contents present on the site www.alfemminile.com; NOTING that the Company has specified that “all editorial content will be used by OpenAI to allow users [of the ChatGPT service, editor’s note] to search for current news in real time, with the simultaneous provision of a summary (generated by OpenAI artificial intelligence systems) and a direct link to the news item itself” and that “all editorial content will also be used by OpenAI to improve its services and train its artificial intelligence algorithms”; NOTING that the data protection impact assessment (hereinafter “DPIA”), including the “concurrent balancing of the legitimate interest pursuant to Article 6 and Article 35 of the Regulation”, was transmitted to the Authority on 19 November 2024, as it had not yet been completed at the time of the response to the request for information pursuant to Articles 58, paragraph 1, letter a) of the Regulation and 157 of the Code; CONSIDERING that the DPIA shows that the “Processing of so-called common personal data is based on the legitimate interest of the Data Controller pursuant to art. 6 par. 1, letter f) GDPR (considered prevalent, as specified below) to exercise journalistic activity according to innovative methods and capable of preserving the capacity and informative function of editorial content” and that the “Processing of personal data belonging to particular categories and relating to criminal convictions and (residual) crimes, is carried out in compliance – in particular – with art. 136 and 137 of the Privacy Code and the provisions contained within the Deontological Rules”; CONSIDERING, from a formal perspective, that from the documentation in the files it emerges that the contractual counterparty of the agreement stipulated by GEDI is the US company OpenAI OpCo LLC, while from the same files it appears that the communication of personal data will be made to OpenAI Ireland Ltd. (hereinafter “OpenAI IE”); CONSIDERING also that the agreement was entered into by GEDI, but that the editorial contents refer to GEDI News Network S.p.A., GEDI Periodici e Servizi S.p.A., GEDI Digital S.r.l., Monet S.r.l. and Alfemminile S.r.l., qualified as independent data controllers; CONSIDERING that the legal basis of the processing was identified by GEDI in the legitimate interest of each data controller to exercise journalistic activity in innovative ways, preserving the capacity and informative function of the editorial contents; CONSIDERING that the processing activities can be classified as “large scale” given that they are intended to involve a large volume of personal data, including of a particular nature, in particular those contained in the GEDI archives as of 29 November 2024 and those contained in the articles that will be published after 30 November 2024; CONSIDERING that the legal basis for the communication to OpenAI of editorial content that includes data of a particular nature pursuant to articles9 and 10 of the Regulation, processing activities carried out by the Company attributable to the exercise of journalistic activity pursuant to Articles 136 and 137 of the Code, are not, at present, sufficiently analysed in the DPIA, in particular in light of the provisions of Article 137, paragraph 3, of the Code which provides that "in the event of dissemination or communication of data for the purposes referred to in Article 136, the limits of the right to report remain in place to protect the rights referred to in Article 1, paragraph 2, of the Regulation and Article 1 of this Code and, in particular, that of the essentiality of the information regarding facts of public interest"; CONSIDERING that legitimate interest is not a condition legitimizing the processing of personal data of a particular nature since, Article 9 of the Regulation, in its second paragraph, identifies such "legal bases" as exceptions to the general rule of the first paragraph, according to which: "It is prohibited to process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as to process genetic data, biometric data intended to uniquely identify a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation."; CONSIDERING that it does not appear sufficiently clear how the legal basis of the legitimate interest used by GEDI, in the terms described above, for the processing of data for journalistic purposes, could also be a suitable legal basis to allow GEDI to communicate the personal data included in the editorial content to OpenAI, including for "training" operations of its own artificial intelligence applications; the latter activity, as GEDI itself reports, "completely removed from the participation and control of GEDI and the GEDI Group's newspapers"; CONSIDERING that individuals whose personal data, both common and particular, contained in the archives and articles that will be communicated to OpenAI, cannot reasonably expect such communication and that the supplementary paragraph of the privacy notices published on the websites of the newspapers involved, produced by GEDI, does not appear sufficient to consider the transparency obligation pursuant to Articles 13 and 14 of the Regulation fulfilled, given that to date this paragraph has not yet been published (e.g. the privacy notice of La Repubblica is updated to December 2023) and that it is addressed to users registered with the aforementioned newspapers and not to the interested parties whose data are communicated to OpenAI; CONSIDERING ALSO that, although in the integration to the above-mentioned privacy information the Company states that “Each interested party may always, at any time, exercise the right to object to the communication of data to OpenAI and the other rights recognized by the applicable legislation (as also described in other sections of this information notice) by means of a communication to be sent to the publisher, at the following address: [_]. Requests for further details on the legitimate interest pursued by the publisher as well as on the subjects involved in the processing may also be sent to the same addresses”, and that the same Company in the DPIA declares that “it will implement suitable procedures to guarantee the fulfillment of the obligations deriving from the applicable legislation including those referred to in Article 19 GDPR”, GEDI is not in a position to guarantee the rights of the interested parties; in fact, both with reference to the journalistic archives that will be communicated en bloc on 30 November 2024, and in cases in which the communication to OpenAI will take place at the same time as the publication of the individual articles, the exercise of the right of opposition towards the GEDI group newspapers involved does not appear to be effective given that, in such cases, the exercise of the rights referred to in Chapter III of the Regulation may take place exclusively towards OpenAI IE; NOTING that the DPIA shows that "The GEDI Group newspapers are not and will not be, therefore, responsible in any way for the operation or set of operations of processing of personal data carried out by OpenAI, not even with reference to the personal data included in the contents communicated to OpenAI under the Agreement"; CONSIDERING that, under the Agreement, OpenAI is expected to act as an “independent data controller and may use such content (and, therefore, the personal data included therein) for the purposes of training its own artificial intelligence systems, and for the purposes of improving its services, such as improving the accessibility of content when users search for such information using ChatGPT”; THEREFORE, RECOGNISED the need to address, pursuant to art. 58, paragraph 2, letter a), of the Regulation and art. 154, paragraph 1, letter f), of the Code, a warning to GEDI Gruppo Editoriale S.p.A and all companies party to the editorial content communication agreement stipulated with OpenAI, namely GEDI News Network S.p.A., GEDI Periodici e Servizi S.p.A., GEDI Digital S.r.l., Monet S.r.l. and Alfemminile S.r.l., as data controllers of the personal data, that the communication of the editorial contents of the aforementioned GEDI Group publications to OpenAI could likely constitute a violation of the provisions of Articles 9, 10, 13, 14 and Chapter III of the Regulation, with all the consequences, including sanctions, provided for therein; SEEN the documentation in the files; SEEN the observations formulated by the Secretary General pursuant to Article 15 of Regulation No. 1/2000; REPORTER Prof. Pasquale Stanzione; CONSIDERING ALL THE ABOVE, THE GUARANTOR: a) pursuant to Article 58, paragraph 2, letter a), of the Regulation and Article 154, paragraph 1, letter f), of the Code, warns GEDI Gruppo Editoriale S.p.A., with registered office in Turin, via Ernesto Lugaro 15 and all the companies party to the editorial content communication agreement stipulated with OpenAI, namely GEDI News Network S.p.A., GEDI Periodici e Servizi S.p.A., GEDI Digital S.r.l., Monet S.r.l. and Alfemminile S.r.l., as data controllers, that the communication of the editorial content of the aforementioned GEDI Group publications to OpenAI could likely violate the provisions of Articles 9, 10, 13, 14 and Chapter III of the Regulation. Rome, 27 November 2024 THE PRESIDENT Stanzione THE REPORTER Stanzione THE GENERAL SECRETARY Mattei
