All news
Case law March 20, 2026 4 min

Rome Court annuls 15M euro fine against OpenAI

March 20, 2026: the ruling that reopens the debate on GDPR and generative AI models

On March 20, 2026, the Rome Court annulled the EUR 15 million fine that the Italian DPA had imposed on OpenAI in December 2024 in relation to personal data processing in the context of ChatGPT development and operation. A decision that immediately sparked debate among DPOs and privacy lawyers across Europe.

Context of the initial fine

The DPA had charged OpenAI with multiple violations: processing personal data without adequate legal basis for model training, lack of notice to data subjects, failure to meet accountability obligations under Art. 24 GDPR, and absence of an age verification mechanism for minor users.

What changes for DPOs

  • GDPR enforcement on generative AI models enters a phase of greater interpretive uncertainty
  • DPA decisions on AI can be reformed in opposition proceedings
  • The question of legal basis for training sets composed of web-scraped data remains open
  • EDPB Opinion 28/2024 on AI models gains importance as an interpretive reference

Ruling not yet final

The Rome Court ruling can be appealed to the Supreme Court. The definitive regulatory framework will form in the coming months/years through case law consolidation and Digital Omnibus innovations proposing an explicit legal basis for AI training.

Operational implications

For clients using generative AI systems, the DPO must continue applying best practices: data minimization, DPIA when processing presents high risk (WP248 criteria), case-by-case legal basis assessment, specific notice to data subjects, DPA contracts with AI providers. The Rome Court ruling does not absolve OpenAI on the merits, but annuls the sanctioning act: GDPR principles remain applicable.

In DPO Workspace

The DPIA Wizard (Studio plan) includes in the WP248 screening the specific criterion for automated decisions and AI systems. When a client activates an integration with ChatGPT, Claude, Gemini or other LLMs for business purposes, the wizard guides you to document the impact assessment.

Official source:Federprivacy: Rome Court annuls OpenAI fine

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

Case law
200 €for the loss of control

Real employee data inside the test system: what loss of control is worth

Testing a new HR system with real data is not forbidden: transferring more fields than the test needs is. The German Federal Labour Court ordered an employer to pay two hundred euro because it had uploaded salary, home address, tax ID and marital status although it had agreed a list of nine fields with the works council. And it confirmed that a delayed answer to an access request is not, in itself, a damage.

Aug 21, 2026New 5 min
Case law
7i criteri di bilanciamento CEDU

You don't delete the article, you delete the name

On 5 August 2026 the CNIL clarified the boundaries of a right that is often exercised and widely misunderstood. Against a press organisation, objection and erasure remain available; access and rectification do not. And a refusal must be reasoned concretely: six generic formulas are named as inadmissible.

Aug 05, 2026New 4 min
Case law
3condizioni cumulative del test

Legitimate interest is not the fallback legal basis

In Case C-621/22 the Court of Justice held that a commercial interest can constitute a legitimate interest under Article 6(1)(f). Many people read only that line. The rest of the judgment recalls that the conditions remain three and cumulative, and that the third - the balancing against the data subject's reasonable expectations - is where the case at hand was lost. For the DPO the consequence is practical: legitimate interest exists only if it is written down somewhere.

Aug 12, 2026New 6 min