ItalyGDPR Article 22 and the Garante's OpenAI/ChatGPT Enforcement
Regulation (EU) 2016/679, Art. 22; Garante Provvedimento 30 marzo 2023
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 25 May 2018.
A data subject rights rule binding public and private bodies.
As of 24 August 2026.
What it requires
- Give a person in Italy a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.
- Expect the Garante to scrutinize a generative AI service's lawful basis and transparency toward Italian users, as it did against OpenAI from March 2023.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Individuals in Italy have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. The Garante's ChatGPT/OpenAI matter is Italy's leading automated-processing enforcement episode: a provisional order suspending OpenAI's processing of Italian users' personal data on 30 March 2023, and a formal notice of violation on 29 January 2024.
A further EUR 15 million fine (December 2024) and the Court of Rome's annulment of that fine on a one-stop-shop competence ground (18 March 2026, once OpenAI's Irish establishment shifted lead-authority jurisdiction to Ireland's DPC) are not independently verified here, and rest on secondary sourcing rather than a confirmed read.
When LexLint raises it
high_risk_decisionsdeploys_chatbotgenerates_contenttrains_models
Read the law
Garante notice of violation, 29 January 2024
GDPR Art. 22
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.