The Rome Court’s OpenAI Decision

The Rome Court’s OpenAI decision marks an important turning point in artificial-intelligence and data-protection law.

At first glance the decision appears to have been given in OpenAI’s favour, as the lifting of a €15 million sanction imposed for a GDPR infringement; yet the court made no assessment of the lawfulness of AI training data.

At the heart of the decision is a procedural issue:

Under the GDPR “One Stop Shop” mechanism, after OpenAI’s main establishment in the EU moved to Ireland, it was accepted that the lead authority for the investigation should be Ireland’s Data Protection Commission (DPC), not Italy.

Accordingly;

On what legal basis AI models may be trained,

Whether data collected from the internet may be used for training purposes,

The scope of transparency and information obligations,

The limits under the GDPR and KVKK of using personal data in model training,

these questions remain unanswered.

The decision is an important procedural ruling that determines which authority will conduct the debate, rather than resolving the substantive issues of AI and data-protection law.

From Türkiye’s perspective, the decision shows that debates on the purpose-limitation and proportionality principles in KVKK Art. 4, and on cross-border data transfers under KVKK Art. 9, will gain still greater importance in the period ahead.

The future of AI law depends in large part on the answer to this question:

May data that a person shared for a specific purpose later be used to train artificial-intelligence models?