Rome Court Annuls the Garante's €15 Million OpenAI Fine on Jurisdiction Grounds

On 18 March 2026 the Court of Rome annulled, in full, the Italian data protection authority's decision against OpenAI: a €15 million fine and an order requiring the company to run a six-month public information campaign about how ChatGPT is trained on personal data. The court did not find that OpenAI had complied with the GDPR. It found that the Garante — the Autorità Garante per la Protezione dei Dati Personali — was no longer the authority entitled to decide. The ground was jurisdiction — a point the court did not explain on the day, and which became clear only when the full grounds were published on 28 May 2026 — and it turned on a date: the Irish Data Protection Commission had recognised OpenAI Ireland Ltd as the company's single establishment in the European Economic Area on 15 February 2024, eight and a half months before the Garante's final decision, and under the GDPR's one-stop-shop mechanism the file should by then have been in Dublin. Reuters reported the ruling on 19 March 2026 and noted that the court released no explanation at the time; the Garante declined to comment. The record's severity grade, confidence rating and full source list sit in the Orca AI Incident Archive, alongside the other European regulatory entries filed around it.

What was annulled, and what the court did not say

The decision in question is the Garante's provvedimento n. 755 of 2 November 2024, published on 20 December 2024. It found that OpenAI had failed to notify the authority of a personal data breach suffered in March 2023, had processed users' personal data to train ChatGPT without first identifying an adequate legal basis, had breached the GDPR's transparency and information obligations, and had put no age-verification mechanism in place, with the result — in the Garante's words — that children under 13 risked being exposed to responses inappropriate to their stage of development.

The €15 million figure was, on the Garante's own account, calculated "also taking into account the company's cooperative attitude". The more unusual part of the decision was the second order. Using article 166(7) of the Italian Privacy Code for the first time, the authority required a six-month institutional campaign across radio, television, newspapers and the internet, its contents to be agreed with the authority, aimed at both users and non-users of ChatGPT and explaining how their data was collected for training and how to object, rectify or erase it.

On 18 March 2026 the court annulled that decision in its entirety. It gave no reasoning that day. The Garante received the judgment on 19 March, and the full grounds became publicly available only on 28 May 2026, as Theodore Christakis and Giulio Monga record in the European Law Blog. OpenAI's response, issued to Reuters, was that it welcomed the decision, had "always been committed to respecting user privacy", and looked forward to helping more Italian people, businesses and society benefit from AI. The Garante had no comment.

Three weeks, then eight and a half months

The chronology is the case. The Garante opened its sanctioning proceeding on 26 January 2024. On 15 February 2024 — about three weeks later — the Irish Data Protection Commission formally recognised OpenAI Ireland Ltd as OpenAI's single establishment in the EEA. The Garante adopted its final decision on 2 November 2024, some eight and a half months after that recognition.

That distinction between incorporation and recognition matters. OpenAI Ireland Ltd was incorporated on 24 March 2023, but "single establishment" is an autonomous concept of EU data protection law, turning on the effective and real exercise of activity through stable arrangements; the two dates need not coincide. What changed on 15 February 2024 was not the existence of an Irish company but its recognition for one-stop-shop purposes.

Article 56(1) of the GDPR gives the supervisory authority of the controller's main or single establishment exclusive competence over cross-border processing, acting as lead authority. The Court of Rome relied on the European Data Protection Board's Opinion 8/2019, and in particular its section 4.3.2 on the creation of a main or single establishment, or its relocation from a third country into the EEA, while administrative proceedings are already pending. On that reading, competence may switch to the new lead authority at any point until a final decision has been adopted, and any pending proceeding must be transferred with it.

The Garante had anticipated the problem and divided the file. Its December 2024 press release states that, because OpenAI had established its European headquarters in Ireland during the investigation, the authority "forwarded the procedural documents to the Irish Data Protection Authority (DPC), which became lead supervisory authority under the GDPR so as to continue investigating any ongoing infringements that have not been exhausted before the opening of the European headquarters". The qualification is the Garante's own: it kept what it considered finished, and sent on what it considered continuing. The court held that the split was not available to it.

The word the judgment turned on

Almost the whole dispute reduces to paragraph 16 of Opinion 8/2019, which says that the questions examined in the Opinion "mainly relate to infringements of a continuing or continuous nature". The Garante read that as a limit: the transfer logic was designed for continuing infringements, and could not reach conduct already completed before any EEA establishment existed. OpenAI read "mainly" as descriptive rather than exclusive. The court agreed with OpenAI, holding that "mainly" identifies the kind of case in which the question most often arises and does not exclude the same logic applying to completed infringements where the proceeding is still pending and no final decision has been taken.

The Garante's fallback was the Italian civil code principle of tempus regit actum — that the law in force at the time governs. The court dismissed it on the facts: this was a succession of facts, not a succession of laws. The decisive moment, on the judgment's logic, is neither the date of the infringement nor the date the investigation opened, but the date the final decision was adopted. After that point competence is fixed.

The merits were never reached

The court upheld the first ground of appeal, lack of competence, and declared every other ground "absorbed". It made no finding on the legal basis for training, on transparency, on age verification or on the late breach notification. It said nothing about whether €15 million was proportionate. Those questions remain formally unanswered.

That is the point most easily lost in the coverage. As the Italian firm Rödl & Partner put it in a June 2026 note, the judgment "should not be read as a substantive green light for OpenAI's practices: it is only a transfer of competence to the appropriate supervisory authority". The archive's entry records no real-world harm for this incident, which is consistent with a case that turned on who may decide rather than on an established injury to identified people.

Whether the file has a home in Dublin

The most substantial objection to the ruling is that the transferee may not be able to decide the case either. Christakis and Monga, writing in the European Law Blog on 4 June 2026 under the title "Establish, Then Escape?", argue that the court's reading produces an enforcement gap rather than a change of venue. Their concrete example is the breach notification. The breach occurred on 20 March 2023 and the duty to notify the Garante fell due seventy-two hours later, when OpenAI had no EU establishment and OpenAI Ireland Ltd had not yet been incorporated. The Garante classified that infringement as consumed and kept it for itself; on the court's logic the whole decision, including that charge, falls away. The authors argue it is hard to see how the Irish authority, whose competence postdates and flows from an establishment that did not exist when the duty arose, could adjudicate a notification owed to the Garante in respect of Italian data subjects.

They are careful about the limits of that argument, and so should the reader be. They record the contrary position — that the GDPR is a single Union-wide instrument, so whichever authority becomes lead may enforce it whenever the facts arose — and call the question arguable. They note they are not aware of any earlier national court ruling applying section 4.3.2 of Opinion 8/2019, that this is a first-instance judgment by a single judge, and that the reach of Article 56 over pre-establishment conduct seems to them unsettled rather than clear. Their recommendation is a preliminary reference to the Court of Justice under Article 267 TFEU.

The enforcement gap is not only a doctrinal prediction. Theodore Christakis, writing on the Cross-Border Data Forum the day after the ruling, recorded that no other European data protection authority has published a final enforcement decision concerning GDPR violations from the ChatGPT launch period of November 2022 to March 2023, and that the EDPB's ChatGPT taskforce report of May 2024 contained only preliminary views. On that account, the only final GDPR enforcement decision Europe produced over the generative-AI launch period has now been annulled.

What changed after 18 March

The fine had already been suspended. On 21 March 2025 the same court suspended the sanction's effect pending judgment, subject to a guarantee — a cauzione, or security deposit, in Altalex's account of the order. That suspension did not touch the merits, and the annulment a year later did not either.

The Garante has not removed the case from its record so much as set it aside. Its press-release page for decision 755 now carries a notice that the decision "was temporarily removed from the website of the Garante" following judgment n. 4153/2026. The word is the authority's: temporarily.

On the appeal question, the sources are consistent but incomplete. Christakis and Monga note that the Garante may yet appeal to the Corte di Cassazione. The Cross-Border Data Forum recorded on 19 March 2026 that, because the reasoning had not been released, the authority was not then in a position to say whether it would. In the sources reviewed for this article we found no report of a filing since, and no final decision by the Irish Data Protection Commission on the transferred file. Neither absence is proof that nothing happened; both mean the outcome is not yet closed.

Established, argued, and open

• Established: that judgment n. 4153/2026 of 18 March 2026 annulled decision n. 755 of 2 November 2024 in its entirety, removing a €15 million fine and a six-month media campaign order; that the operative part was read that day without reasoning; and that the published grounds rest on the one-stop-shop, the DPC's recognition of OpenAI Ireland Ltd on 15 February 2024, and EDPB Opinion 8/2019.

• Argued: whether a pending file may properly be transferred to an authority whose competence postdates the conduct at issue. The court said yes; Christakis and Monga say that reading leaves the pre-establishment conduct unenforceable and want the Court of Justice to decide; Rödl & Partner and ICT Legal Consulting describe the judgment instead as clarifying how the one-stop-shop applies to a change of establishment mid-procedure.

• Open: whether the Garante takes the case to the Corte di Cassazione, whether any court refers it to Luxembourg, and whether the Irish authority ever reaches a decision on the part of the file it received.

The €15 million is gone. The question the case raised — who in Europe may hold a generative AI provider to the GDPR for the period before it had a European establishment — has simply moved to a different desk.