The €15M Privacy Fine That Collapsed Because Nobody Owned It

In December 2024 Italy's privacy regulator did the thing everyone said no regulator would dare: it fined an AI company €15 million for training a model on people's data without first deciding it was allowed to. Fifteen months later a court erased the fine without disputing a single fact, on the grounds that the regulator was not the manager on duty.

On 20 December 2024 the Garante, Italy's data protection authority, closed its ChatGPT investigation with a €15 million penalty, a six-month public-awareness campaign, and findings that OpenAI had trained the model with no identified lawful basis, fell short on transparency, lacked real age checks, and never reported a March 2023 breach. The same day, three days after the EU's data board issued its opinion on exactly this question, the regulator's own notice already conceded it had forwarded the file to Ireland's DPC as the new lead authority under the one-stop-shop rule.

On 18 March 2026 the Court of Rome annulled the decision in full, and on 28 May 2026 it published why: the Irish DPC had become lead supervisory authority on 15 February 2024, the day it recognized OpenAI's Dublin entity as the EEA establishment. The Garante issued its decision nine months after that. So the court set aside the fine and the campaign order without reaching whether keeping-everything-to-train-the-model broke the law at all. The merits were not refuted. They were declared somebody else's paperwork.

What this reveals is the quiet load-bearing assumption of modern enforcement: that the hard part is proving the harm, when the hard part is establishing who holds the clipboard. The substantive question — can you collect first and find a lawful basis later — was researched, argued, written up, and then shelved on a jurisdictional technicality that the issuing regulator had itself flagged in the original notice. An entire flagship action turned out to rest on an ownership handoff nobody had finished.

Watch whether Dublin, now the undisputed lead, actually re-runs the case it inherited, or whether "lead authority" becomes the regulatory equivalent of the shared inbox where tickets go to age. Watch the appeal. And watch how quickly "the fine was thrown out" hardens into "a court blessed training on scraped personal data" in vendor decks — a claim the ruling pointedly never made. When the only finding is about custody, everyone gets to keep believing they won.