Written by Kieran Harte
Fógra: Following intensive engagement between the DPC and Meta, Meta decided on 14 June 2024 to pause its plans to train its large language model using public content shared by adults on Facebook and Instagram across the EU/EEA. The DPC, in co-operation with its fellow EU data protection authorities, will continue to engage with Meta on this issue.
On 6 June 2024, advocacy group NOYB (None of Your Business) filed complaints against Meta with the Austrian, Belgian, French, German, Greek, Italian, Irish, Dutch, Norwegian, Polish, and Spanish data protection supervisory authorities. This is as a result of changes to Meta’s data protection policy that come into force on 26 June 2024 concerning how it intends to use personal data to train its artificial intelligence (AI) models.
In September 2023, Meta announced that it intended to use information shared publicly by people on Meta’s products and services, as well as publicly available online and licensed information to train AI. Meta is relying on the legal basis of legitimate interests (Article 6(f) GDPR) to process this personal data to improve AI at Meta. Data subjects will have the right to opt out/object (Article 21(1) GDPR) before the policy change takes effect on 26 June 2024, but personal data could still be processed by Meta if you appear in an image someone shared or are mentioned in another user’s posts or captions. However, special categories of personal data cannot be processed on the grounds of legitimate interest by commercial bodies (Article 9 GDPR) and it is highly likely that there will be special category personal data included in the material. Moreover, the objection form appears to oblige data subjects to provide a reason for opting out, which is not a requirement under GDPR.
In a similar case, the preliminary report of the European Data Protection Board (EDPB) on OpenAI’s ChatGPT has remained inconclusive on the lawfulness and fairness of OpenAI’s processing, including training data, after more than a year of consideration. Moreover, in a related European Court of Justice ruling on 3 June 2021 on database law (Directive 790/2019), the court said that a balance must be sought between database rights and free access to information and the development of innovative products. The Directive allows web scraping for text and data mining for the purpose of gaining new knowledge from the data, but it is not clear if AI training can be considered to fall within this definition, particularly as AI training is not explicitly mentioned in the legal text. So, it appears that it will be up to the individual supervisory authorities assessing complaints to decide if legitimate interests can be relied upon as ground for processing personal data. The challenge for the supervisory authorities is whether it is correct to assess complaints relating to AI technology in a prism of expectation and demand for certainty, for absolutes in relation to the application of the GDPR.
NOYB considers that the processing should be based on opt-in consent, while Meta argues that their approach is consistent with how other tech companies are developing and improving their AI experiences in Europe. Given that the policy will take effect on 26 June and the possibility that the enforcement of a data subject right could be considerably impeded, NOYB has now requested an urgency procedure (Article 66 GDPR) that would allow supervisory authorities to issue provisional measures and a subsequent EU-wide decision to be issued by the EDPB. Such a request has been made by NOYB in 11 EU countries on behalf of data subjects. The DPC and Meta have previously been subject to two urgent binding decisions by the EDPB (see Urgent Binding Decision 01/2023 and Urgent Binding Decision 01/2021).