Irish Data Protection Commission’s Decision Sparks Outcry from Privacy Advocates

The Irish Data Protection Commission (DPC) has given Meta the green light to begin training its AI on the public-facing posts of European citizens, despite ongoing legal challenges and criticism from privacy advocates. The decision, which was announced yesterday, comes after Meta made several improvements to its proposal to harvest the data of European users of its social media platforms for teaching its neural networks.

According to the DPC, Meta has updated its transparency notices, making it clearer how users’ data will be used and processed. The company has also made its objection form easier to use, available for longer, and accessible in its mobile apps. Additionally, Meta has lengthened its notice period, giving users more time to object to the use of their data. The company has also made it clearer how users can hide their public posts from AI scraping and updated its data protection measures.

However, the DPC will require Meta to compile a report on the effectiveness of its safeguards and the appropriateness of the measures being taken in response, which is due in October. The report will assess whether Meta’s data collection and processing practices are in line with the General Data Protection Regulation (GDPR).

Meta intends to begin training its AI on EU citizens’ data on May 27. However, not everyone is satisfied with the DPC’s decision. None Of Your Business (noyb), a privacy advocacy group led by Austrian lawyer Max Schrems, has continually objected to Meta’s plans and has sent a cease and desist letter to the company, warning it to prepare for a class-action lawsuit.

Noyb argues that Meta’s plans to collect data for AI training on “legitimate interest” grounds would be in violation of the GDPR. The group claims that Meta has already lost a legal battle on similar grounds when it tried to argue for an opt-out option under legitimate interest grounds for ad targeting. In that case, the Irish High Court ruled that Meta’s use of legitimate interest grounds for ad targeting was unlawful, and the company was required to get explicit consent from users with an opt-in option.

A case is currently being heard in a German court, brought by the Consumer Advice Center of North Rhine-Westphalia, seeking an injunction against Meta to prevent its AI training implementation on May 27. The case argues that Meta’s plans to collect data for AI training on “legitimate interest” grounds would be in violation of the GDPR and the German Data Protection Act.

Noyb says that the German decision will affect its future actions in the matter, but it will not acquiesce to the DPC’s decision. “Regardless of the DPC’s stance, we (and other orgs as well) are carefully assessing all legal options,” a noyb spokesperson told us. “Furthermore, other [data protection agencies] are quite critical here as well and might take actions themselves.”

The DPC’s decision has also sparked criticism from other data protection agencies. The European Data Protection Board (EDPB) has expressed concerns about Meta’s plans to collect data for AI training on “legitimate interest” grounds. The EDPB has called on Meta to provide more information about its data collection and processing practices and to ensure that users’ rights are respected.

The controversy surrounding Meta’s plans to collect data for AI training has sparked a wider debate about the use of personal data for AI development. Some experts argue that the use of personal data for AI development is necessary to ensure that AI systems are accurate and effective. Others argue that the use of personal data for AI development is a threat to users’ privacy and that companies should be required to get explicit consent from users before collecting and processing their data.

As the debate continues, Meta’s plans to collect data for AI training remain uncertain. The company’s decision to begin training its AI on EU citizens’ data on May 27 has been met with opposition from privacy advocates and other data protection agencies. The outcome of the German case and the DPC’s report on Meta’s data collection and processing practices will be closely watched in the coming months.