In a significant escalation of privacy concerns, the European digital rights group noyb has filed complaints with data protection authorities (DPAs) in 11 European countries to halt Meta’s latest privacy policy updates, which allegedly infringe on user rights under the General Data Protection Regulation (GDPR). This move highlights escalating tensions between privacy advocates and tech giants over the use of personal data in AI technologies.
Meta, formerly known as Facebook, has recently notified millions of its users in Europe about changes to its privacy policy, which would allow the company to use vast amounts of personal data for broadly defined “AI technology.” This data includes personal posts, private images, and online tracking data accumulated since 2007. Critically, Meta plans to share this information with unspecified third parties without explicit consent from users, claiming a “legitimate interest” that purportedly overrides individual privacy rights.
noyb, led by privacy activist Max Schrems, argues that Meta’s approach violates multiple aspects of the GDPR, which is designed to protect personal data and ensure privacy for EU citizens. The group has lodged complaints in Austria, Belgium, France, Germany, Greece, Italy, Ireland, the Netherlands, Norway, Poland, and Spain. These complaints urge the respective DPAs to initiate urgent procedures to prevent Meta’s policy from taking effect on June 26, 2024.
Meta defends its policy by stating that the use of AI technology to process user data is a legitimate business interest, which they believe does not require user consent. This stance has been controversial, as it appears to bypass the stringent consent requirements laid out in the GDPR. Meta also attempts to shift responsibility to users, offering an opt-out option that is complex and burdensome, rather than obtaining affirmative consent.
The changes proposed by Meta raise significant concerns about user autonomy and privacy, particularly the right to be forgotten, as users would seemingly have no ability to have their data erased once it is used by Meta’s AI systems. This stands in stark contrast to the GDPR’s requirements for clear, affirmative consent and the ability for users to withdraw consent and request data deletion.
The reaction from European DPAs has been mixed. While some, like the Norwegian DPA, have expressed skepticism about the legality of Meta’s practices, others have yet to issue formal responses. This situation underscores the ongoing challenge DPAs face in regulating large tech companies with the capacity to significantly influence public and private sectors through their handling of personal data.
The outcome of these complaints could have far-reaching implications for privacy rights and AI governance in Europe. If DPAs take action, it could lead to substantial changes in how companies like Meta handle personal data, potentially resulting in hefty fines and forced changes to business practices. Conversely, a lack of decisive action could undermine public trust in the effectiveness of GDPR protections.
Max Schrems of noyb emphasizes the gravity of the situation: “Meta’s current approach, if unchecked, could set a dangerous precedent that allows companies to exploit personal data under the guise of AI development. This is not just about privacy, but about the fundamental rights of millions of Europeans.”
Need Help?
As this situation unfolds, it will be crucial to monitor the responses from DPAs across Europe and any subsequent legal challenges that may arise. With every day comes a new AI regulation or bill, and you might have questions and concerns about how it will impact you. Don’t hesitate to reach out to BABL AI. Their Audit Experts are ready to provide valuable assistance.
