On Thursday, 6 June 2024, the Austrian privacy and digital rights campaign group NOYB filed 11 complaints with the data protection authorities (DPAs) in Austria, Belgium, France, Germany, Greece, Italy, Ireland, the Netherlands, Norway, Poland and Spain concerning Meta's plans to train and develop AI services using years of users' personal posts, images and the online tracking data it has amassed.
NOYB claims that in opting to use legitimate interests as its legal basis for processing rather than asking for consent overrides European users' fundamental right to data protection and privacy. In filing the complaints, NOYB is asking the 11 DPAs to launch an "urgency procedure" under Article 66 of the EU General Data Protection Regulation (GDPR) to stop the changes from taking place on 26 June because, after this date, the company has said that there will be no option to opt-out at a later point.
While Meta claims that content from private profiles and users under the age of 18 will not be used for this purpose, NOYB argues that its various announcements indicate this is inaccurate and spin. Instead, NOYB says that the company intends to use all public and non-public user data collected since 2007 for an undefined future AI-related purpose. Alongside user data collected from its own platforms, NOYB says Meta plans to collect information from third parties, including scraping data from other online services.
Despite Meta having already lost a protracted legal battle (Case C-252/21) in the Court of Justice of the European Union (CJEU) concerning the processing of personal data for behavioural advertising, it plans to use the same legal basis for an even broader purpose.
In a statement, NOYB honorary chair Max Schrems said: "The European Court of Justice has already made it clear that Meta has no 'legitimate interest' to override users' right to data protection when it comes to advertising. Yet the company is trying to use the same arguments for the training of undefined 'AI technology'. It seems that Meta is once again blatantly ignoring the judgements of the CJEU."
Schrems added that NOYB hopes the 10 other DPAs "outside of Ireland will take quick action and at least stop this project for a full investigation. The EDPB has already issued two such urgency decisions against Meta and the Irish Data Protection Commissioner."
Earlier in the week, the Norweigan DPA, Datatilsynet, published a blog article on Tuesday outlining Meta plans. The DPA highlights that Meta has chosen not to ask for user consent and instead claims that "their interest in using the content outweighs the users' interests and rights." The DPA is doubtful about the legality of the move.
(Translate to English: Google Chrome, Mozilla Firefox, or Microsoft Edge)
What is this page?
You are reading a summary article on the Privacy Newsfeed, a free resource for DPOs and other professionals with privacy or data protection responsibilities helping them stay informed of industry news all in one place. The information here is a brief snippet relating to a single piece of original content or several articles about a common topic or thread. The main contributor is listed in the top left-hand corner, just beneath the article title.
The Privacy Newsfeed monitors over 300 global publications, of which more than 4,350 summary articles have been posted to the online archive dating back to the beginning of 2020. A weekly roundup is available by email every Friday.
