Meta's mega AI data grab sparks mass GDPR complaint

Meta’s plans to exploit years of personal posts, private images or online tracking data on its sites to build a new artificial intelligence platform has incurred the wrath of its long-time nemesis Max Schrems yet again, with the privacy campaigner’s organisation, NOYB, rifling off a barrage of complaints to EU data protection chiefs.

The move follows Meta’s decision to inform millions of Europeans that its privacy policy is changing for the umpteenth time. Only on closer inspection of the links in the notification, NOYB claims the tech giant’s real intentions become clear, with the “undefined AI technology” able to ingest personal data from any source and share any information with undefined “third parties”.

However, instead of asking users for their consent via an opt-in, the Facebook, Instagram and WhatsApp owner argues that it has a “legitimate interest” that overrides data protection principles.

In addition, NOYB maintains that once users’ data is in the system, they seem to have no option of ever having it removed in breach of GDPR’s right to be forgotten element.

The organisation has now filed complaints in 11 European countries – Austria, Belgium, France, Germany, Greece, Italy, Ireland, the Netherlands, Norway , Poland and Spain – asking the authorities to launch an urgency procedure to stop this change immediately, before it comes into force on June 26 2024. It will file complaints with the other EU authorities within days.

Unlike companies using certain (public) data to train a specific AI system, NOYB maintains Meta’s new privacy policy basically says that the company wants to take all public and non-public user data that it has collected since 2007 and use it for any undefined type of current and future “AI technology”.

This includes the many dormant Facebook accounts which still contain huge amounts of personal data. In addition, Meta says it can collect additional information from any “third party” or scrape data from online sources. The only exception seems to be chats between individuals – but even chats with a company are fair game, NOYB claims.

Users have not been given any information about the purposes of the “AI technology” – which NOYB insists is against the requirements of GDPR. Meta’s privacy policy would theoretically allow for any purpose.

The organisation stated: “This change is particularly worrying because it involves the personal data of about 4 billion Meta users, which will be used for experimental technology essentially without limit. At least users in the EU/EEA should (in theory) be protected from such abuse by GDPR.”

Schrems commented: “Meta is basically saying that it can use ‘any data from any source for any purpose and make it available to anyone in the world’, as long as it’s done via ‘AI technology’. This is clearly the opposite of GDPR compliance.

“‘AI technology’ is an extremely broad term. Much like ‘using your data in databases’, it has no real legal limit. Meta doesn’t say what it will use the data for, so it could either be a simple chatbot, extremely aggressive personalised advertising or even a killer drone. Meta also says that user data can be made available to any ‘third party’ – which means anyone in the world.”

Meta has previously argued that it can use legitimate interests to process personal data for advertising purposes but this was rejected by the European Court of Justice.

Schrems concluded: “The ECJ has already made it clear that Meta has no ‘legitimate interest’ to override users’ right to data protection when it comes to advertising. Yet the company is trying to use the same arguments for the training of undefined ‘AI technology’. It seems that Meta is once again blatantly ignoring the judgments of the court.”

NOYB has already set its sights firmly on ChatGPT, filing complaints last monmth that the AI tool is in breach of GDPR because it provides false information about people and cannot be corrected. Within days, the German authorities appeared to back the issue when it released new AI guidance.