The Irish Data Protection Commission has cleared the way for Meta to begin slurping up the data of European citizens for training AI next week, ongoing legal challenges notwithstanding. 

The DPC said in a statement yesterday that Meta had made a number of improvements to its proposal to harvest the public-facing posts of European users of its various social media platforms for teaching its neural networks. Those changes appear to have satisfied concerns the DPC expressed early last year when Meta first revealed its AI data collection intentions, which ultimately led to the Facebook parent suspending its plans following numerous complaints from privacy advocates. 

Meta resumed its plans to train AI in the EU earlier this year with an opt-out option following a decision from the European Data Protection Board issued at the request of the Irish DPC to get clarity on the privacy requirements for such a move. 

“Having reviewed Meta’s proposals, and following feedback from the other EU/EEA supervisory authorities, the DPC made a number of recommendations to Meta,” the DPC said, adding that many of its requests have been implemented. 

Per the DPC, Meta has updated its transparency notices; made its objection form easier to use, available for longer, and accessible in its mobile apps; lengthened its notice period; made it more clear how users can hide their public posts from AI scraping; updated its data protection measures and updated General Data Protection Regulation documentation.

Additionally, the DPC will require Meta to compile a report on the effectiveness of its safeguards and “appropriateness of the measures” being taken in response. The report is due to the DPC in October. 

Meta intends to begin training AI on EU citizens’ data on May 27.

Not so fast

The DPC may be satisfied with Meta’s guarantees, but there are still a lot of privacy advocates and other regulatory bodies that are critical of this move.

None Of Your Business (noyb), the privacy outfit helmed by Austrian lawyer Max Schrems, is one such group that has continually objected to Meta’s plans. Noyb sent a cease and desist letter to Meta last week telling it to prepare for a class-action lawsuit if it opted to go through with its plans, citing a number of legal arguments for why Meta is in the wrong. 

Collecting data for AI training on “legitimate interest” grounds, for example, would be in violation of the General Data Protection Regulation (GDPR) by erroneously arguing that Meta needed all that data to be “culturally aware” of EU norms. 

Legitimate interest can be used as grounds to opt users into data processing by default with an option to opt out instead of opting in. Noyb argued that Meta has already lost a legal battle on similar grounds when it tried to argue for an opt-out option under legitimate interest grounds for ad targeting. Meta is now required to get explicit consent from users with an opt-in option for advertising. 

When asked for comment on the DPC decision, noyb told us that there was currently (it’s being heard today) a case before a German court brought by the Consumer Advice Center of North Rhine-Whestphalia seeking an injunction against Meta to prevent its AI training implementation on May 27 on grounds similar to noyb’s C&D letter. 

Noyb told us that a ruling is expected in short order, but it didn’t appear to be handed down before publication. We’ll update this story when we learn of the outcome. 

Noyb, meanwhile, said the German decision will affect its future actions in the matter, but it wasn’t going to acquiesce to the DPC’s decision. 

“Regardless of the DPC’s stance, we (and other orgs as well) are carefully assessing all legal options,” a noyb spokesperson told us. “Furthermore, other [data protection agencies] are quite critical here as well and might take actions themselves.” 

Meta didn’t respond to questions for this story. ®