Meta Is About to Start AI Training on Public EU User Data—What Will the GDPR Authorities Do?
On 27 May, Meta plans to begin AI training using public EU user data from Facebook and Instagram. Yesterday, Meta’s lead GDPR regulator, the Irish Data Protection Commission (IDPC) published a statement highlighting the additional safeguards adopted by Meta since the previously paused plan from early 2024. On my reading, the IDPC implies that they do not object to Meta’s current plan, including Meta’s reliance on the “legitimate interest” basis for data processing under the GDPR. Nevertheless, it remains to be seen whether other EU data protection authorities (DPAs) and the courts will take the same approach. Following the IDPC’s statement, the Hamburg authority issued a “hearing letter” which may suggest German officials will try to overrule the Irish DPC to force a more restrictive approach as they have done in the past. There is also an ongoing attempt to secure an injunction in a German court to stop Meta’s 27 May plan. This matters to all AI developers and deployers in the EU, because Meta’s situation is not unique and whatever limitations are imposed on Meta, they can easily become a standard for others.