Privacy group noyb slams EU for changing data rules to cater to AI

The Vienna-based privacy group noyb has criticized proposed changes to European data protection law meant to make room for AI, calling them an abandonment of the principles behind the GDPR. The group, led by Austrian lawyer Max Schrems, warns the amendments could end up before the Court of Justice of the European Union.

What the Commission proposes

In September, the European Commission said it would launch an "ambitious program" to strengthen the EU's competitiveness and "radically lighten the regulatory load for people, businesses and administrations." Earlier, the EU put forward changes to the rules that govern the processing of personal data under the GDPR.

A briefing note states that such processing "may be pursued for legitimate interests" where it is necessary for the controller's interests "in the context of the development and technical operation of an AI system … or an AI model."

"Digital expropriation"

noyb argues the amendments to Article 88c proposed by the European Commission — renamed article 88bis in a leaked EU Council compromise draft — would let Big Tech use all personal data collected over past decades with virtually no restrictions, as long as it happens "in the context" of AI.

The group says people who were never customers of an AI company, and whose data was entered into a system decades ago in chats or on social media, may find that information in the hands of an AI firm. Consent would not be needed, because companies would be assumed to have an overriding "legitimate interest" whenever they train or use an AI product.

Schrems said: "Under these proposals, the profits of AI companies would trump Europeans' fundamental right to privacy. This is nothing but a digital expropriation of Europeans."

He added that a likely majority of EU member states now say the interests of Elon Musk, Marc Zuckerberg, Google or OpenAI in making enormous profits should take precedence over Europeans' fundamental right to data protection.

Courts as the last resort

noyb says the European Commission has abandoned its data protection priorities for the sake of the tech industry lobby. The view of the European Parliament was mixed, and the group notes the Court of Justice could examine whether the changes can be reconciled with EU fundamental rights. "In the past, the European Court of Justice has struck down EU law in cases involving much less significant infringements of EU fundamental rights, such as data retention or transfers of EU data to the United States," it said.

noyb is best known for dismantling two transatlantic data transfer pacts: the Safe Harbor Agreement, struck down in 2015 in the Schrems I case, and the EU-US Privacy Shield, invalidated in 2020 in Schrems II. Schrems said litigation may be the only option left: "If the legislator has lost all sense of proportion and direction, then the people can only turn to the courts."