Thought Leadership
The EU’s planned GDPR changes for AI are drawing sharp criticism from privacy organization noyb, which is threatening legal action.
The privacy organization None of Your Business (noyb), led by Austrian lawyer Max Schrems, is strongly criticizing planned changes to the General Data Protection Regulation (GDPR) related to artificial intelligence. Noyb has previously succeeded in challenging two transatlantic data protection agreements before the courts.
Proposal for GDPR Article 88c
In September, the European Commission announced plans for an “ambitious program” aimed at strengthening the EU’s competitiveness and “radically reducing” the regulatory burden on individuals, businesses, and public administrations. According to noyb, the initiative includes “immediate adjustments” to digital legislation, including changes to Article 88c of the GDPR. In a leaked compromise draft from the Council of the EU, the provision would be renumbered as Article 88bis.
According to a briefing paper, the processing of personal data could in the future be based on legitimate interest if it is “necessary for the interests of the controller in relation to the development and technical operation of an AI system or an AI model.”
Noyb Calls It “Digital Expropriation”
Noyb argues that the proposed change could allow large technology companies to use virtually all personal data collected over decades with few restrictions, as long as the use is somehow “related” to AI. This could also affect people who have never been customers of an AI company but whose data was collected decades ago, for example through chats or social media.
According to noyb, individuals would no longer need to give their consent because companies would automatically be assumed to have an overriding legitimate interest as soon as they train or use an AI product. Max Schrems said:
“A likely majority of EU member states are now saying that the interests of Elon Musk, Marc Zuckerberg, Google or Open AI, in making enormous profits, should take precedence over European’s fundamental right to data protection. This is nothing short of the ‘digital expropriation’ of Europeans. Everything we have ever entered into digital systems, or that AI corporations have otherwise obtained, becomes fair game for AI corporations to use.”
Max Schrems, None of Your Business (noyb)
European Commission Responds
According to noyb, the European Commission has shifted its data protection priorities in favor of the interests of the technology industry. The position of the European Parliament on the proposed changes is reportedly divided. Noyb also points out that the European Court of Justice has previously struck down EU legislation involving significantly less extensive interference with fundamental rights, including data retention rules and the transfer of EU data to the United States. The organization therefore argues that the current proposals could also face judicial scrutiny.
Noyb’s Track Record in Court
Noyb is known for successfully challenging two major transatlantic data transfer agreements before the European Court of Justice. In 2015, the court invalidated the Safe Harbor framework in the Schrems I case. Five years later, in Schrems II, it struck down the EU-US Privacy Shield. Schrems said legal action could once again become the last remaining option for preventing what noyb sees as a weakening of data protection rules in favor of the AI industry:
“If the legislator has lost all sense of proportion and direction, then the people can only turn to the courts. Any extreme law that has a high risk of being overturned would at the same time only create more legal uncertainty – instead of promised simplification.”
Max Schrems, None of Your Business (noyb)
(Editorial Team)
