Schrems campaign raises specter of another legal challenge as legislators propose changes to GDPR
The campaign group which forced the EU's highest court to strike down past US-EU data sharing deals has criticized the latest changes to European data protection laws designed to accommodate AI.
Led by Austrian lawyer Max Schrems, None of Your Business (noyb) claims the proposal to alter the data protection legislation “in the context of AI” amounts to an abandonment of data protection principles.
In September, the Commission said it would launch an “ambitious program” to strengthen the EU’s competitiveness and “radically lighten the regulatory load for people, businesses and administrations.” It proposed “immediate adjustments” to digital legislation to the boost competitiveness.
Earlier, the EU had proposed changes in the legislation governing the processing of personal data, governed by the General Data Protection Regulation (GDPR).
“Where the processing of personal data is necessary for the interests of the controller in the context of the development and technical operation of an AI system … or an AI model, such processing may be pursued for legitimate interests,” a briefing note said.
Noyb argues the amendments to Article 88c (original here) proposed by the European Commission (a leaked EU Council compromise draft renames it as article 88bis) would allow Big Tech to use all personal data collected over the past decades with no restrictions, as long as this happens “in the context” of AI.
Schrems said: “Under these proposals, the profits of AI companies would trump Europeans’ fundamental right to privacy. This is nothing but a digital expropriation of Europeans.”
The campaign group said the changes could mean people who have never been customers of an AI company, whose data was entered into a system decades ago – for example in chats or on social media – may find their personal data is placed in the hands of an AI company. There is no need to ask users for consent: companies are automatically assumed to have an overriding “legitimate interest” if they train or use any AI product, the group said.
Schrems added: “A likely majority of EU member states are now saying that the interests of Elon Musk, Marc Zuckerberg, Google or OpenAI, in making enormous profits, should take precedence over Europeans' fundamental right to data protection. This is nothing short of the ‘digital expropriation’ of Europeans. Everything we have ever entered into digital systems, or that AI corporations have otherwise obtained, becomes fair game for AI corporations to use.”
The campaign group said the European Commission had abandoned its data protection priorities in the interests of the tech industry lobby.
Meanwhile, the view of the European Parliament was mixed. However, the Court of Justice could examine whether the proposed changes can be reconciled with EU fundamental rights.
“In the past, the European Court of Justice has struck down EU law in cases involving much less significant infringements of EU fundamental rights, such as data retention or the transfer of EU data to the United States,” it said in a statement.
Noyb is famous for having successfully challenged and dismantled two transatlantic data transfer pacts t hrough the Court of Justice of the European Union: The Safe Harbor Agreement (in 2015, in the Schrems I case) and t he EU-US Privacy Shield (2020, Schrems II).
Schrems said the legal route might be the only option left to prevent the dilution of data protection law to satisfy the AI industry. “If the legislator has lost all sense of proportion and direction, then the people can only turn to the courts. Any extreme law that has a high risk of being overturned would at the same time only create more legal uncertainty – instead of promised simplification,” he said. ®