Schrems campaign raises specter of another legal challenge as legislators propose changes to GDPR:
The campaign group which forced the EU's highest court to strike down past US-EU data sharing deals has slammed the latest changes to European data protection laws designed to accommodate AI.
Led by Austrian lawyer Max Schrems, None of Your Business (noyb) claims the proposal to alter the data protection legislation "in the context of AI" amounts to an abandonment of data protection principles.
In September, the Commission said it would launch an "ambitious program" to strengthen the EU's competitiveness and "radically lighten the regulatory load for people, businesses and administrations." It proposed "immediate adjustments" to digital legislation to the boost competitiveness.
Earlier, the EU had proposed changes in the legislation governing the processing of personal data, governed by the General Data Protection Regulation (GDPR).
"Where the processing of personal data is necessary for the interests of the controller in the context of the development and technical operation of an AI system ... or an AI model, such processing may be pursued for legitimate interests," a briefing note said.
Noyb argues the amendments to Article 88c (original here) proposed by the European Commission (a leaked EU Council compromise draft renames it as article 88bis) would allow Big Tech to use all personal data collected over the past decades with virtually no restrictions, as long as this happens "in the context" of AI.
Schrems said: "Under these proposals, the profits of AI companies would trump Europeans' fundamental right to privacy. This is nothing but a digital expropriation of Europeans."
The campaign group said the changes could mean people who have never been customers of an AI company, whose data was entered into a system decades ago – for example in chats or on social media – may find their personal data is placed in the hands of an AI company. There is no need to ask users for consent: companies are automatically assumed to have an overriding "legitimate interest" if they train or use any AI product, the group said.
Schrems added: "A likely majority of EU member states are now saying that the interests of Elon Musk, Marc Zuckerberg, Google or OpenAI, in making enormous profits, should take precedence over Europeans' fundamental right to data protection. This is nothing short of the 'digital expropriation' of Europeans. Everything we have ever entered into digital systems, or that AI corporations have otherwise obtained, becomes fair game for AI corporations to use."
The campaign group said the European Commission had abandoned its data protection priorities in the interests of the tech industry lobby.
Meanwhile, the view of the European Parliament was mixed. However, the Court of Justice could examine whether the proposed changes can be reconciled with EU fundamental rights.
"In the past, the European Court of Justice has struck down EU law in cases involving much less significant infringements of EU fundamental rights, such as data retention or the transfer of EU data to the United States," it said in a statement.
Noyb is famous for having successfully challenged and dismantled two major transatlantic data transfer pacts through the Court of Justice of the European Union: The Safe Harbor Agreement (in 2015, in the Schrems I case) and the EU-US Privacy Shield (2020, Schrems II).
Schrems said the legal route might be the only option left to prevent the dilution of data protection law to satisfy the AI industry. "If the legislator has lost all sense of proportion and direction, then the people can only turn to the courts. Any extreme law that has a high risk of being overturned would at the same time only create more legal uncertainty – instead of promised simplification," he said.
(Score: 3, Informative) by arslan on Tuesday September 29, @05:43AM (2 children)
The elreg article and the legal dude that's making a fuss seems to be cherry picking parts of the proposal and omitting other parts... here's the truncated bit at the end from the sentence that they cherry picked from the actual proposal:
So basically, it doesn't trump (did I trigger someone) data protection laws.
(Score: 1) by shrewdsheep on Tuesday September 29, @06:02PM (1 child)
To be fair, the EU is incompetent by design (quotas, lack of transparency, little journalistic scurtiny...), so suspicion is always warranted.
If the law does not change anything with respect to privacy, why is it required in the first place? Notice the weasel word "explicit" and the ill defined concepts "interests" and "freedoms of the data subject". Why is it necessary to mention children? Shouldn't a clear definition of above concepts take care of that automatically?
I certainly concur that selective reporting disqualifies the journalist.
(Score: 3, Interesting) by arslan on Wednesday September 30, @02:40AM
Hehe that's me cherry picking/truncating... there's actual links to the other policies that elaborate in more details from the cross reference, i just didn't copy-paste it here is all.
I can't comment about the EU's competency - but specific to this case, all their doing is making it explicit - AI is fairly play as long as they comply with the rest of the policies. To be fair it is a step better than a lot of countries. There really isn't much news here tbh, except the fake drama being raised by the elreg author and the so called Austrian lawyer.