INSTAGRAM and FACEBOOK users could, until Tuesday, May 27, 2025, fill out a form to object to the use of their data to train META’s artificial intelligence.
META collects and processes its users’ personal data and, as such, is considered a data controller within the meaning of the General Data Protection Regulation (“GDPR”).
The data controller must, in particular, define for each data processing operation, even if the data is public :
– A purpose (Article 5 of the GDPR) and
– A legal basis for the processing (Article 6 of the GDPR).
META now collects (i) public data from its adult users (published text, photos, comments) as well as (ii) all data resulting from its users’ interactions with its AI Chatbot, unless users object to such use by submitting the form before May 27, 2025.
This processing is carried out for a new purpose, which is to train the generative artificial intelligence model, Llama.
META has decided to base this new processing not on consent, which requires the prior agreement of each user and must meet restrictive conditions, but on its legitimate interest to train its AI system.
Legitimate interest does not require the prior agreement of the data subject, which is the case with consent, but the possibility to object to such processing.
This legal basis is also subject to conditions in order to be validly used by the data controller, in particular :
- If the interest pursued is “legitimate,”
- If the processing is necessary,
- The processing does not disproportionately affect the rights and interests of the data subjects, taking into account their reasonable expectations.
This legal basis is often put forward in order to develop an AI system.
Discussions are ongoing between the European data protection authorities (via the Irish authority) and META in order to assess the legality of the processing envisaged by META.
To be continued !
Please do not hesitate to contact us for advice relating to GDPR issues.