Irish DPC Provides Update on Meta's AI Training Plans & Data Protection Measures

Key Takeaways

• Regulatory Oversight of AI: The DPC has worked with Meta to ensure that its use of personal data for AI model training complies with GDPR, focusing on minimizing risks to individuals' privacy.
• Enhanced Data Protection Measures: Meta has implemented updated transparency notices, user-friendly objection mechanisms, and stronger data safeguards to address privacy concerns.
• Ongoing Compliance Monitoring: The DPC continues to monitor Meta’s data processing activities and will assess the effectiveness of its safeguards through a report due in October 2025.
• User Empowerment: The DPC encourages individuals to actively manage their privacy settings on social media platforms, particularly by making public posts private to prevent their data from being used in AI training.

Deep Dive

The Data Protection Commission (DPC) has issued a detailed update on its ongoing engagement with Meta regarding its use of personal data to train Large Language Models (LLMs) in the EU/EEA. As AI technologies continue to evolve at a rapid pace, the DPC has been working with major technology companies to ensure that personal data is processed in compliance with the General Data Protection Regulation (GDPR). This regulatory oversight is essential in mitigating risks to individuals and protecting data subjects' rights within the context of cutting-edge AI development.

In a recent statement, the DPC emphasized the ongoing complexity of applying GDPR to AI, especially in relation to training AI models with public data. However, the DPC has made significant progress in engaging with industry leaders to ensure that data protection concerns are adequately addressed before new AI technologies are deployed in the EU.

In March 2024, Meta disclosed to the DPC its intention to use publicly available content from Facebook and Instagram users across the EU/EEA to train a generative AI model. In response to Meta’s plans, the DPC identified several critical issues with the proposed data processing practices. This led to discussions with Meta, culminating in the company pausing its AI training in June 2024 to address regulatory concerns.

In September 2024, the DPC engaged with the European Data Protection Board (EDPB), seeking a formal GDPR Opinion on several AI-related matters, aiming to bring regulatory clarity and consistency across EU/EEA member states. The EDPB’s Opinion, issued in December 2024, provided guidance on the general criteria that data protection authorities should consider when evaluating the use of personal data for AI training and deployment.

Meta's Revised AI Training Proposal and DPC Recommendations
Following the publication of the EDPB's Opinion, Meta reassessed its AI model training plans. With the updated proposal, Meta intends to resume training its generative AI model starting 27th May 2025. The DPC, having reviewed Meta's revised documentation, worked with other EU/EEA supervisory authorities to evaluate the potential risks to data subjects' privacy and to ensure compliance with GDPR.

As a result of this extensive regulatory engagement, Meta has made several important updates to its data protection practices, including:

• Updated Transparency Notices: Meta has issued new notifications to users in both 2024 and 2025, detailing how their public content may be used in AI training and providing users with an opportunity to object to this processing.
• Improved Objection Forms: The Objection Form has been redesigned to be more user-friendly, allowing individuals to easily object to the use of their data for AI training.
• Longer Notice Period: Meta has introduced an extended notice period, giving users time to change their privacy settings, including the option to switch public posts to private to prevent them from being used in AI training.
• Cross-Jurisdictional Access to Objection Forms: The Objection Form is now available in all European jurisdictions to ensure accessibility for all affected users.
• Enhanced Data Protection Measures: Meta has introduced stronger safeguards, including de-identification and data filtering techniques, to mitigate the risks associated with using personal data for AI training.
• Updated Risk Assessments: Meta has updated its risk assessments, including the Legitimate Interest Assessment, Data Protection Impact Assessment, and Compatibility Assessment, to reflect the newly implemented safeguards.

Ongoing Monitoring and Future Reports
As part of its continued oversight, the DPC has required Meta to submit a comprehensive report by October 2025. This report will evaluate the effectiveness of the new safeguards and the impact they have had on data protection. The DPC is also actively monitoring the implementation of the Objection Forms and the transparency notices to ensure that users are fully informed of their rights and can easily object to the processing of their personal data.

The DPC has reminded users to regularly review and adjust their privacy settings to ensure their preferences are respected. In particular, users are encouraged to consider setting their public posts to private to prevent their data from being used in AI model training.

The DPC continues to emphasize its commitment to ensuring that AI development and deployment occur responsibly and in compliance with GDPR. Through its active engagement with Meta and other leading tech companies, the DPC aims to mitigate risks to individuals while fostering innovation. As the lead supervisory authority for many global technology companies, the DPC is committed to consistent, transparent, and fair regulation, ensuring that all companies developing AI models in the EU/EEA are held to the same high standards.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.