Artificial Intelligence & Machine Learning
,
Data Privacy
,
Data Security
Critics Say Regulation Amendments Would Chip Away at Fundamental Rights
A slew of amendments to European tech regulations touted by the European Commission as necessary for boosting continental competitiveness is receiving pushback from privacy watchdogs unhappy with changes that could water down EU privacy laws.
See Also: OnDemand | Transform API Security with Unmatched Discovery and Defense
The commission presented its so-called “Digital Omnibus” package of legal changes in November, arguing that the bloc’s tech rules needed streamlining. The bill is on a fast-track procedure, though the commission must still negotiate the final text with the European Parliament and Council of the EU, which represents the bloc’s member states.
Some of the tweaks were expected and have been broadly welcomed, such as doing away with obtrusive cookie consent banners in many cases, and making it simpler for companies to notify of data breaches in a way that satisfies the requirements of multiple laws in one go. But digital rights and consumer advocates are reacting furiously to an unexpected proposal for modifying the General Data Protection Regulation.
These include narrowing the definition of personal data, so that the classification would no longer apply to all data that can potentially be connected with an identifiable person. Instead, if an organization processing someone’s data cannot itself connect the information with the individual, the GDPR rules would fall away – even if the organization could then pass the data on to a third party, such as an ad broker, who could easily make the connection.
In an unusually forthright statement on Wednesday, the European Data Protection Board and the European Data Protection Supervisor said lawmakers should reject the change. The board represents national data protection authorities, and the supervisor oversees the behavior of EU institutions including the commission and the European Parliament.
“Simplification is essential to cut red tape and strengthen EU competitiveness – but not at the expense of fundamental rights,” said EDPB chair Anu Talus in the statement. “We strongly urge the co-legislators not to adopt the proposed changes in the definition of personal data, as they risk significantly weakening individual data protection.”
Wojciech Wiewiórowski, the EDPS, said that the proposal is “not in line” with the case law of the Court of Justice of the EU, the bloc’s highest legal authority. This was a direct riposte to the commission’s claim, made in its proposal, that the changes would “codify” the CJEU’s interpretation of the GDPR. According to the watchdogs’ joint opinion, the commission cherry-picked “a single element of a single case, [lacking] the necessary context.”
“The proposal ignores the specific characteristics of the case and will undermine – rather than improve – legal certainty,” they wrote.
The commission had not responded to a request for comment at the time of publication, but the proposal’s critics were quick to applaud the data protection authorities’ opinion.
Noyb Not Thrilled
“The independent authorities have called out key changes for what they are: neither ‘technical changes’ nor ‘simplification,’ but limitations of the right to data protection for EU residents,” said veteran privacy activist Max Schrems, the head of the Noyb non-profit, in an emailed statement.
Schrems’s NGO also welcomed the authorities’ pushback against a proposed limitation on people’s GDPR-given right to demand access to the data an organization holds on them, unless it is for data-protection purposes. The commission pitched this change as a reaction to scenarios involving abusive requests that are intended to harm the data controller, but the watchdogs said the GDPR’s data-access provision “aims to protect all individuals’ fundamental rights and freedoms, and is not limited to the protection of personal data alone.” The CJEU has already backed this up in case law, they added.
Noyb was also less than thrilled with the regulators’ stance on the commission’s desire to cement the GDPR’s “legitimate interest” basis for processing personal data as a legal justification for allowing artificial intelligence models to train on and operate using people’s personal data.
AI Models Already Can Use Personal Data for Training
Uncertainty over this point heavily delayed Meta’s rollout of its AI chatbot in Europe, until the EDPB decided that the GDPR’s “legitimate interest” basis for processing – a notoriously grey area, compared with legal justifications such as consent and contractual necessity – was kosher in this scenario. Digital rights groups did not agree with the decision, though a German regional court came to the same conclusion (see: Meta Begins AI Training Using EU Personal Data).
In their opinion this week, the watchdogs said their earlier decision made it unnecessary to change the GDPR. Once more, they pointed out the proposed change would only say that “processing in the context of development and operation of AI systems ‘may’ be pursued for legitimate interests, a statement that does not bring any legal clarification.”
If lawmakers intend to press on with this amendment, the regulators said, they should better clarify the circumstances where “legitimate interests” truly apply to AI training and operations.
Another notable element of the Digital Omnibus is the proposal to raise the threshold for notifying all personal data breaches to supervisory authorities.
As the GDPR currently stands, organizations must notify a data protection authority within 72 hours of becoming aware of the breach. If amended as the commission proposes, the obligation would only apply to breaches that are “likely to result in a high risk” to the affected people’s rights – the same threshold that applies to the duty to notify breaches to the affected data subjects themselves – and the notification deadline would be extended to 96 hours.
“This change is not expected to substantially affect the level of protection for data subjects but would significantly reduce the administrative burden for controllers, given that they would only have to notify data breaches that are likely to result in a high risk to the rights and freedoms of data subjects,” the EDPB and EDPS wrote approvingly, adding that it would also lessen the load on regulators who currently have to field thousands of data-breach notifications each year.
But they stressed that data controllers would still need to document all personal data breaches, and to implement measures to mitigate the potential effects of the breaches.