Privacy Navigator: Weekly Insights on Privacy, AI, and Compliance

AI Training &amp; Privacy: nyob vs MetaPrivacy advocacy group noyb (none of your business) has issued a &quot;cease and desist&quot; letter to Meta&#39;s Irish headquarters, threatening a class action lawsuit if the tech giant proceeds with its plan to train its AI models using EU user data without explicit opt-in consent.Meta&#39;s intention, set for May 27, 2025, is to use public data shared by adults across Facebook and Instagram for AI training, relying on an alleged &quot;legitimate interest&quot; under GDPR.Noyb argues that this &quot;opt-out&quot; approach is a clear violation of GDPR, which generally requires explicit consent for such extensive data processing, especially for AI training. They highlight that even if a small percentage of users opt-in, it would still provide Meta with vast amounts of data to learn EU languages and cultural references.Max Schrems, noyb&#39;s founder, stated that Meta&#39;s claim of &quot;legitimate interest&quot; is &quot;neither legal nor necessary&quot; and &quot;laughable.&quot; This isn&#39;t the first time Meta has faced scrutiny over its reliance on &quot;legitimate interest,&quot; as they were previously forced to shift to a consent-based approach for targeted advertising in the EU in 2023.Noyb also raises concerns about Meta&#39;s ability to technically differentiate between users who opt-out and those who don&#39;t, and the lack of clarity or approval from national data protection authorities. Texas vs. Google: A $1.375 Billion Privacy WinTexas Attorney General Ken Paxton announced a landmark $1.375 billion settlement with Google, resolving lawsuits alleging that Google illegally tracked and collected Texans&#39; personal data without their consent. This record-breaking settlement is the largest ever secured by a state attorney general against Google for data privacy violations.The lawsuit, filed in 2022, accused Google of secretly tracking users&#39; movements, private searches, and even voiceprints and facial geometry through its products and services. Paxton emphasized that &quot;Big Tech is not above the law&quot; and that the settlement sends a clear message that companies will be held accountable for abusing public trust. Google stated that the agreement settles various &quot;old claims&quot; related to product policies they have already changed and does not require any additional product changes.While a $1.375 billion settlement sounds substantial, it&#39;s crucial to look beyond the headline. Google, as is common in such settlements, admitted no wrongdoing. This allows them to avoid setting a legal precedent that could have wider implications. The fact that Google claims it doesn&#39;t need to make &quot;any additional product changes&quot; is also telling.This suggests that the financial penalty, while large, might be more of a cost of doing business rather than a catalyst for fundamental shifts in data collection practices.The &quot;Take It Down Act&quot; Signed into Law: A New Era for Deepfake RegulationPresident Trump recently signed the &quot;Take It Down Act&quot; (officially, the &quot;Tools to Address Known Exploitation by Immobilizing Technological Deepfakes On Websites and Networks Act&quot;) into law. Championed by Melania Trump, this bipartisan bill addresses the non-consensual online publication of intimate visual depictions, explicitly covering AI deepfakes.Key provisions include:Prohibition &amp; Penalties: Criminalizes the non-consensual online publication of intimate visual depictions (both authentic and computer-generated, termed &quot;digital forgeries&quot;) with mandatory restitution and criminal penalties (prison, fine, or both). Threats to publish such depictions are also prohibitedPlatform Responsibilities: Requires &quot;covered platforms&quot; (public websites, online services, or applications primarily providing a forum for user-generated content) to establish a process for individuals to report and request removal of such content. Platforms must remove the content within 48 hours of notification.Learn more at https://conformally.com/privacy-navigator


2025-W21 nyob vs Meta, Google with 1.3 Billion Settlement and Deepfakes law

The Irish High Court recently awarded €7,500 in damages for a GDPR breach—reportedly the highest such court-awarded damages in Ireland (and Europe?) to date.While administrative fines from data-protection authorities often reach into the millions or even billions, this relatively modest figure highlights a key point: it represents only an individual claim. Where numerous people are similarly affected by a single breach, the potential exposure for organizations could be enormous.


2025-W07 Largest GDPR Civil Damages Awarded by the Irish Court

The Consent or Pay model is now a reality in the UK, and the ICO has set out a framework for how businesses can implement it while remaining GDPR-compliant.At first glance, the approach seems balanced: users get a choice, companies get flexibility, and privacy remains protected—at least in theory.But here’s the real question: Is privacy something that can be bought and sold like any other commodity? If so, shouldn’t the market set the price? And if not, doesn’t that make the very concept of “paying for privacy” fundamentally flawed?The ICO tries to walk a tightrope between these two positions, but does it succeed? Or are we left with a framework that tries to regulate an uncomfortable reality without fully confronting its implications?


2025-W06 UK ICO’S Pay or OK Framework – A Tight Balance or A Bad Compromise

When news first broke that a small Chinese AI startup called DeepSeek managed to build a reasoning model better than OpenAI’s top-tier o1 model—and for around $6 million investment—everyone’s jaws dropped.How could such an underdog possibly outperform a tech giant that’s burned billions in research and developmentNot to mention it’s free. As you can imagine it went viral in a matter of days.But as we all know, there’s a dark side to these too-good-to-be-true stories. DeepSeek’s sudden stardom raised red flags among privacy regulators across Europe—especially once it became clear that this new AI powerhouse was more than happy to store and process your data on Chinese soil, in a manner that screams “GDPR… what’s that?”Let’s dive into this fiasco and see what lessons we, as privacy pros, can learn from DeepSeek’s swift rise and potential meltdown.Find all resources from this episode at: https://conformally.com/privacy-navigatorLearn more about Conformally at https://conformally.com


2025-W05 DeepSeek: A Quantum Leap in AI, A Dead End in GDPR Compliance

UK Data Use and Access Bill UpdatesSeven consortia have been selected to establish AI Factories across Europe.Brazilian AI Act On the WayUK Data Use and Access Bill UpdatesThe UK government is proposing the Data Use and Access Bill to modernise data protection regulations.The bill seeks to balance data processing benefits with user privacy and has received positive feedback from the Information Commissioner’s Office (ICO).It impacts sectors like health and finance, promoting data sharing in research while clarifying consent procedures.The bill addresses the use of automated decision-making technology (ADMT) in AI, granting individuals the right to challenge decisions made by AI systems.The proposed reforms would restructure the ICO, granting it additional enforcement resources and responsibilities related to technology innovation and public safety.The ICO would gain powers to investigate data protection compliance and security incidents, potentially requiring organisations to provide technical reports.The bill emphasises the responsible and careful handling of personal data in the context of AI and data breaches.Read more hereSeven consortia have been selected to establish AI Factories across EuropeSeven consortia have been selected to establish AI Factories across Europe. The tldr:These factories aim to boost AI innovation and will receive €1.5 billion in funding, split equally between the EU and national sources.They will be hosted in research hubs across Europe, including Barcelona, Bologna, Kajaani, Bissen, Linköping, Stuttgart and Athens.The AI factories will provide access to computing power, data, and talent necessary for AI development.Their focus is on developing large language models and specialised vertical AI models for various sectors.The next opportunity for Member States to submit proposals for new AI factories is 1 February 2025.Read more hereBrazil is on its way to regulate AI.Here is what you need to know:The Brazilian Senate will vote in two days on a bill to regulate Artificial Intelligence (AI).The bill defines AI systems similarly to the EU AI Act.It outlines rights for people affected by AI, drawing inspiration from GDPR principles.A risk-based approach is adopted, prohibiting certain AI systems deemed to be excessively risky.We quite liked Luiza Jarovski’s take on this, see it here
