On Wednesday, EU Member States approved a change to the GDPR that would put the profit-making interests of OpenAI, Anthropic, Google, Meta and SpaceX over European's fundamental right to data protection. According to the approved text, processing personal data “in the context of AI” should automatically be lawful. In particular, Big Tech would be able to use all personal data collected over the past decades with virtually no restrictions, as long as this happens “in the context” of AI. Schrems: “Under the agreed text, the profits of AI companies would typically trump European’s fundamental right to privacy. This is nothing but a digital expropriation of Europeans.” All this is happening despite the key figures of AI corporations actively warning about the enormous risks associated with their own products.
Last limits fall: Profits of AI companies trump data protection? As part of the "Digital Omnibus" Proposal, the European Commission claimed it would only make minor changes to simplify things for EU companies. At the same time, it explicitly claimed to maintain a “high level of protection” for people in Europe. Therefore, a “fast-track procedure” was chosen. This was done without carrying out a fundamental rights assessment or directly involving the European expert group on data protection.
Article 88c, as proposed by the European Commission (now Article 88bis in the Council document), intends to liberate the use of personal data for AI. The proposal is currently with the Council, where the Irish Presidency currently holds the reins. Ireland also serves as the EU headquarter for the majority of the US and Chinese AI corporations.
Digital expropriation: approved in the Council. With the support of Germany and other EU powerhouses, the Council (representing EU Member States) on Wednesday approved that companies should generally be permitted to do basically anything when using personal data "in the context of AI". This means that the commercial interests of AI companies would generally trump the fundamental rights of users. This general allowance would also apply to people who have never been customers of an AI company and to data entered decades ago, for example in chats or on social media. All personal data that an AI company can somehow get its hands on would fall under the provision. There would be no need to ask users for consent. Instead, it is automatically assumed that companies have an overriding "legitimate interest" if they use or train any AI product.
The Council has added a reference to the existing rights and duties under Article 21 (a right to an opt-out in specific cases) and Article 24 GDPR (the need for technical and organisational implementation of legal duties), but these alleged "safeguards" would apply to any processing even without that reference. In essence, no material safeguards are required by the new Article 88bis on AI.
Max Schrems: “On Wednesday, the EU Member States have agreed to take our data and feed it to AI companies for free. For decades, we have been telling people that their data is safe and, at best, is used for ads. Now, Google, Meta and Microsoft can just use all the data they've collected with almost no limits and for any project that involves some 'AI' component. This is the biggest gift that EU Member States have ever made to US Big Tech.”
The sale of European data to the US and China. Politicians seem to believe that the European economy will benefit from the abolishment of as many laws as possible. Nonetheless, the exact opposite can be expected: most EU companies neither have the access to the same volume of data nor the capital to compete with US corporations. In many cases, this could also mean that the data collected by EU companies (but processed on platforms or services outside the EU) would flow to providers in the US or China.
Max Schrems: “This legislative change primarily benefits the big players, those who have collected massive amounts of European data. This is a total sell-off of European data to global corporations. It would also result in a large amount of know-how flowing from EU companies to the US or China. From an industrial policy perspective, such an approach is madness.”
A blank check for an entire technology? Usually, the GDPR permits processing for specific purposes (e.g. retention for tax records or fraud prevention). However, the agreed Article 88c (or Article 88bis) legitimises an entire technology. Regardless of the purpose for which it is used, any AI system could lawfully take any personal data by default. For example, the proposed Article would also permit the training and use of AI for manipulation, disinformation, the generation of nude images or killer drones, and indeed any other questionable purpose. Many processing operations that were so far illegal could suddenly become legal – just because they are done “in the context” of an AI system. For example, data processing for personal advertising purposes (without consent) is currently illegal in the EU. Now, however, advertising could suddenly become legal if it is personalised using AI technology.
Max Schrems: “It’s like saying anything goes – no matter what you do – as long as it’s done with AI. If something is illegal in an Excel spreadsheet, it's legal if done with an AI agent. It’s utterly absurd to give preferential treatment to a high-risk technology over every other computer system.”
The 45-year promise of data protection is collapsing. On a European level, data protection legislation has existed since 1981. For decades, Europeans have been promised that such (supposedly) “strict” data protection would ensure that platforms such as Twitter/X, Facebook or Instagram, and corporations such as Google or Microsoft, which collect vast amounts of data, would “never” use it for other purposes that for what they were shared. The proposed Article 88c (or now 88bis) breaks this promise: all collected data is suddenly up for grabs for any use by any AI system.
Max Schrems: “Since the 1980s, we have promised people that while large corporations may hold onto data, they are only permitted to use it to a limited extent. However, Article 88bis suddenly opens the floodgates and allows unlimited use of all data for AI."
Further massive limitations on protections and rights. Furthermore, EU member states have proposed to drastically narrow the definition of “personal data”. This means that, among other things, it is unclear whether online tracking would still be covered by the GDPR. This is supposed to be done using so-called "pseudonyms", which should regularly not be covered by the GDPR anymore. The problem is that most IT systems primarily work with pseudonyms (such as user IDs, tracking IDs, IP addresses or social security numbers). The decision of whether data is still “personal” would be primarily made by the companies that are regulated by the law. Such debates typically drag on for years and drown procedures in enormous delays and enormous costs – so anything but "simplification".
Max Schrems: “These changes are right out of the playbook of any big law firm defending big tech. We've spent years in courts and before authorities to get these claims rejected. The EU legislator will likely turbocharge them and hence make EU law even more complex and unenforceable.”
Next Battleground: The European Parliament. This agreement is not an agreement on the final law. The Council has to negotiate the final wording with the European Parliament, which is yet to take a position. The European Commission is the third institution involved in the so-called "Trilogues" that will lead to a final EU law. The Commission has already made a 180-degree turn a while ago and currently clearly prioritises the interests of industry lobbies over fundamental rights.
The position of the European Parliament is still in the making. Whilst most of the European People’s Party (EPP) tend to argue in favour of putting more and more loopholes in EU digital laws, Members of the European Parliament from the center-left fractions have so far pushed back and favour keeping the status quo. Increasingly, also far-rights groups oppose proposals for a “free pass” for Big Tech.
Last hope: The Court of Justice? The main question seems to be whether a law without any meaningful restrictions can in any way be reconciled with EU fundamental rights. In the past, the European Court of Justice has struck down EU law in cases involving much less significant infringements of EU fundamental rights, such as data retention or the transfer of EU data to the United States.
Max Schrems: “If the legislator has lost all sense of proportion and direction, the people can only turn to the courts. Any extreme law that has a high risk of being overturned would at the same time only create more legal uncertainty instead of promised simplification.”
