Today, a German Region Court in Cologne had to decide on an interim injunction against Meta. The German Consumer Rights Organisation "Verbraucherzentrale NRW" has brought the case, arguing that Meta violates the GDPR when sucking up decades of user data without consent to train its AI.
VZ NRW brought an "interim" case in an attempt to prevent Meta from starting AI training before a normal court case can be brought. The case was heard ad hoc yesterday at the German Higher Regional Court of Cologne. noyb hasn't brought a case itself and is not a party to the procedure in Germany, but is considering similar ligitation on an EU level.
Max Schrems: "We are somewhat surprised about the outcome, given that Meta's breach is quite massive and obvious. However, you must proof much more for an interim injunction than in a normal Court procedure. While the preliminary injunction has not been granted, this doesn't mean that the main procedure won't be won. While VZ NRW is bringing a case for Germany, noyb is also planning a case for the entire EU. Other organisations are also considering taking action these days – so this is far from done for Meta. If Meta's approach is finally found to be unlawful, it could be liable to damages claims from up to 400 million European users."
New Front: Hamburg DPA issued "urgency procedure" against DPC & Meta under Article 66 GDPR. The hearing also showed that the Hamburg Data Protection Authority (DPA) has issued a so-called "urgency procedure" under Article 66 GDPR against the Irish DPC (the lead regulator of Meta) and Meta. This would require the DPC to itself stop Meta AI training - contrary to the DPC's current postition. The Hamburg DPA was asked to join the German Court Case and disclosed this latest move in open court.
Max Schrems: "Despite Meta having a preliminary win in Germany, the overall battle just got bigger, when an EU regulator is going after them and their Irish 'friendly' regulator. It is interesting that the Court in Germany took the view that Meta followed the guidelines by the EU Data Protection Authorities, while the authorities themselves bring and urgency procedure."
