Channeling U.S. Federal Trade Commissioner Alvaro Bedoya's keynote at the IAPP Global Privacy Summit 2023 last week, I thought I would test an artificial intelligence language model (ChatGPT, not to name it) to write this column. Spoiler alert: It failed. Just for the fun of it, I asked the model to write a 500-word text about recent privacy developments in Europe. It gave me a decent, though very high-level, account of the state of play. When asked to focus on 2022-23 developments, it wrote back an interesting text, with a little nugget that "recent proposals suggest that (e-privacy) will be adopted in 2023." Who would have thought! When I asked the model about the news in data protection in Europe this week, it responded that "(it does not) have real-time browsing capabilities so (it doesn't) have access to current news articles or updates." Bummer. So I turned to more traditional sources, like the European Data Protection Board.
The EDPB met in plenary this week and there were only two topics on the agenda, but oh my, are those big issues: ChatGPT and Facebook's use of standard contractual clauses for transfers.
AI is in many people's minds, in some shape or form. For some, it announces a doomsday scenario future; for others, there is nothing to fear. As with many things in life, the reality may be somewhere in the middle. But one thing many agree on is the role and responsibility that the privacy community and decisionmakers — whether in political, economic or societal circles — will have in shaping that very future.
One illustration of that is the emergence of AI litigation. Another is that in only a few weeks, several data protection authorities in Europe and elsewhere have seized ChatGPT as a topic of discussion at a minimum, and as a cause for bans in more peremptory approaches. Italy's Garante decided an immediate temporary limitation on the processing of Italian users' data by OpenAI, following a breach reported on 20 March of ChatGPT users' conversations and subscribers' payment information. In particular, the DPA is questioning the lack of transparency on data collection and the lack of legal basis on data collection and processing by the AI model.
In Europe, the existing legal framework applicable to AI is quite substantive already and branches into data protection, privacy, cybersecurity and consumer protection, let alone other areas of law that do have some relevance to AI aside from personal data considerations, like IP and trade secret rules, database regulations, digital trade and competition rules, and several others.
This Italian investigation into ChatGPT will be very interesting on many accounts. It will show the extent to which the existing legal framework applicable to AI in Europe is robust enough to empower regulators (in this case a data protection regulator) to accurately assess the situation and, where relevant, make proper determinations on fines and corrective actions. It will also add valuable thinking on the table of EU co-legislators as they still aim to finalize the AI Act legislation by the end of the year. In the meantime, the EDPB announced it is launching a dedicated taskforce "to foster cooperation and to exchange information on possible (DPA) enforcement actions."
As for data transfers, all eyes this week were on the EDPB as it reaches a binding decision on Ireland's Data Protection Commission draft decision regarding Facebook's use of standard contractual clauses to transfer EU data to the U.S. At the time of writing, the decision is not yet public but all signs indicate that the EDPB will decide in favor of the DPC ordering Meta to suspend its data transfers to the U.S. The DPC will have to adopt its final decision within one month of the EDPB notification.
This case was elevated to an "Article 65" dispute resolution procedure in January after the DPC was unable to resolve objections from other EU DPA to its draft enforcement decision. The IAPP's editorial director reported on this development at the time.
The decision will be consequential for Meta and fundamentally could have far-reaching implications well beyond Meta, at a time when EU-U.S. transfers are still waiting for a final commission adequacy decision expected late spring at the earliest. On Thursday, the European Parliament's Civil Liberties committee called the commission to reopen the negotiations with the U.S. to further improve the Data Privacy Framework. This reopening is extremely unlikely but such a call reinforces the cloud of uncertainty on data transfers in Europe and revives the trend for data localization.
