DATA PROTECTION CONCERNS have been raised after Facebook and Instagram parent company Meta announced it will soon start using its users’ posts and photos to train its Artificial Intelligence products and services.

Users of the social media platforms are automatically opted in to consent to this. While they have the option of opting out, they must go through a number of steps to do so, which has raised concerns among data privacy advocates and experts.

Many users of Meta products will have gotten a notification informing them that as of 26 June the company will be expanding its “AI at Meta experiences”, including Meta AI an AI creative tools. 

“To help bring these experiences to you, we’ll now rely on the legal basis called legitimate interests for using your information to develop and improve AI at Meta.”

The notification says users have a right to object to how their information is used for these purposes, and that “if your objection is honoured, it will be applied going forwards”.

If a user objects, they must click on the link in the notification and fill out a form explaining why they object to their data being used in this way. They must then check their email address to provide a confirmation code before their objection is lodged.

“Currently they’re throwing up a consent form. But the consent form doesn’t say, ‘yes I approve’. It’s fill in this form if you don’t approve. So it’s an opt out form,” said Simon McGarr, a solicitor and director of Data Compliance Europe.

“Unless you fill that in that you’ve consented to their legitimate interest use of your data. Now, I don’t think that’s valid because people’s data in Meta and Facebook is likely a mix of what is known and personal data and sensitive personal data.

And sensitive personal data cannot be processed on foot of legitimate interest.

McGarr said this was covered under Article 9 of GDPR legislation. He said that the Data Protection Commissioner should intervene in the matter.

“You must have a lawful legal basis to process data, and this is definitely data processing it will include personal data but it will also include sensitive personal data,” he said.

Any posts that discuss sexual orientation or medical conditions, for example, would be considered sensitive personal data, and McGarr said Meta is not legally able to process these under legitimate interest, due to GDPR legislation.

In a statement, the Data Protection Commissioner:

“Meta delayed the launch following a number enquiries from the DPC which have been addressed. Meta is now giving users a jewel notification, additional transparency measures (AI privacy centre articles), a dedicated objection mechanism, 4 weeks from notification to users to date of initial training so there is now a time between notification and training.

“Meta has advised the DPC that only that personal data (posts not comments) shared by users based in the EU to a public audience on Instagram and Facebook at the time of training will be used and that this will not include personal data from accounts belonging to users under 18.

The DPC has also shared this and more information with our EDPB colleagues as our engagement with Meta has progressed.