The Irish Data Protection Commission (DPC) has initiated proceedings against Google in the EU. It is suspected that Google did not carry out a data protection impact assessment or only an inadequate one before training its Pathways Language Model 2 (PaLM 2) with data from EU citizens.
Proceedings against Google: Was there no data protection impact assessment?
"A data protection impact assessment (DPIA) is essential to ensure that the fundamental rights and freedoms of natural persons are adequately considered and protected where the processing of personal data is likely to result in a high risk," explains the DPC in its communication of September 12, 2024.
This legal investigation is part of a comprehensive effort to regulate the processing of personal data of data subjects in the EU in the development of AI models and systems in cooperation with its EU/EEA peer regulators, the DPC adds.
The DPC refers to Article 35 GDPR, according to which a data protection impact assessment (DPIA) is required if the type of processing, in particular using new technologies, is likely to result in a high risk to the rights and freedoms of natural persons, taking into account the nature, scope, context and purposes of the processing.
Consideration required for AI training
It is explicitly stated that the data protection impact assessment is a key process for developing and demonstrating compliance. It ensures that data controllers identify and mitigate all data protection risks arising from high-risk processing. Among other things, it aims to ensure that the processing is necessary and proportionate and that appropriate safeguards are in place in light of the risks.
The Irish authority is responsible for Google, as the Group subsidiary Google Ireland Limited has its EU headquarters in Dublin, Ireland. The DPC acts on behalf of all EU data protection supervisory authorities. In the past, it has been accused of being overly lenient with the large US tech companies, which all have their EU headquarters in Ireland. However, this has now changed.
Reading tip: Generative AI - EDPS publishes guidance for use
AI trouble for X, Meta and Apple too
The DPC had previously filed a lawsuit against the social media platform X. During the court proceedings, the company had agreed to permanently cease processing certain personal data collected in the EU for the training of its AI chatbot Grok. As a result, the Irish authority discontinued the legal proceedings against X.
And Meta, the parent company of Facebook and Instagram, announced in July that it would not be making the successor to the Llama AI model available to customers in the European Union for the time being. Meta had previously stopped using data from European customers to train its AI after the EU data protection authorities intervened.
The technology company Apple also shows just how hot the topic of AI and data protection is. The company explained in a support message on September 9 that its own AI Apple Intelligence will not work for the time being if you are in the EU and your Apple ID is set to a country or region in the EU.
English 
German 
Italian 
French