The Irish Data Protection Commission (DPC) has initiated proceedings against Google in the EU. There is a suspicion that Google did not provide any or only inadequate data protection prior to training its Pathways Language Model 2 (PaLM 2) with data from EU citizens. Data protection impact assessment has undertaken.
Proceedings against Google: Was there no data protection impact assessment?
"A Data protection impact assessment (DPIA) is essential to ensure that the fundamental rights and freedoms of natural persons are adequately respected and protected when the Processing of personal data is likely to lead to a high risk," explains the DPC in its communication of September 12, 2024.
This legal investigation is part of the comprehensive efforts to Processing personal data of data subjects in the EU in the development of AI models and systems in cooperation with its EU/EEA peer regulators, the DPC continues.
The DPC refers to Article 35 GDPRaccording to which a Data protection impact assessment (DPIA) is required if the nature of the Processingin particular using new technologies, taking into account the nature, scope, context and purposes of the Processing is likely to entail a high risk to the rights and freedoms of natural persons.
Consideration required for AI training
It is expressly pointed out that the Data protection impact assessment is a key process for the development and verification of compliance. It ensures that the information required for the Processing responsible for all data protection risks resulting from a high-risk Processing and reduce them. Among other things, the aim is to ensure that the Processing is necessary and proportionate and that appropriate safeguards exist in view of the risks.
The Irish authority is responsible for Google, as the Group subsidiary Google Ireland Limited has its EU headquarters in Dublin, Ireland. The DPC acts on behalf of all EU data protection supervisory authorities. In the past, it has been accused of being overly lenient with the large US tech companies, which all have their EU headquarters in Ireland. However, this has now changed.
Reading tip: Generative AI - EDPS publishes guidance for use
AI trouble for X, Meta and Apple too
The DPC had previously filed a lawsuit against the social media platform X. During the court proceedings, the company had agreed to Processing of certain personal data collected in the EU for the training of its AI chatbot Grok. As a result, the Irish authority discontinued the legal proceedings against X.
And Meta, the parent company of Facebook and Instagram, announced in July that it would not be making the successor to the Llama AI model available to customers in the European Union for the time being. Meta had previously stopped using data from European customers to train its AI after the EU data protection authorities intervened.
How hot the topic of AI and Data protection is also demonstrated by the technology company Apple. The company explained in a support message on September 9 that its own AI Apple Intelligence will not work for the time being if you are in the EU and your Apple ID is set to a country or region in the EU.
German 
English 
Italian 
French