ICO fails UK Meta users and allows social media giant to resume data scraping for AI

Open Rights Group have called on the ICO to justify its refusal to issue a binding order to stop Meta’s plans to scrape users data in order to train its AI systems. Meta’s plans will not only resume but have also expanded to include scraping users’ comments as well as posts, images and videos.

In May, the global tech company announced changes to its privacy policy claiming it would “rely on the legal basis called legitimate interests” to use individuals’ information for its AI development. However, these plans were put on hold after the data rights group “None of Your Business” lodged GDPR regulatory complaints in 11 EU member states, asking Data Protection Authorities (DPAs) to immediately stop Meta’s abuse of personal data for AI. As a result, Meta announced plans to pause these changes on June 14, and the ICO posted that Meta “responded to our request to pause and review plans to use Facebook and Instagram user data to train generative AI”. Open Rights Group also filed a complaint to the ICO, asking the UK regulator to investigate Meta’s plans and issue a legally binding order to stop processing UK’s personal data to train AI in the absence of valid opt-in consent.

On September 13, Meta said it was resuming its plans in the UK after it engaging “positively” with the UK. The ICO have also issued a statement, saying that the company has “made changes to its approach, including making it simpler for users to object to the processing and providing them with a longer window to do so”. Further, the ICO has allowed Meta to go ahead with its plans, despite its statement that it “has not provided regulatory approval for the processing”.

As a result, Facebook and Instragram users’ in the UK will have their data fed into Meta’s AI products without their consent, and will need to opt out instead. Meta is also silent on users’ rights to delete their data from Meta’s AI once the model has been trained. This suggests that users who do not to object to Meta’s AI training will not be able to have their data deleted at a later date, despite this being their right under UK data protection law. In comparison, Meta’s plans ar still on hold in the European Union and EEA, where Ireland’s Data Protection Commission is leading the investigation.

Mariano delli Santi, complainant and Legal and Policy Officer at Open Rights Group said:

“Once again the ICO has failed to stand up for the data rights of Meta users in the UK.

“Making the opt out process simpler is an inadequate response to these intrusive proposals to ingest the posts, pictures, videos and comments of over 50 million Facebook and Instagram users.

“The ICO has a legal duty to investigate complaints, yet they have decided to ignore Open Rights Group complaint. By omitting to act upon our complaint, the ICO is taking the sides of Meta’s commercial interests rather than the rights of the British public.

“Meta’s plans remain on hold in Europe. We call on the ICO to respond to our complaint and explain how these proposals comply with the UK GDPR.”

ORG complaint to the ICO

In July, ORG submitted a complaint to the ICO on behalf of five Meta users. The complainants asked the ICO to:

• Issue an imminent and legally binding decision under Article 58(2) UK GDPR to prevent the processing of the personal data of the complainants – and over 50 million UK data subjects — without consent.

• Fully investigate the matter under Article 58(1) UK GDPR.

• Prohibit the use of personal data for undefined “artificial intelligence technology” without the opt-in consent form the complainants – and indeed other data subjects.

The ICO has not responded to this complaint and has not compelled Meta to ask users for consent rather than allowing them to opt out.