Meta — no stranger to complaints over its use of personal data — is now facing another complaint. It recently messaged its 50m+ Facebook and Instagram users that it was changing its privacy policy to use their personal data to “develop and improve” its AI.

Meta explained that it had a “legitimate interest” to this change of use of personal data. Rather than offering users to opt-in to this change with its potentially wide ramifications for users, Meta instead offered users the opportunity to opt-out.

Open Rights Group — a UK-based digital rights organisation — has submitted a complaint to the Information Commissioner’s Office alleging that Meta’s actions infringe Articles 5(1) and (2), 6(1) 6(4), 9(1), 12, 13, 17(1)(c), 18, 19, 21(1) and 25 of UK GDPR. ORG’s complaint comes off the back of the objection filed by data rights group, None of Your Business, in 11 EU member states. This saw Mega pause its action but did not provide sufficiently robust protections.

It looks like ORG has a point. This seems to be an overreach by Meta. Just because Meta has the data for one purpose, doesn’t automatically mean they can use it for another purpose. Even if they really, really want to — that’s not what legitimate interest means. Also, Meta has not allowed users to choose to opt-in but has forced them to proactively opt-out of this use. Moreover, Meta says this new processing is irreversible and doesn’t explain how this fits with an individual’s right to be forgotten.

The timing is interesting as the Court of Justice of the EU (CJEU) recently clarified that the compensation rights under GDPR are exactly that, to compensate the individual, not to punish the other party. So, while an action by a regulator could lead to massive fines, an individual would likely only get minimal compensation.

If you need advice, contact me at +44 20 3824 9748 or fjennings@hcrlaw.com.