Irish DPC: Early Engagement with Firms on AI Training Can Lower Privacy Risks
Engaging with leading tech companies at the forefront of AI development is helping ensure they understand how to reduce high risks and harms to people, the Irish Data Protection Commission said in a statement Wednesday.
Sign up for a free preview to unlock the rest of this article
The use of adults' personal data to train Large Language Models (LLMs) is a dominant theme of ongoing discussions in the EU/European Economic Area (EEA), the DPC said. These talks have led several organizations to deploy improvements and additional data-protection safeguards before LLM training launches in the EU, it said.
For instance, Meta notified the regulator in March 2024 of plans to train its LLM using public content shared by adults on Facebook and Instagram across the EU/EEA, the DPC noted. The office had several concerns with the rollout plans.
After being notified about those issues, Meta paused its model training plans in June 2024. The DPC then sought an opinion from the European Data Protection Board (EDPB) aimed at creating regulatory harmonization and clarity on key AI model training and deployment-related questions.
The EDPB opinion, issued in December, provided general criteria data that protection authorities should consider when they assess the compliance of data processing for the development and deployment of AI models (see 2412180004).
After publication of the EDPB opinion, Meta reassessed its proposal and updated the DPC about plans to start training its generative AI models on May 27, 2025, the watchdog noted. The office made several recommendations to Meta, which, in turn, implemented significant improvements, the DPC said.
Among other things, the DPC said, the company updated its transparency notices to users and created an easier-to-use objection form. In addition, it gave users a longer notice period as well as information on controls available to change all published posts from public to private to avoid being used for model training.
Meta is required to give the DPC an update in October on how well the various measures it's implemented for data processing are working. Meanwhile, the regulator said it "continues to actively monitor" the rollout of the forms that allow people to object to having their public posts used for AI model training.
The DPC noted that its pre-processing compliance assessments are intended to ensure "companies innovate responsibly, mitigate identified harms and risks to individuals and appropriately consider data subjects' rights by balancing and protecting fundamental rights against the companies' interest."