The European Union Regulation on Artificial Intelligence and Data Privacy – Explained by Anna Kriebel

Meta AI Assistant won’t be available in the European Union – at least for now. After a conflict with Irish data regulators over privacy concerns, Meta announced earlier this month that it would delay the release of its AI assistant in the EU.

Meta collected publicly shared content from Facebook and Instagram users around the world to train its large language model (LLM), Meta Llama 3. Such LLMs are trained on large datasets to generate, summarize, translate, and predict digital content. Meta’s new AI assistant, based on Llama 3, integrates these capabilities with Meta’s social platforms.

Meta AI Assistant first launched in the United States in September 2023 and has since expanded to Australia, Canada, Ghana, Jamaica, Malawi, New Zealand, Nigeria, Pakistan, Singapore, South Africa, Uganda, Zambia and Zimbabwe . Europe was on the horizon – until Ireland’s Data Protection Commission (DPC) demanded (with the implied threat of fines and further legal action) that Meta stop using Europeans’ social media posts to train Llama 3, scuppering Meta’s plans to launch an AI assistant in Europe .

While AI regulation in the United States is still largely theoretical, the European Union has taken a much more aggressive stance in recent years, introducing two major programs: the General Data Protection Regulation (GDPR), implemented in 2018, and the EU Artificial Intelligence Act , which went into effect in March. Both regulations apply to all EU member states, and the GDPR also covers Iceland, Liechtenstein, and Norway, which are part of the European Economic Area but not the EU.

GDPR, which the EU itself describes as “the strictest privacy and security law in the world”, sets standards for the protection of personal data and imposes severe financial penalties on violators that can amount to tens of millions of euros. GDPR applies to any organization that processes personal data of European citizens or residents, including those outside a region such as Meta.

Each of the 30 countries covered by the GDPR has its own data protection authority responsible for monitoring compliance with the law. These authorities report to the European Data Protection Board, which ensures uniform application of the GDPR across the region and hears appeals from those who have been penalized. The GDPR also establishes a number of individual rights related to access, restriction and erasure of personal data, and also grants Internet users a private right to claim compensation in civil courts.

GDPR limits data processing, broadly defined as “any action performed on data, whether automated or manual.” This includes recording, organizing, storing, using or deleting personal data. Pursuant to the law, personal data may only be processed if:

the natural person expressly consents to the processing of his or her data, e.g. subscribing to a mailing list;
data processing is necessary to perform a contract, a personal legal obligation or to save someone’s life;
the processing of data serves the public interest or some official function;
there is another “legitimate interest” unless it is overridden by the “fundamental rights and freedoms of the data subject”, especially in the case of a child.

The GDPR sets out seven principles of data protection and accountability:

data processing must be lawful, fair and transparent to the individual;
any processing of personal data must be related to the specific, legitimate purposes for which the data was originally collected;
data collection must be limited to what is necessary to achieve the stated purpose;

processors are obliged to update users’ personal data on an ongoing basis and correct any inaccuracies “immediately”;
processors may not store personal data longer than necessary for the original purpose;
processors must ensure “adequate” security and confidentiality;
at all times, data processors must be able to prove compliance with all GDPR requirements.

The terminology of the GDPR is inherently vague. The EU itself describes the regulation as “fairly vague” and justifies this ambiguity as a safeguard against obsolescence. The EU believes that, with technology evolving so rapidly, a certain level of generality is needed for the law to remain relevant.

The vagueness of the law also leaves wide latitude for regulatory authorities. For example, the Irish DPC has been particularly zealous in enforcing GDPR. With Meta’s European headquarters located in Dublin, Irish regulators have been at the forefront of the prosecution against the tech giant, as evidenced by this month’s move. According to its 2023 annual report, the Irish DPC was responsible for 87 percent of all GDPR fines in the EU, the majority of which were imposed on Meta for privacy breaches.

This contentious dynamic is likely to continue. In a June 14 statement, the DPC said it would “continue to engage with Meta on this matter” to enforce the GDPR alongside other EU data protection authorities. Meta, meanwhile, expressed “disappointment” in the DPC’s request, arguing that its LLMs need to have access to public content shared on social media platforms to “accurately understand important regional languages, cultures, or social media trends.” Meta noted that several competitors — including Google and OpenAI — continue to train their LLMs on data from EU users, and emphasized that it does not use private posts or messages to train its software.

While the DPC’s move has halted development of Meta’s AI Assistant tool in Europe, negotiations between the company and regulators are still ongoing. “We are confident that our approach is in line with European laws and regulations,” Meta said in a statement.

What does the EU Act on Artificial Intelligence introduce?

The EU’s Artificial Intelligence Act, passed in March 2024, is considered the world’s first comprehensive regulation on AI. It restricts certain forms of AI to ensure that “AI systems respect fundamental rights, safety and ethical principles,” according to the European Commission.

The act is addressed primarily to artificial intelligence creators, but also covers people and organizations using artificial intelligence systems for professional purposes – for example, websites with customer service chatbots or personalized shopping recommendations. Like GDPR, the Artificial Intelligence Act applies to entities operating in the EU, regardless of location. The Artificial Intelligence Act, unlike the distributed regulatory framework of GDPR, is enforced centrally by the European AI Office.

The EU Artificial Intelligence Act divides AI into four risk categories.

“Unacceptable Risk”: Prohibited. This refers to artificial intelligence used for manipulation, biometric categorization, facial recognition databases or social scoring by public authorities to assess a person’s trustworthiness, as implemented by the CCP.
‘High Risk’: Strictly regulated. This includes AI that profiles individuals – such as a CV scanner for job applicants – and AI used in key areas such as infrastructure, education, employment, law enforcement and the judiciary.
“Limited risk”: Minimal transparency requirements. This includes general purpose AI (GPAI) systems such as chatbots and deepfakes. Providers of such systems must make people aware that they are interacting with AI-generated content.
“Minimal risk”: Largely unregulated. This includes spam filters and video games with improved artificial intelligence.

Most of the EU’s AI bill addresses “high-risk” AI systems, requiring providers to develop guardrails to monitor risk, ensure accuracy, enable human oversight and help “downstream providers” that integrate GPAI with other platforms to compliance with the requirements of the Artificial Intelligence Act. They must also keep detailed records to document compliance with the Artificial Intelligence Act to the enforcement bodies at the European AI Authority.

For GPAI systems designated as “limited risk,” the regulatory burden is much lower. However, providers must document training processes for their GPAI systems, comply with the EU Copyright Directive, and inform “downstream providers” of the system’s capabilities and limitations so they can comply with the AI Act.

It is planned that the EU Artificial Intelligence Act will enter into force in stages depending on the level of risk. “Unacceptable risk” artificial intelligence systems will be banned in September, six months after the law enters into force. “High-risk” AI systems, depending on their type, will have between 24 and 36 months to comply with regulatory requirements, while “limited-risk” GPAI systems, such as Meta’s Llama 3, will have just 12 months .

While the law has yet to be implemented, tensions are already brewing between the emerging European Artificial Intelligence Office and the tech giants. Amazon and Meta executives have warned that the regulations could paralyze AI research and development in the EU. “We need to make sure that innovation continues and that it doesn’t just happen outside of Europe,” Amazon’s chief technology officer Werner Vogels told CNN. “We already have a long history of underinvestment in research and development in Europe.”

What does this mean for future regulation of AI?

The stalemate between Meta and the Irish DPC illustrates the ongoing struggle to balance innovation and ethics in the EU’s complex regulatory landscape. The need for massive amounts of data to train AI systems hits EU privacy restrictions, leading to a zero-sum battle between regulators and developers. With GDPR coming into force and the AI Act looming on the horizon, more clashes are likely to arise.

Meta isn’t the only tech company clashing with regulators over the development of AI features. Apple recently announced it would withhold Apple Intelligence from the EU, citing concerns about the Digital Markets Act.

Michael Frank, founder and CEO of AI consulting firm Seldon Strategies, doubts that the new AI Act will actually establish the new “global standard” that EU regulators have announced. “I don’t think it will be extraterritorial,” Frank said. “Either the EU relaxes the rules during the implementation phase, or AI vendors leave the market.”