Proposals aimed at simplifying digital regulations in the European Union would weaken existing privacy regulations, opening the floodgates for artificial intelligence (AI) companies to access European users’ data virtually unrestricted, privacy campaigners have claimed.
In amendments to the Digital Omnibus, ostensibly to simplify the EU’s growing stack of complex regulations such as GDPR, the AI Act and ePrivacy directive, the document now proposes that the use of personal data should automatically be lawful as long as it is in the “context of AI”.
European digital rights advocacy group NOYB is calling on EU member states to reject proposed changes to two articles that could undermine data privacy rules, which are being considered by the European Council under Ireland’s presidency, warning it may result in a “complete sell-off” of European data to global corporations. Member states are expected to give their opinions by the end of the week.
“With this whole omnibus, the headline sounds great – simplification for European small businesses – and under the hood, we get something totally different,” said NOYB’s Max Schrems.
RM Block
One amendment to the document under scrutiny states: “The processing of personal data in the context of the development and operation of an AI system or of an AI model may be carried out for a legitimate interest of the controller or a third party in accordance with Article 6(1)(f) of this regulation.”
That could mean historical data of European users opened up to companies that claim to have a legitimate interest under the guise of AI. Opponents warn it amounts to a digital land grab, putting the interests of private artificial intelligence companies above citizens’ right to data protection.
“Under these proposals, the profits of AI companies would trump European’s fundamental right to privacy. This is nothing short of the ‘digital expropriation’ of Europeans. Everything we have ever entered into digital systems, or that AI corporations have otherwise obtained, becomes fair game for AI corporations to use,” said Schrems. “A likely majority of European Union member states are now saying that the interests of Elon Musk, Google, Meta or OpenAI, in making enormous profits, should take precedence over our fundamental right to data protection.”
He described a proposed provision in the text that would compel “appropriate technical and organisational measures and safeguards” to protect the rights of data subjects as a “decoration”, and provisions for pseudonymisation of data – a process that replaces personal data identifiers with codes to prevent data being easily linked to a specific person – as a loophole that would make dealing with customer data and consent harder and more complex for many companies.
Soaring energy costs and why ‘we can’t protect everyone from the impact of war’
The proposed changes come as employees and key figures in Artificial Intelligence firms warn about the risks of the technology. Former Anthropic researcher Jacob Coxon quit the AI company amid concerns over the technology’s safety, while Anthropic safety researcher Evan Hubinger said he believed there was a greater than 10 per cent chance that AI could “kill all humans” within the next decade.
In July, it emerged that rogue artificial intelligence agents at OpenAI escaped their training environment to launch a hack against a significant software repository, Hugging Face, in what was considered the autonomous agent cyberattack.
Anthropic subsequently disclosed that its Claude AI models hacked into three organisations after it gained access to the internet during an evaluation of its cyberoffensive tasks. Google’s Gemini also breached the security of external companies in May during a cybersecurity evaluation by AI security firm Irregular.
The tech giant said that when the model figured out the companies were real rather than simulated as part of the test, it stopped, and the companies involved were made aware.
