Great to have attended the Autoriteit Persoonsgegevens (Dutch DPA) (AP) open day. We heard from a wide range of speakers, including chairman Aleid Wolfsen. Topics included facial recognition, emotion recognition, generative AI, and the AP’s approach to enforcement. Some notable points include:
– The AP has forbidden the use of biometric facial recognition in shops to identify potential criminals. I pointed out that, in the UK, the Information Commissioner’s Office has a significantly laxer position, which has led to the widespread use of Facewatch: shoppers’ faces are biometrically scanned upon entry and checked, while retailers can upload faces of people of interest to Facewatch’s database. The AP then noted this as an example of unwanted and risky use of facial recognition technology (I largely agree). The regulatory divergence between the ICO and the AP on this topic is remarkable, given the similar legal framework.
– The AP has recently published its web scraping guidance, where it doubles down on its position that a (purely) commercial interest cannot be a legitimate interest if it is not protected by law. This effectively makes many types of web scraping impossible, in addition to the need to identify a suitable exemption to the ban on processing special category data under Article 9. I noted that web scraping is also done by search engines, which have existed for many years. However, the AP has decided to distinguish between web scraping for traditional search engines and generative AI technologies, due to the difference in processing activities after the web scraping has taken place. [Additional comment: I think the guidance is not entirely clear on this issue, particularly as search engines also store scraped content from webpages for further processing (including after the indexing process). The particular conversation I had at the event was regarding generative AI vs traditional search engines and why the AP seems to distinguish between them when it comes to web scraping. I think this will need to be clarified further, particularly now traditional search engines are ‘blurring the lines’ by incorporating generative AI into their search results (e.g. Google’s AI overviews).]
– On the issue of commercial interests not constituting legitimate interests, I noted that the AP’s (unorthodox) position is due to be tested before the CJEU (case C-621/22 – Koninklijke Nederlandse Lawn Tennisbond). The European Commission has previously written to the AP, suggesting that the AP’s interpretation is too strict and not in line with the GDPR (I agree). [Additional comment: On the point of search engines using legitimate interests, the AP did also mention the (presumably non-commercial) legitimate interest in allowing people to search the internet and easily access information from it in the context of search engines. However, in my view the same argument could easily be made for many generative AI-based applications. Another point the AP made was that data deletion and rectification is much harder in the context of generative AI. But in my view, this is something to take into account in the LIA balancing test rather than the establishment of a legitimate interest itself. Overall, something I think would benefit from further clarification, assumably after the CJEU’s judgment on the commercial legitimate interest issue.]
– I asked the chairman of the AP about the invocation of an urgency procedure before the end of June to stop Meta’s planned use of Facebook and Instagram user content to train its AI (as noyb.eu is also pushing for). The AP responded that, while they do have this power, the lead supervisory authority is generally responsible for enforcement (the Irish DPC in this case). From this response, I assume the AP is unlikely to invoke an urgency procedure in this case – although in my view it would be an excellent opportunity to do so.
– The AP says that users browsing the web must have a free choice regarding tracking cookies and technologies and should be able to reject them without detriment. I was not able to ask about the AP’s notable lack of (published) formal enforcement on this issue, but I hope to see some in the near future.
– The AP has recently increased its staffing levels and expects this to continue. [Additional comment: Hopefully this means complainants no longer have to deal with ridiculous waiting times, resulting in little to no action.]
Thank you to all who made the event possible. #RondjeRechtsstaat
