The Spanish data protection authority (AEPD) has published a decision to dismiss a complaint against Meta Platforms Ireland Limited concerning the use of personal data for training artificial intelligence models. The complaint was rejected because the company voluntarily suspended the contested processing before its implementation, leading the Irish lead supervisory authority to conclude that no infringement was committed at the time of the complaint review.

Facts and context

The Spanish data protection authority (AEPD) today published a decision to dismiss a complaint against Meta Platforms Ireland Limited regarding its project to use personal data of its users to train its artificial intelligence models.

The case originated from a complaint filed on 23 May 2024, following a notification from Meta announcing an update to its privacy policy scheduled for 26 June 2024.

Reasons for the decision

As this is a cross-border processing and Meta's main establishment is in Ireland, the complaint was forwarded to the Irish supervisory authority acting as the lead authority. The latter's analysis, adopted by the AEPD, led to the dismissal of the complaint for the following reasons:

• No infringement found: The complainant challenged the lawfulness of the intended processing, notably the use of legitimate interest (Article 6(1)(f) of the GDPR), the clarity of the information provided, and compliance with data protection by design (Article 25 of the GDPR). However, following the intervention of the Irish lead supervisory authority, Meta voluntarily agreed to suspend the deployment of its new privacy policy and not to use the data of European Union and European Economic Area users for training its models. The authority therefore concluded that the contested data processing had not taken place and that, consequently, no GDPR infringement was constituted at the time of the complaint review, justifying its dismissal under Article 57(1)(f) of the GDPR.

Authority's decision

Consequently, the authority declared the complaint inadmissible and dismissed the procedure.

Lessons learned

This decision clarifies that:

• The voluntary suspension of a planned data processing before its implementation can lead a supervisory authority to conclude the absence of an infringement and dismiss the related complaint.
• A complaint dismissal based on the absence of actual processing does not constitute validation of the legal basis or the modalities of the processing initially planned.
• The lead supervisory authority may decide to reject a complaint, but the formal dismissal decision is adopted and notified by the authority where the complaint was originally filed, in accordance with the cooperation mechanism of Article 60 of the GDPR.
• The question of the appropriate legal basis for training artificial intelligence models from personal data of users remains a major focus for authorities, and this dismissal does not close the substantive debate.