DP News – Week 15. EDPB will decide on the legality of Meta’s EU-US transfers and is already asked to discuss ChatGPT during its next meetings.

Today, on 13 April, the European Data Protection Board will make a crucial decision during their plenary meeting. The decision concerns the legality of Meta’s transfer of data between the EU and the US. The decision will be binding and made under Article 65 of the EU General Data Protection Regulation’s dispute resolution mechanism. The decision will determine whether Meta can continue to use standard contractual clauses (SCC) for transferring data or face a potential blackout of their services in the EU until a new legal transfer mechanism is established. The decision is being made in response to a case brought by Ireland’s Data Protection Commission (DPC). Initially, DPC was unable to resolve all objections raised by other data protection authorities and launched Article 65 dispute resolution mechanism.

Meanwhile, Spain’s data protection authority (AEPD) has asked the EDPB to address, during its following meetings, privacy concerns around ChatGPT.

“The AEPD understands that global processing operations that may have a significant impact on the rights of individuals require coordinated decisions at European level,” a spokesperson from the AEPD said. “Therefore, in the short term, it has requested that the issue of ChatGPT be included in the next Plenary of the EDPB, so that harmonised actions can be implemented within the framework of the application of the General Data Protection Regulation.”

In addition, at least two complaints about the ChatGPT’s use of personal data were filed last week with the Commission nationale de l’informatique et des libertés (CNIL), the French data protection authority.

One complaint highlights that, when creating a user account, ChatGPT offers no “general terms and conditions of use” to accept and “any privacy policy”, and there was also no success in obtaining any information from ChatGP through the access request. In another complaint, the complainant outlines that he identified personal information about him by questioning ChatGPT on his profile.