Background
On June 26, 2024, Meta updated its Privacy Policy to allow the company to process personal data posted on its platforms, such as Facebook, Messenger, and Instagram, to train their AI systems. The Brazilian DPA became aware of the new policy and opened an investigation into Meta’s practices.
Brazilian DPA’s Concerns
The DPA is concerned that Meta’s new Privacy Policy may violate the Brazilian General Data Protection Law (LGPD) in the following ways:
- Inappropriate legal basis for data processing: The Brazilian DPA believes that Meta is using an inappropriate legal basis to justify the processing of personal data. The company is relying on the on the legal basis of “legitimate interest”, which is generally not allowed for processing personal data that could lead to discriminatory practices.
- Lack of transparency: The DPA believes that Meta has not been transparent enough about how it will process personal data to train their AI systems, as users have not been provided with clear and easily accessible information about the policy change and the processing of their personal data.
- Excessive limitations on user rights: The DPA believes that Meta’s new privacy policy places excessive limitations on users’ ability to exercise their rights under the LGPD.
- Processing of children’s data: The DPA is concerned that Meta’s new privacy policy could allow the company to process the personal data of children and adolescents without adequate safeguards. The LGPD requires that the processing of children’s data be carried out in their best interests and with appropriate safeguards. However, the DPA did not confirm this in their preliminary analysis.
DPA’s Actions
In light of these concerns, the DPA has issued a precautionary measure suspending the effectiveness of Meta’s new privacy policy in Brazil. This means that Meta is prohibited from processing personal data posted on its platforms to train AI systems until the DPA completes its investigation. The DPA has also imposed a daily fine of 50,000 (fifty-thousand) BRL on Meta for any non-compliance with the suspension order.
