EU users’ data is being sent to Kenya for human review by a Meta contractor, the MEPs’ question also highlights.

The MEPs – who come from S&D, Greens, the Left and Renew political groups across 17 countries, according to an assistant working on the issue – want to know what action the Commission will take alongside national privacy watchdogs regarding Meta’s compliance with the EU’s General Data Protection Regulation (GDPR).

The lawmakers also want to know if the Commission will conduct further impact assessments on proposed changes in its Digital Omnibus package which critics have warned could weaken the GDPR and individual privacy, writing that the allegations about Meta’s smart glasses “raise broader questions regarding the Commission’s digital policy initiatives, and proposals to ease EU rules on personal data for AI training”.

Sama staff work as annotators for Meta’s AI, meaning they do things like labelling objects within images to help AIs learn to recognise them. However Sama employees told the newspapers they had seen images of people in intimate situations, such as changing their clothes, which they believed were recorded without their knowledge and therefore without consent.

The personal data is supposed to be anonymised, for instance by blurring any faces that appear, according to the media reports. But Sama employees said automatic blurring and other safeguards applied by Meta do not always work.

Under EU privacy laws, people must be informed – and, in most circumstances, give their consent – for their personal data to be collected and processed.

Additionally, if personal data is sent outside the bloc to a third country it must either have a level of privacy protection that’s recognised as equivalent to the EU’s or additional safeguards must be applied.

Kenya is still in talks with the European Commission for its privacy laws to be recognised as adequate, meaning that specific contractual safeguards are likely to be required for companies to export EU people’s data there.

(nl)