TFL Vsebine / Pravni letopis

Prispevek je umeščen v tekočo družbeno in pravno razpravo o razvoju modelov umetne inteligence na podlagi virov podatkov, ki tipično vsebujejo podrobne informacije o posameznikih, njihovem zasebnem življenju, zanimanjih in prepričanjih; to so podatki uporabnikov z družbenih omrežij. Prispevek se zlasti osredotoča na vprašanje zakonite pravne podlage te obdelave, pri čemer prek študije primera družbe Meta proučuje zatrjevani pravni temelj zakonitega interesa. Dilema, ali je taka obdelava po Splošni uredbi o varstvu podatkov dopustna, je prisotna vse od dne, ko je Meta naznanila obdelavo podatkov uporabnikov za ta namen, in so pritožbe posameznikov, nevladnih organizacij in nadzornih organov vodile do odloga načrtovane obdelave. Meta je vendarle začela uporabljati podatke s svojih družbenih omrežij Facebook in Instagram 27. maja 2025, ne glede na sporno pravno podlago. Avtorica test zakonitega interesa ponazori na primeru obdelave s strani Meta, pri čemer se opira na kriterije iz mnenja Evropskega odbora za varstvo podatkov št. 28/2024 o določenih vidikih obdelave osebnih podatkov v kontekstu modelov umetne inteligence ter na sodno prakso Sodišča EU. Namen prispevka je osvetliti prožnost pravne podlage zakonitega interesa ter preseči posplošeno razumevanje, ki prednost daje pravnemu temelju privolitve posameznikov. Splošna uredba o varstvu podatkov ne določa hierarhije med pravnimi temelji, vsak od njih ima svoje prednosti in slabosti. Ključno je, da se evropsko pravo varstva podatkov po državah članicah udejanja dosledno in konsistentno. Članek v tej luči preučuje, katerim kriterijem testa zakonitega interesa še manjka določnosti, ki bi vodila k usklajenemu pristopu evropskih nadzornih organov.

This article situates itself within the ongoing social and legal discourse on the development of artificial intelligence models trained on data sources that typically include detailed information about individuals—their private lives, interests, and beliefs—and, in particular, on user data from social media platforms. It focuses on the question of the lawful legal basis for such processing, examining the purported legal ground of legitimate interests through a case study of Meta. The question of whether such processing is permissible under the General Data Protection Regulation has been live since Meta announced its intention to process user data for this purpose, with complaints from individuals, non-governmental organisations, and supervisory authorities leading to a postponement of the planned processing. Notwithstanding the disputed legal basis, Meta commenced the use of user data from Facebook and Instagram on 27 May 2025. The author illustrates the legitimate interest test with reference to Meta’s processing activities, drawing on the criteria outlined in European Data Protection Board Opinion No. 28/2024 on certain aspects of personal data processing in the context of artificial intelligence models, as well as relevant case law of the Court of Justice of the EU. The article aims to shed light on the flexibility of the legal basis of legitimate interest and to move beyond a generalised understanding that prioritises consent as the primary legal ground. The General Data Protection Regulation does not establish a hierarchy among legal bases; each possesses specific advantages and limitations. Ensuring the consistent and coherent application of EU data protection law across Member States is therefore essential. In this context, the article examines which criteria of the legitimate interest test still lack sufficient precision to facilitate a harmonised approach by the European supervisory authorities.

(Re)defining Data Protection Law Amid the Development of Artificial Intelligence. Legitimate Interest as a Legal Basis for AI Model Training