Posts, comments, video clips, photos, numerous personal data that are shared publicly via Instagram, Facebook and other applications owned by the company Meta, since the end of June, are not just content that we share with friends.
By changing the privacy policy, the Targets can become material for training artificial intelligence (artificial intelligence - AI) developed by this American company, RSE writes.
Everything happened without announcement or explanation, and millions of users in the Western Balkans were not even informed about Meta's new "Privacy Policy", which was published on June 26.
In a document analyzed by Radio Free Europe (RSE), the company Meta states the launch of a new service - which is the ability to create text, sound, images and videos through artificial intelligence.
Meta collects publicly published content that users share through the company's platforms, so the new service it provides through the development of artificial intelligence will build on this practice.
Users of the Western Balkans were not informed about the news, while citizens of the European Union, when logging on to the platforms, received a warning that the policy was changing, and then the option to withdraw data from the planned artificial intelligence training.
When everything is put into context with local laws in the region, Meta was obliged to offer the same option to users in North Macedonia, Kosovo, Serbia, Bosnia and Herzegovina and Montenegro.
Legal solutions exist in the Balkan countries and are mostly harmonized with European ones when it comes to the processing of personal data, RSE's analysis shows.
However, the institutions responsible for protecting personal data in these countries do not have many instruments to react, their representatives told RSE.
As one of the biggest problems, they state that Meta has not even appointed representatives in the countries of the Balkans with whom the institutions would cooperate.
At the same time, Meta did not respond to Radio Free Europe's questions about privacy policy changes and their effects on users from Serbia, Montenegro, North Macedonia, Bosnia and Herzegovina, and Kosovo.
What does the new Meta policy bring?
The privacy policy represents a kind of contract between the users of the platform and the company that provides various digital products and services.
The most important part of this document is what data it collects and how it is processed by the digital platform. Meta is changing its policy precisely in these important areas.
The development of artificial intelligence is cited for the first time as a reason for the processing of Meta user data, according to an analysis of the Privacy Policy, which is available to the public through Meta's Facebook platform.
Namely, in the part of the policy "How and why we process your data", Meta company lists on the one hand a number of services and products it provides, and on the other hand different types of user data it collects for these purposes.
As stated in the document, it concerns publicly published content that users leave on platforms such as profile data, name, username, profile photo, then comments on social networks, but also video and audio content that is shared publicly.
Meta also collects data on the content that users pay attention to, i.e. collects data on how various contents are reacted to, the time of use and the frequency of interactions on individual networks controlled by Meta.
The list doesn't stop there, it also mentions "messages you send and receive, including their content, in accordance with applicable laws," as well as data about the devices from which Facebook or Instagram are accessed.
The target has very sensitive information
"If we look at Meta, what is special in this case is that they have access to platforms, such as WhatsApp, Instagram and Facebook, which have thousands of millions, actually billions of users and profiles, where sensitive information is located," he said in an interview with RSE lawyer Feliks Mikolaš.
Mikolaš is a lawyer for the organization and law firm NOYB (Non Of Your Business) based in Austria, which was one of the most active in filing lawsuits and letters to stop Meta's ideas at the EU level.
He adds that, unlike other companies developing artificial intelligence, there is a lot of information that Meta can use that other platforms cannot collect from the Internet, and this makes this case more problematic than when it comes to developing other AI models.
However, he points out that cases of misuse of personal data through the AI model have not yet been documented.
Commenting on the Privacy Policy, Mikolaš points out that two things are key - that the company did not ask for the user's consent for their data to be used for training artificial intelligence, but also that the artificial intelligence model it is developing is not described in detail.
"We can use this data for any purpose, we don't know exactly what we will use it for, we will just use it in general for AI technology. So it does not provide any information to users," says Mikolas and adds that the company must be more transparent.
Western Balkans without an option to exit AI training
While organizations and experts in the EU fought to treat the citizens of the Meta Union more considerately, the region remained in a kind of darkness.
RSE was unable to find users of Meta's platforms from the Western Balkans who were notified of the privacy policy change.
Meta did not respond to RSE's questions about how it informed users from Serbia, Bosnia and Herzegovina, North Macedonia, Montenegro and Kosovo about the newspaper's data collection.
Expert in digital rights and protection of personal data Ana Toskić Cvetinović from the organization "Partners of Serbia" states that the Western Balkans has found itself in a kind of gray zone in this case.
"Our entire region is in a specific position, which is in Europe, part of the EU integration process, our regulations are largely aligned with EU regulations, but the mechanisms available to us are not efficient enough as those that exist in relation to EU citizens ", states Toskić.
She states that at the end of July, the "Partners of Serbia" organization submitted an initiative to the Commissioner for the Protection of Personal Data to initiate proceedings against the company Meta for violating the law in Serbia.
The same initiative was announced by the organization SHARE, which deals with the protection of digital rights.
She adds that the Meta company was under a legal obligation to inform citizens about the new "policy", which was essential, not technical.
Who protects the digital rights of citizens in the Western Balkans?
Laws exist, but they are difficult to apply, according to some independent bodies for the protection of personal data in the Western Balkans.
There is no appointed representative in any of the five Meta countries, and for now the data protection authorities are not insisting on this through a joint initiative.
The Office of the Commissioner for Data Protection in Serbia states that in the coming period they will contact the company "Meta" regarding the change in the privacy policy.
Ana Toskić Cvetinović from "Partner Serbia" believes that the Commissioner should have informed the public what the changes to Meta's privacy policy entail.
"The commissioner should have informed the citizens about such a change, but since this has not been done now, proceedings should be initiated against the Meta company in order to determine possible illegalities in data processing," she points out.
The Office of the Commissioner explains that the initiation of proceedings against the company Meta was difficult because this company does not have a representative in our country, which is an obligation under the Personal Data Protection Act.
"Without the presence of representatives of these companies, our citizens cannot fully exercise their right to protection of personal data, nor can they exercise individual rights in a simple way," says the Office of the Commissioner.
Laws are harmonized with European ones, but certain provisions remain unenforceable, the Office of the Commissioner in Serbia explains, and they state that this is exactly what the example with Meta's policy changes shows.
They emphasize the same problem in North Macedonia.
According to the local law, those who process personal data should designate an authorized representative in North Macedonia, which is not the case with Meta, the Agency for the Protection of Personal Data in this country points out.
The Agency for the Protection of Personal Data of Montenegro, which implements the Law on the Protection of Personal Data in this country, states that it will be harmonized with European practice.
"We are closely monitoring how the matter develops at the EU level, we will follow the views of independent bodies in the region, we will decide according to the best standards of European law," explains the member of the Council of the Agency in Montenegro, Muhamed Gjokaj.
In Kosovo, the protection of personal data is handled by the Information and Privacy Agency, which as an independent institution reports on its work to the Assembly of Kosovo.
RSE addressed this Agency with a question whether they are aware of Meta's decision to change the privacy policy, whether this issue is being considered, and how the rights and personal data of Kosovo citizens can be protected. However, no answer came.
RSE also requested answers from the Ombudsman Institution (IO) of Kosovo, from which they state that they did not consider the issue of personal data processing for the purposes of artificial intelligence development by the company Meta.
"When the IO considers that the right to privacy has been violated, it has the mandate to examine it from the perspective of human rights," they state in their written answers to RSE.
The Agency for the Protection of Personal Data of Bosnia and Herzegovina did not respond to RSE's inquiry about the changes introduced by the new Meta policy until the publication of the text.
This Agency has repeatedly called for the adoption of a new law on personal data in BiH that would be harmonized with the GDPR and Convention 108, which the state has signed.
The existing law, the Agency previously assessed, is not sufficient to solve all the problems that have arisen due to the development of information technologies, digitization processes, mass use of video and audio surveillance, with artificial intelligence.
Metin AI model na pauzi u EU
The company Meta announced in mid-June that it will pause training of artificial intelligence models using publicly released data of European Union citizens.
This move by the company was welcomed by the Data Protection Commission in Dublin, stating in a statement that the decision followed intensive discussions between this body and the company.
Meta is registered in Ireland, so by law it is the competent authority for the protection of personal data in this country.
"We have nothing further to add, the process is still ongoing," the Commission in Dublin stated in response to a series of questions from RSE about Meta's plans to train an artificial intelligence model using data from users of platforms owned by it.
Coaching on personal data stopped in Brazil as well
Announcements by the company Meta that the artificial intelligence model will be trained with the help of content from the Facebook and Instagram platforms were stopped at the beginning of July in Brazil as well.
This Latin American country is one of the biggest users of Meta's platforms.
In early July, Brazil's National Authority for the Protection of Personal Data (ANPD) forced Meta to stop processing personal data for artificial intelligence training. A temporary measure was adopted ordering Meta to exclude personal data from artificial intelligence training materials.
If it does not comply with the decision, the company will be fined 50 thousand dollars per day.
According to publicly available data, the decision of the Brazilian regulator from the beginning of July this year remained unchanged.
The company Meta evaluated this decision as stopping the development of artificial intelligence in Brazil.
However, the training of artificial intelligence on content from platforms owned by Meta has not been stopped in all parts of the world.
Some smaller countries in Latin America, such as Argentina, share a similar fate with countries in the Balkans. Experts in this region believe that the reason for this is the lack of a legal framework.
US Meta user data will also be used to train AI models, as laws are less strict than in Europe.
Bonus video:
