Norway is Nuts about Meta: The Urgency Ban with Tobias Judin

On this week of Serious Privacy, Paul Breitbarth of Catawiki and Dr. K Royal connect with Tobias Judin, the Head of the International Section at the Norwegian DPA and Co-Chair of the International Enforcement Working Group of the Global Privacy Assembly. Tobias has a background in law and informatics, which lends itself well to the recent investigations and actions by the Norwegian DPA. On 27 October 2023, the European Data Protection Board made a big decision. The urgent request from the Norwegian DPA to enforce a processing ban for Meta’s personalised advertising practices was endorsed. 
Some resources mentioned:

• Leaked FB memo about Cambridge Analytica
• Paul’s post on Linkedin with photos of consent 

If you have comments or questions, find us on LinkedIn and IG @seriousprivacy, and on Blue Sky under @seriousprivacy.eu, @europaulb.seriousprivacy.eu, @heartofprivacy.bsky.app and @igrobrien.seriousprivacy.eu, and email podcast@seriousprivacy.eu. Rate and Review us!

Proudly sponsored by TrustArc. Learn more about NymityAI at https://trustarc.com/nymityai-beta/

#heartofprivacy #europaulb #seriousprivacy #privacy #dataprotection #cybersecuritylaw #CPO #DPO #CISO

Transcript

Please note that this is largely an automated transcript. For accuracy, listed to the audio.

[00:00:00] Paul: On the 27th of October 2023, the European Data Protection Board made a big decision. The urgent request from the Norwegian DPA to enforce a processing ban for META's personalized and behavioral advertising practices was endorsed, and that means that after many years of questions asked and concerns being raised, it seems that privacy has won.

At least for now. In this episode, you'll hear all about this decision. Our guest is Tobias Hjudin, the head of the international section at the Norwegian DPA and co chair of the International Enforcement Working Group of the Global Privacy Assembly. My name is Paul Breitbart.

[00:00:49] K: And I'm K Royal and welcome to Serious Privacy. So Tobias, here's the unexpected question. What is your favorite, Type of nut. If I just said, what's your favorite nut? That could be a whole bunch of things. But what is your favorite type of nut? Like pecans or hazelnuts or pistachios?

[00:01:11] Tobias: I mean, pistachios are delicious, but I tend to go for cashew nuts. I eat a lot of cashew nuts,

[00:01:17] K: Salted

[00:01:19] Tobias: Salted, I would say, with salt and pepper, preferably.

[00:01:22] K: or unsalted? Oh, I was gonna say I expected you to come back, Gauquet. That's one unexpected question. Not two. Nice, cashews are a favorite. They're like a dessert all on their own, I think. 

[00:01:34] Paul: to agree with salted cashew, although macadamias are also very high up on my favorite list. Also salted.

[00:01:41] K: Oh, I love macadamias too. I think I'm gonna have to go with the pistachios though. I like anything with nuts in it, like pecan brownies and different things, but if I eat them on their own, they're not as good. Cashews and pistachios are about the only things I like to eat. It's just raw nuts, no salt, no pepper, no flavor, just raw.

But the pistachios have to be shelled. I don't, I don't like having to, to shell them. That's way too much work.

[00:02:09] Tobias: Yeah, exactly.

[00:02:11] K: Alright. 

[00:02:11] Paul: Yeah, for a moment I thought you were going to ask who's your favorite nut and then the answer should be Mark Zuckerberg But

[00:02:18] K: I had to, I was, I was rephrasing the question as I was saying it out loud because I was thinking, oh my goodness, I know there's a bunch of nuts they could talk about right now.

[00:02:28] Paul: so Tobias, first of all, congratulations because this is not only a big win for privacy But also for the Norwegian DPA for being persistent in your views

[00:02:38] Tobias: Thank you.

[00:02:39] Paul: And I assume everybody has been really working hard towards this decision, but also been celebrating hard that the EDPB endorsed it.

[00:02:48] Tobias: Well, we have certainly been working hard. I mean, for many months, I mean, you don't. You know, drop an urgency decision on your national territory without thinking about, okay, is this going to go to the EDPB and will we be able to fulfill the requirements? So this has been coming a long time for us. And I would love to say that we have also celebrated hard, but, you know, we're being sued by Mesa again.

So we actually have a court case to prepare. That's the way it goes.

[00:03:13] Paul: With probably another gazillion lawyers being involved on their end and just a handful of you 

[00:03:18] Tobias: Yep.

[00:03:20] K: That's exactly what I was picturing. Their army of lawyers and our stout defenders of privacy.

[00:03:26] Paul: So can you tell us a bit more? How did the decision for an urgency request come about?

[00:03:32] Tobias: So, I mean. We have been following the meta case for many years, ever since 2018. The GDPR became applicable and there were complaints right against their behavioral advertising practices.

and up until December 2022. We have kind of been in a process, haven't we, which was led by the Irish D. P. C.

Investigating thoroughly which also culminated with a, with a procedure at the E. D. P. B. essentially stating no, sorry, matter your processing personal data and lawfully, you need to comply with the law. And so one could, of course, hope that that was the end of this story, but we kind of suspected that it wouldn't be so.

The deadline for Meta to comply with that order was actually 5th of April. So on that date, we received all of the compliance material. We started looking at it immediately. And we quickly realized that, sorry, Meta, you are still not complying with, with the law. and then you already had kind of finalized the one stop shop procedure.

And, and the result was you're in breach of the law and 5th of April, they were still in breach of the law. And so we figured, okay, we can't silently accept this. We actually need to intervene. And from our point of view, when you get a decision from a data protection authority, and you don't respect it, that in itself is a very.

Extraordinary circumstance. So then then we started thinking, Okay, how can we as a Norwegian regulator do this? Are there any opportunity for us to to do this within the GDPR? And indeed, there are quite a few situations in which you could actually do something on your national territory, including then the urgency mechanism in the GDPR.

So, Then you kind of need to prove two things. You need to prove that the company is not complying with the law. anD it seems like more or less, everyone agrees that they don't. 

and then you need to prove urgency. 

[00:05:22] K: Yeah. I don't see there being much question on that one.

[00:05:25] Tobias: Yeah. And it's interesting, you know, when, when they keep challenging our order, et cetera, you, you could imagine that they would drive really hard on the fact that, no, we have a legal basis.

No, this is lawful, but it seems that they're not spending a lot of time on that at all, and instead they're going after the procedural part, which is, was there actually An urgent need to intervene, so they're kind of arguing that there wasn't and that is kind of what we have been looking at thinking about dreaming of and then finally putting into paper with our decision.

[00:05:56] Paul: in itself is already remarkable that apparently the content of your decision is not always being challenged. So maybe they also agree that. They've messed up and that following a contract and then legitimate interests and now some vague sort of consent that actually there is no right legal basis to do this behavioral advertising.

And that just somebody has found out about it and their business model goes down the drain.

[00:06:24] Tobias: so I think this is a very interesting point because this goes to the core of the business model. Right? And we think that the business model is at odds with the legislation. 

[00:06:35] K: that's a nice way of putting it. At odds. At odds with the legislation. Not spitting in his face or completely disregarding it, but at odds. I like that. But you know, I mean, isn't that the age old story? If you can't argue on the merits, you argue on the... the form.

[00:06:53] Tobias: Seems like it doesn't it? Which is a bit frustrating because if everyone can kind of acknowledge that this should not be taking place, then we spend all our resources fighting about something else rather than actually seeing the processing come to an end. So it's immensely frustrating. I would say, but in the meanwhile.

While we're fighting this out in court, they are making, I don't know how much money, right? So, they want to drag this out, for sure.

[00:07:20] Paul: let's, let's take a look at the procedural first and then go back to to the merits because I think there's a lot to be said there too. The GDPR has the urgency procedure that would allow the Norwegian DPA to make a national decision, go back to the EDPB but why not just leave it to the Irish DPC to complete the process?

[00:07:39] Tobias: Indeed so we had a lot of communication with our Irish colleagues and we really appreciate the interactions we've had with Irish colleagues throughout this case. but we felt that just stating that META is not complying with the law, that that in itself is not sufficient. We strongly felt that, well, if the conclusion is that they're not complying, you also need to enforce that and stop the illegal activity. 

So you could say that ourselves and Irish colleagues then had a very different idea about what should be done in this case. And we felt very strongly that we needed to ban the unlawful processing.

Yeah, if we wanted to see that through, it was clear that that is something that we needed to adopt a decision about ourselves. No one else was going to do that.

[00:08:27] K: Right. And we keep talking about the urgency provision under GDPR. There may be some people out there who are not familiar with it. I don't want to derail the train of thought, but it's Article 66 of the GDPR. It has four different provisions to it. So please feel free to go pick that up for yourself. But one of them, I think, is the one that is truly here.

Isn't it? Number three, Any supervisory authority may request an urgent opinion or an urgent binding decision from the board where another competent supervisory authority has not taken appropriate measures.

[00:09:02] Tobias: Not quite. 

Yeah, yeah. 

[00:09:04] K: So, so tell me which provision of Article 66 this went under so people were all on the same page.

[00:09:11] Tobias: Yeah. So we actually had two grounds for urgency. So the first one was Article 66. 1, which states that In exceptional circumstances, and if there's an urgent need to protect rights and freedoms, then you can actually intervene. So that was one basis. And then there's also actually a basis hidden away in Article 61.

8, which states... Yeah. Yeah, so essentially if you... If you make a request, a mutual assistance request to, to the lead supervisory authority or a different supervisory authority, and they don't correctly respond to it, that in itself is the ground of urgency. So, in this case, we actually had 2 grounds for urgency.

[00:09:55] K: Oh, very nice.

[00:09:56] Paul: Indeed, no, that's the procedural part because that is important because a lot of people may indeed wonder, so why is Norway suddenly the big hero in Europe? Whereas the DPC is the one driving all the big tech companies. The case has now moved back to Ireland, right, to, for them to follow up with Meta to make sure that the board's decision is actually also enforced and with urgency again.

[00:10:20] Tobias: Yes, so essentially the EDPB has that instructed the Irish DPC to make a decision against META, which involves a permanent ban of EEAY application. So it's then for the DPC to kind of. Issue that decision to matters headquarter in Dublin.

[00:10:39] Paul: And they only have a couple of days to do that following the decision of the 27th of October. Yeah.

[00:10:44] Tobias: Correct.

[00:10:45] K: And what impact would the ban have? Would it truly be a ban? There would be no more meta use. in Europe, or would they flounder around, or they probably already have them proposed 10 plans deep of what their next thing could be to get around the ban.

[00:11:01] Tobias: Yeah, this is, this is a cool, cool question, isn't it? So the ban applies to processing based on contractual necessity and legitimate interest. So to the legal basis, it doesn't ban it altogether. And

[00:11:15] K: So they could still seek this silly consent thing that they think they've rolled out. Okay.

[00:11:21] Tobias: what they're trying to do, isn't it? And because you cannot, you know, we, we banned what they have been doing to dates. And now they're going to find the, try and find different way to do it. And that is consent, they believe. And they have rolled out something, or they are rolling out continuously something they believe to be consent, hoping that they won't actually have to pause anything.

[00:11:43] K: And actual consent is not silly. I think our listeners know that, but this thing that they're calling, which Paul, I think I saw you post something about it yesterday or today. So fill us in more on this consent that they're seeking.

[00:11:55] Paul: Well, I was confronted with it yesterday when I logged onto my Facebook page, and that was more out of curiosity to see whether it was actually live, because I don't use Facebook anymore. I still use Instagram, but my Facebook page has been silent for I don't know how many years, but you cannot delete your Facebook without deleting your Instagram, so, that is in itself already a challenge.

[00:12:19] K: I still post my Wordle results every morning.

[00:12:23] Tobias: Nice. 

[00:12:23] Paul: I was suddenly confronted with this big blue banner saying, Hey, we there is some changes in legislation in your jurisdiction. That was surprise number one because that's their main argument. 

[00:12:34] K: That the legislation 

[00:12:35] Paul: so now you have to make a choice. There is a, the legislation has changed according to META.

either you start paying and then you have an ad free experience, and that's either 10 euros if you do it online, or 13 euros if you use the app. Or you give consent for personalized advertising. There is no granularity. There is no further explanation on what kind of settings you might might have.

There is not, as the Court of Justice has indicated, any specific consent for the combination of online or on platform and off platform data. There are no choices to be made apart from saying, oh, no, I consent to everything or I start paying. 

[00:13:19] K: Wow. And screenshots of these are on Paul's LinkedIn

[00:13:24] Paul: yeah, we'll put them in the we'll put them in the show notes.

And I know this will be subject to a lot of conversations in the board and by DPAs, and you cannot take a firm position yet, so I'll first state my position and then leave you to comment to the extent that you are able to, Tobias. But I don't believe that, A, this is valid consent, because this is not a free choice.

But I also believe that the pay or okay model is fundamentally flawed. Because I don't need to pay for my fundamental right to be protected. I have a constitutional right to the protection of my privacy, of my personal data, and that is not for pay. It would be comparable to... Paying for freedom of speech or paying to go to the election polls later this month here in the Netherlands.

Pay 120 euros a year to be able to vote. That is absurd. And it's equally absurd to ask people to pay not to be tracked. I'm perfectly fine with advertisement. Even on my social media. I just don't want to be continuously tracked without understanding what is actually happening with my data.

[00:14:31] K: Yeah,

[00:14:32] Paul: Tobias, over to you.

[00:14:34] Tobias: Wow. Well put. 

so obviously I can't prejudge anything. So I can't, you know, say this is legal. This is not legal. We, we, we can't do that. But what we can do is maybe reiterate some of our concerns that we also shared with Meta. Before they roll this out, because we also have, let's call them concerns. and I think the, the point you made about human rights, fundamental rights, not being for sale, I think that is very accurate.

This is also something that is, you know, very distressing because if Meta does this and gets away with it, other might also do the same, right? what would the internet look like? But also, I mean, what kind of choice do you really have? When, you know, maybe it's not an option for you to leave these platforms because we have become dependent on them.

I mean, Meta has been working so hard for the last 15 years in order to make their platforms the go to place. If you want to be on social media, right? All your friends are there. A lot of information that you need is only shared via these platforms,

[00:15:41] K: I was gonna say in times of emergency, the fact that they rolled out that, you know, I've marked myself safe from Hurricane Ida or from the shooting at so and so and it's helped a lot of people stay in touch and ease their concerns when the people wouldn't normally have the ability to, you know, communicate.

[00:16:00] Tobias: Yeah. That is such a good example. And I just think that, you know, we've become some dependent on these platforms. Essentially, we put all our eggs in the meta basket and now, meta is...

[00:16:11] K: And now we're hatching dinosaurs.

[00:16:15] Tobias: Yeah, something like that. I mean, they're essentially holding our eggs or our data as hostage, aren't they? Our social lives online are being held hostage, and they say, well, we know you need us, either pay us or give away your data protection rights. And so the question is, is this really a free choice?

And is it a free choice for all users, knowing that a lot of people simply cannot afford To pay these fees.

[00:16:41] K: Yeah, again, privacy are for those that have the money.

[00:16:44] Tobias: Yeah, exactly. But I mean, also coming back to one point, I mean, what are they specifically asking users? And I've only seen this in Norwegian, I think. but it seems that users are being asked whether or not they want to see ads, right? So you can pay to not see ads, or you could use the free version in which there are ads, you know, that could be behavioral, but there are ads.

So essentially, it's a choice between ads, no ads. Okay, feel free to, to have that option, but what is, what, what does that got to do with data protection? Because if we're talking consent, then it needs to be really specific and unambiguous. Do you consent to this particular use of your data for these purposes with these consequences?

Right?

[00:17:28] K: Right.

[00:17:29] Tobias: not being presented that choice at all.

[00:17:31] Paul: No,

[00:17:32] K: Yeah, they don't, they don't ask what is it do you want us to track your data across multiple websites and listen to you when you talk on your phone to figure out what ads might best be placed with you, right?

[00:17:44] Paul: no, and that's, that's, that's the strange thing and It seems also here again that they are also just bluntly ignoring a large part of the reasoning, not just of the Data Protection Authority, where I can even understand that they, they have a fight to pick with a lot of the authorities and they just don't want to agree.

But also the court of justice was very clear in just tearing apart all the different legal basis in the bundeskatelland decision and it seems that also there the highest court in the european union is not taken seriously by meta

[00:18:21] Tobias: Well, this is very interesting because again, we're up against Meta in court, right? And they're criticizing us for actually building argumentation on the Bundeskartellamt judgment. Because they say, well, that was a very different case, not comparable at all to our case. And in any case, the court of justice cannot rule on the facts.

So essentially they think that the Bundeskartellamt is not relevant.

[00:18:44] Paul: Wow,

[00:18:45] Tobias: Yeah.

[00:18:45] K: Well, that's how they act anyway, right? That they don't think it's relevant,

[00:18:49] Paul: it is it is a very interesting argument so Apart from from the court cases. How do you see this? Playing out, will we will we see possibly similar decisions for other online large scale advertising networks? Will this decision be extended to the Googles, the Criteos, the I don't know whos of this world as well in the months to come?

[00:19:17] Tobias: So do you mean the banning unlawful processing thing? I think a lot of stuff is already happening. I do feel that generally there's a shift where more and more attention is being focused on these platforms. What is sometimes a bit tricky to navigate is that you might have a DPA that want to address this, but the main establishment of the company is in a different country where perhaps the DPA is dealing with another case, right?

And, and this is a bit of a tricky situation. I don't think that our case necessarily has opened any floodgates. I mean, I don't think that we would see a flood of urgency decisions at all because the threshold is still rather high. But I think that more and more DPAs will be attentive to this ecosystem.

I think more and more DPAs are losing their patience. So, I mean, I would expect to see more and stricter and more impactful decisions against other players within this industry for sure.

[00:20:16] K: Well, yeah, because clearly monetary penalties aren't going to do anything.

[00:20:20] Tobias: I think they can afford to pay it, to be

[00:20:22] K: Right. I mean, I think I calculated at one time, one of the, I think the highest penalty was against Amazon or something at the time, and I got their public filing and calculated, yeah, they made that in an hour.

It, it means nothing. It, the, the monetary penalties mean nothing to them. They take it almost as a cost of doing business, but perhaps, you know, deleting the data.

That they acquired illegally is a good and banning them from doing business, which is one of the things that when I worked with companies over here in the U S and we talked about this briefly in Sweden is you use fear. That is what business people understand. Now there are business people that understand a lot more, but the fear of not being able to do business, tends

[00:21:09] Tobias: really interesting. That's really interesting. And another thing is what about the financial proceeds that they got from processing personal data unlawfully? I mean, if, if this had been within criminal law, then, you know, those exactly, they could be, they could be impounded by, by the government. But because we're outside of criminal law, they get to keep, you know, the profits that they shouldn't have had to begin with.

[00:21:36] K: Well, maybe we should add criminal penalties to GDPR. There's criminal penalties under a lot of privacy laws, so why not GDPR? There's a question for the ages.

[00:21:48] Paul: Well, I mean, there is another review of the GDPR due next year, so who knows what we can add to that.

[00:21:55] K: So I need to plant that seed and water it.

[00:21:57] Paul: listening.

so it is still, the whole process is, is fascinating that a relatively small DPA like yours, I mean, Norwegian DPA is what, about 70 people?

60. You're very tech savvy. Other leading decisions like in the grinder case have also showed that you are very much focused also on ad tech in your in, at least in your public decisions.

but leading Europe this way, outside of the European Union comes to that. It must also. Make some other data protection authorities wonder, Hey, do we do enough? Or at least

[00:22:39] K: Right.

[00:22:40] Tobias: Well, let me put it this way. There is absolutely no way we would have succeeded getting this through the EDPB had it not been for the support that we received from other GPAs,

[00:22:53] K: Nice.

[00:22:54] Tobias: cheering us on, helping us out. Being available whenever we needed someone to talk to, but, you know, on substance and, and personally and then obviously also through the voting at the EDPB level.

So it's not the case that others, other DPAs have not done anything because they have indeed helped us, but it's not necessarily very public in the way that they have helped us. There's a lot of stuff going on. behind the scenes. But also I think that, you know, there are so many issues to focus on, right?

And we can't all focus on the same issues. So, okay, so maybe ad tech has been one priority for my authority specifically. Maybe someone else has been looking more at children's rights or, you know, something else that's also very important to look at. So it kind of makes sense to Divide our attention between different issues.

And then, you know, together we, we actually make up a pretty, pretty amazing team, I would say.

[00:23:48] K: Oh, I

[00:23:49] Paul: Absolutely. somewhere on LinkedIn Kerry Lanning researcher from Ireland who also was a guest on, on our show before she was also wondering why you chose specifically the behavioral advertising element and not some of the. Other elements in, in in, in, in the work that Meta is doing, for example, the cross platform data sharing or provision of metrics to third party.

Exchange of data with affiliated companies, things like that. Why the choice for behavioral advertising, is that the most severe?

[00:24:24] Tobias: so there are some practical considerations between behind this choice. So the thing is, we already had this ongoing procedure in Ireland that was related specifically to behavioral advertising. And so again, we had to build a case of urgency and what we kind of. So what's that? Well, we can build upon this case that is already here.

We could establish that the research and see we have everything we need. And that that is what kind of informed the scope of our case. But I would say that there are also a number of other processing activities going on within the meter ecosystem that also do worry us, but, 

they were just not part 

of.

This 

[00:25:05] K: Oh, surely not.

[00:25:08] Paul: So you're telling us that this is not the last meta decision that we will see for the foreseeable future.

[00:25:13] Tobias: Not necessarily.

[00:25:15] Paul: Maybe not out of Norway, but also not out 

[00:25:16] K: ha.

[00:25:17] Paul: Ireland. 

[00:25:18] Tobias: There may be other decisions in the future for sure. I'm hoping that there will be. And I'm not accusing Meta of anything, but I think it's good to get clarification on some of these really controversial issues.

[00:25:30] K: Yeah.

[00:25:31] Paul: That's certainly true and I think that's also the, the good thing about this decision, whether I mean, this is also not necessarily that the DPC, the Irish DPC, is not doing their work. They're also following their own procedures, their own way of working. But we finally do have some some more flesh to the bone on this whole behavioral advertising issue.

And indeed, it has been ongoing for many, many years. I, I recall that my former colleague at the Dutch DPA, Rob van Eyck, When he defended his PhD, which must be six, seven years ago, on real time bidding, I was stunned about the fact that this was actually happening and was talking to my friends about it.

Do you actually know that the ads that you see, that you are being auctioned for that, and that this happens in fractions of seconds? Nobody even knew this was happening and still, I think most people don't know that these auctions for advertising are happening,

[00:26:33] K: The real time bidding is eye opening for sure.

[00:26:37] Paul: Yeah, and even today there was a publication from the leading Dutch broadcaster in the run up to our elections. A lot of political parties are actually using micro targeting on Facebook, on Instagram, on other social media. To reach out to their electorate and they all say, Oh, this is an error and it shouldn't have been set up like that and we made a mistake in configuration.

But researchers have been warning for this for at least two or three years also preceding the previous election. So it is not a mistake. It is very deliberate. And then we are talking sensitive personal data as well, because it's about your political preferences. This whole. this whole concept of behavioral advertising and real time bidding In my view, really should come to an end and I'm hopeful that this decision will be the first whack to that wall and start to break it down.

[00:27:35] Tobias: We'll, we'll see, but for sure we, we share your concerns because what is going on is actually quite creepy. And, you know, there are so many incentives to, you know, get your attention and keep your attention. So the algorithms are built for that specific purpose, which is in itself very creepy. And then once you're kind of sucked into the ecosystems, they can monitor you even more.

That's a very strong incentive to know absolutely everything about you. And at some point you just have to wonder, I mean. In whose interest is this? Is this in the interest of society? Is it in the interest of individuals? I would argue not. I mean, there are other ways that are not creepy that, you know, a service or a website could, could use to earn money, but it's simply, you know, a few companies, actually not a few, quite, quite, quite a few companies who have chosen this for a business model, and they're not backing down, and they just hope that politicians and regulators don't understand what is going on, or that they could stop it on procedural grounds if there's an inquiry.

So it's quite quite frustrating.

[00:28:39] Paul: I can imagine.

[00:28:40] K: Yeah, it reminds me of the, the letter that was issued after the Cambridge Analytical uh, scan where politicians and people were using it to manipulate elections. And there was a memo that quote, leaked. About how this had nothing to do with Facebook's desires to do anything. This was all purely business and commercial, nothing that they hadn't done before.

This was all just buying ads. It wasn't anything, you know, illegal that Facebook had done. All this I'll find the memo and share with it, but it was really eye opening that they would rely upon that as we were, we were scammed. We had no idea it was going to be used for these purposes.

[00:29:24] Paul: Yeah, we don't believe that.

[00:29:25] K: No.

[00:29:26] Paul: So, Tobias, what's next? Obviously, a few court cases, which probably should go to Dublin rather than Oslo because the Irish DPC is back in the lead. But, hey it might take a while for American lawyers to find out that Oslo is actually not in Ireland.

[00:29:46] Tobias: Oh, goodness.

[00:29:47] Paul: but, but what's next? Any other topics that you can already disclose, of course, that you, that you want to focus on for 2024?

[00:29:57] Tobias: Well, I mean, first of all, we're not done with the meta case, because we still have a few things to address there.

[00:30:03] K: And that'll take a minute or

[00:30:04] Tobias: That'll take a minute. It'll probably eat up quite a big proportion of our resources. But then one thing that's also interesting here or symptomatic is obviously that these algorithms are built on artificial intelligence, right?

aNd it just goes to show, I mean, some of the profiling that we've seen on Meta, where users end up in profiles such as gay love and pride.

Someone ended up in the profiles of therapy and high anxiety. I don't know, Meta will have an explanation to this. They say that pride is just an emotion.

You know, the fact that the individual was in fact gay, you know, that's a coincidence as for the high anxiety thing. Turns out it's a movie

[00:30:45] K: able to wear pink shoes. I mean, you know,

[00:30:48] Tobias: Yeah, and so I mean it seems that you know Okay, chat gpt generative ai that's one thing but you know for for a lot of systems Artificial intelligence has been used for quite a few years and we have concerns about whether they have actually been employed in A responsible manner and whether the regulations upcoming regulations will actually be able to address these issues.

I think there's much you could do under the GDPR, to be honest. So, I mean, related to this, I think that artificial intelligence will continue to be a major priority for data protection authorities moving forward.

[00:31:22] Paul: And then especially when it comes to inferences out of data that the algorithms make themselves and start predicting.

[00:31:30] Tobias: Mm hmm.

[00:31:31] K: Yes, and the technology does not have a sense of morality or right or wrong.

[00:31:37] Tobias: No. And sometimes the people that use the technology don't have that either. Sorry.

[00:31:43] Paul: Well, that's a very fair point. We've also said it before. Thank you very much for shedding some light on this important decision. It's always good to hear it firsthand. And we very much appreciate your time for, for joining us today. And on that note we'll wrap up another episode of Serious Privacy.

[00:32:02] Tobias: Thanks for having me. It was such a pleasure to be here.

[00:32:04] K: Thank you for coming on.

[00:32:06] Paul: If you like these episodes, please like and review the the episodes in your favorite podcast app. Make the algorithms work a bit more to recommend this podcast. reach out to Kay on social media as Heart of Privacy. You will find me as EuropolB, the podcast at, at Podcast Privacy or join the conversation on LinkedIn.

You'll find us under Serious Privacy, obviously. Until next week, goodbye.

[00:32:29] Tobias: Bye.

[00:32:30] K: Bye y'all.