3.5: Legal Considerations
- Page ID
- 124278
\( \newcommand{\vecs}[1]{\overset { \scriptstyle \rightharpoonup} {\mathbf{#1}} } \)
\( \newcommand{\vecd}[1]{\overset{-\!-\!\rightharpoonup}{\vphantom{a}\smash {#1}}} \)
\( \newcommand{\dsum}{\displaystyle\sum\limits} \)
\( \newcommand{\dint}{\displaystyle\int\limits} \)
\( \newcommand{\dlim}{\displaystyle\lim\limits} \)
\( \newcommand{\id}{\mathrm{id}}\) \( \newcommand{\Span}{\mathrm{span}}\)
( \newcommand{\kernel}{\mathrm{null}\,}\) \( \newcommand{\range}{\mathrm{range}\,}\)
\( \newcommand{\RealPart}{\mathrm{Re}}\) \( \newcommand{\ImaginaryPart}{\mathrm{Im}}\)
\( \newcommand{\Argument}{\mathrm{Arg}}\) \( \newcommand{\norm}[1]{\| #1 \|}\)
\( \newcommand{\inner}[2]{\langle #1, #2 \rangle}\)
\( \newcommand{\Span}{\mathrm{span}}\)
\( \newcommand{\id}{\mathrm{id}}\)
\( \newcommand{\Span}{\mathrm{span}}\)
\( \newcommand{\kernel}{\mathrm{null}\,}\)
\( \newcommand{\range}{\mathrm{range}\,}\)
\( \newcommand{\RealPart}{\mathrm{Re}}\)
\( \newcommand{\ImaginaryPart}{\mathrm{Im}}\)
\( \newcommand{\Argument}{\mathrm{Arg}}\)
\( \newcommand{\norm}[1]{\| #1 \|}\)
\( \newcommand{\inner}[2]{\langle #1, #2 \rangle}\)
\( \newcommand{\Span}{\mathrm{span}}\) \( \newcommand{\AA}{\unicode[.8,0]{x212B}}\)
\( \newcommand{\vectorA}[1]{\vec{#1}} % arrow\)
\( \newcommand{\vectorAt}[1]{\vec{\text{#1}}} % arrow\)
\( \newcommand{\vectorB}[1]{\overset { \scriptstyle \rightharpoonup} {\mathbf{#1}} } \)
\( \newcommand{\vectorC}[1]{\textbf{#1}} \)
\( \newcommand{\vectorD}[1]{\overrightarrow{#1}} \)
\( \newcommand{\vectorDt}[1]{\overrightarrow{\text{#1}}} \)
\( \newcommand{\vectE}[1]{\overset{-\!-\!\rightharpoonup}{\vphantom{a}\smash{\mathbf {#1}}}} \)
\( \newcommand{\vecs}[1]{\overset { \scriptstyle \rightharpoonup} {\mathbf{#1}} } \)
\(\newcommand{\longvect}{\overrightarrow}\)
\( \newcommand{\vecd}[1]{\overset{-\!-\!\rightharpoonup}{\vphantom{a}\smash {#1}}} \)
\(\newcommand{\avec}{\mathbf a}\) \(\newcommand{\bvec}{\mathbf b}\) \(\newcommand{\cvec}{\mathbf c}\) \(\newcommand{\dvec}{\mathbf d}\) \(\newcommand{\dtil}{\widetilde{\mathbf d}}\) \(\newcommand{\evec}{\mathbf e}\) \(\newcommand{\fvec}{\mathbf f}\) \(\newcommand{\nvec}{\mathbf n}\) \(\newcommand{\pvec}{\mathbf p}\) \(\newcommand{\qvec}{\mathbf q}\) \(\newcommand{\svec}{\mathbf s}\) \(\newcommand{\tvec}{\mathbf t}\) \(\newcommand{\uvec}{\mathbf u}\) \(\newcommand{\vvec}{\mathbf v}\) \(\newcommand{\wvec}{\mathbf w}\) \(\newcommand{\xvec}{\mathbf x}\) \(\newcommand{\yvec}{\mathbf y}\) \(\newcommand{\zvec}{\mathbf z}\) \(\newcommand{\rvec}{\mathbf r}\) \(\newcommand{\mvec}{\mathbf m}\) \(\newcommand{\zerovec}{\mathbf 0}\) \(\newcommand{\onevec}{\mathbf 1}\) \(\newcommand{\real}{\mathbb R}\) \(\newcommand{\twovec}[2]{\left[\begin{array}{r}#1 \\ #2 \end{array}\right]}\) \(\newcommand{\ctwovec}[2]{\left[\begin{array}{c}#1 \\ #2 \end{array}\right]}\) \(\newcommand{\threevec}[3]{\left[\begin{array}{r}#1 \\ #2 \\ #3 \end{array}\right]}\) \(\newcommand{\cthreevec}[3]{\left[\begin{array}{c}#1 \\ #2 \\ #3 \end{array}\right]}\) \(\newcommand{\fourvec}[4]{\left[\begin{array}{r}#1 \\ #2 \\ #3 \\ #4 \end{array}\right]}\) \(\newcommand{\cfourvec}[4]{\left[\begin{array}{c}#1 \\ #2 \\ #3 \\ #4 \end{array}\right]}\) \(\newcommand{\fivevec}[5]{\left[\begin{array}{r}#1 \\ #2 \\ #3 \\ #4 \\ #5 \\ \end{array}\right]}\) \(\newcommand{\cfivevec}[5]{\left[\begin{array}{c}#1 \\ #2 \\ #3 \\ #4 \\ #5 \\ \end{array}\right]}\) \(\newcommand{\mattwo}[4]{\left[\begin{array}{rr}#1 \amp #2 \\ #3 \amp #4 \\ \end{array}\right]}\) \(\newcommand{\laspan}[1]{\text{Span}\{#1\}}\) \(\newcommand{\bcal}{\cal B}\) \(\newcommand{\ccal}{\cal C}\) \(\newcommand{\scal}{\cal S}\) \(\newcommand{\wcal}{\cal W}\) \(\newcommand{\ecal}{\cal E}\) \(\newcommand{\coords}[2]{\left\{#1\right\}_{#2}}\) \(\newcommand{\gray}[1]{\color{gray}{#1}}\) \(\newcommand{\lgray}[1]{\color{lightgray}{#1}}\) \(\newcommand{\rank}{\operatorname{rank}}\) \(\newcommand{\row}{\text{Row}}\) \(\newcommand{\col}{\text{Col}}\) \(\renewcommand{\row}{\text{Row}}\) \(\newcommand{\nul}{\text{Nul}}\) \(\newcommand{\var}{\text{Var}}\) \(\newcommand{\corr}{\text{corr}}\) \(\newcommand{\len}[1]{\left|#1\right|}\) \(\newcommand{\bbar}{\overline{\bvec}}\) \(\newcommand{\bhat}{\widehat{\bvec}}\) \(\newcommand{\bperp}{\bvec^\perp}\) \(\newcommand{\xhat}{\widehat{\xvec}}\) \(\newcommand{\vhat}{\widehat{\vvec}}\) \(\newcommand{\uhat}{\widehat{\uvec}}\) \(\newcommand{\what}{\widehat{\wvec}}\) \(\newcommand{\Sighat}{\widehat{\Sigma}}\) \(\newcommand{\lt}{<}\) \(\newcommand{\gt}{>}\) \(\newcommand{\amp}{&}\) \(\definecolor{fillinmathshade}{gray}{0.9}\)- Understand why US companies are affected by this EU regulation
- Understand the size of potential penalties
- Understand why companies that violate the GDPR are being fined substantial amounts of money
- Understand what arguments are being put forward to justify the positions of non-compliant companies
Why US Companies can be affected
The GDPR imposes rules on organizations that offer goods and services to people in the EU, or that collect and analyze data tied to EU residents. The GDPR applies to any entity processing personal information of “data subjects” inside the EU/EEA (regardless of company’s location or data subject’s citizenship/residence). The GDPR covers international companies with data processing centers in the EU.
Penalties
The following sets out the GDPR fines:
- “The less severe infringements could result in a fine of up to €10 million, or 2% of the firm’s worldwide annual revenue from the preceding financial year, whichever amount is higher.”
- “The more serious infringements go against the very principles of the right to privacy and the right to be forgotten that are at the heart of the GDPR. These types of infringements could result in a fine of up to €20 million, or 4% of the firm’s worldwide annual revenue from the preceding financial year, whichever amount is higher.” [Ref 1]
Business decision analysis may result in accepting legal penalties in lieu of compliance. This could occur when a large percentage of a company's revenue is derived from direct marketing activities based on user data. A risk assessment might conclude that if a high percentage of users opt out of having their data be used for direct marketing purposes, that loss of revenue will be large in comparison to paying the penalty resulting from non-compliance.
GDPR Fines in Practice
The following are examples of fines that have been imposed.
- Meta Platforms 1.2 billion euros for EU to US data transfers.
- Uber Technologies, Inc 825 million euros for using automated systems to suspend driver accounts.[2] Note: this is an Article 22 violation.
- Amazon 746 million euros (sent back to the regulator)
- TikTok 530 million euros
- Instagram 405 million euros
- Meta 390 million euros for EU to US data transfers.
- TikTok 345 million euros
- LinkedIn 310 million euros
- Uber 290 million euros
- Meta 265 million euros
- Whatsapp 225 million euros
Data Subjects' Rights in court
- Article 77: private right to lodge complaints with supervisory [data protection] authority of the Member State of one’s “habitual residence”
- Article 79: data subjects can bring action in courts of the Member State where the controller or processor has an establishment, or where the data subject has “habitual residence”
Argumentation
Here, we will briefly explore two interpretations issued by the second-highest authority in applying the GDPR, the European Data Protection Board (EDPB).
EDPB Binding Decision 3/2022 on Meta IE
- Ireland’s GDPR supervisory authority circulated a draft decision to the other EU data protection authorities (see Art. 60 GDPR). They disputed the finding that contract was a lawful basis for Meta’s processing. The Irish DPA (“IE SA”) asked the EDPB for a binding decision to resolve the dispute.
- The EDPB's decision concerns how to analyze contract as a lawful basis for necessary processing (Art. 6(1)(b) GDPR). Relevant excerpts from the decision are included and annotated below.
Contract as Lawful Basis
- “It is important to determine the exact rationale of the contract, i.e., its substance and fundamental objective, as it is against this that it will be tested whether the data processing is necessary for its performance” (para. 112)
- “[R]egard should be given to the particular aim, purpose, or objective of the service, and…it is required that the processing is objectively necessary for a purpose and integral to the delivery of that contractual service to the data subject” (para. 112)
- “…the controller should be able to justify the necessity of its processing by reference to the fundamental and mutually understood contractual purpose."
- “…as a general rule, processing of personal data for behavioral advertising is not necessary for the performance of a contract for online services” (para. 114)
- “…the EDPB recalls that the concept of necessity has its own independent meaning under EU law. It must be interpreted in a manner that fully reflects the objective pursued by an EU instrument, in this case, the GDPR. Accordingly, the concept of necessity cannot be interpreted in a way that undermines this provision and the GDPR’s general objective of protecting the right to the protection of personal data or contradicts Article 8 of the [EU] Charter” (para. 116)
Note the recurrence of the concept of necessity.
EDPB Binding Decision
- The EDPB found that users sign up for Facebook mainly for the purpose of communicating with others, not to get personalized, behavioral ads (para. 124)
- A reasonable user could not expect their signing up to have their data processed for behavioral advertising; the terms of service and related documents are too sparse in their discussion about this type of processing (para. 123)
Artificial Intelligence and the GDPR
- In late 2024, the EDPB issued a major opinion on AI Labs’ compliance (or lack thereof) with the GDPR in the training of their models
- Recall: under Article 6, data processing must be lawful (e.g., via the consent of the data subject (Art. 6(1)(a), contracting with a data subject (Art. 6(1)(b)), or “legitimate interests” (Art. 6(1)(f))
- At the time, most AI labs appeared to be relying on 6(1)(f)
The EDPB issued Guidelines 1/2024 (October) on how to fulfill Art. 6(1)(f). Three conditions included:
- Pursuit of a legitimate interest by controller or 3rd party)
- The need to process personal data for the purpose of (1)
- The interests or fundamental freedoms and rights of data subjects affected by (2) do not take precedence over (1).
References
- What are the GDPR Fines? - GDPR.eu
- Charlotte Hughes-Morgan. Bloomberg. "Dutch Regulators penalize Uber under EU data policy." The Mercury News, Section C, page 8, Sunday August 23, 2026.