The National Consumer Secretariat (Senacon), part of the Ministry of Justice and Public Security (MJSP), has issued a notification to Meta on Tuesday, questioning the use of Brazilian citizens’ personal data to train its artificial intelligence (AI) tools, thus changing its own Privacy Policy. Meta owns social media platforms such as Instagram, Facebook, and WhatsApp.
Senacon is raising concerns about the legality of this action and questioning the use of legitimate interest as a justification for data processing, the lack of a specific purpose, manipulative practices that hinder consumers’ rights, and the absence of adequate information. “Internet companies must understand that Brazil has laws and that these laws prevail over their terms of use,” said National Consumer Secretary Wadih Damous.
Vitor Hugo do Amaral, the director of the Department of Consumer Protection and Defense, stated that the indiscriminate use of personal data for AI training without a solid and transparent legal basis leaves consumers vulnerable. “It is our duty to protect consumers’ fundamental rights, ensuring that their personal information is treated fairly and legally,” he said.
According to Senacon, the legal relationship between Meta and its users is a consumer relationship, subject to the Consumer Protection Code (CDC). Furthermore, the General Data Protection Law (LGPD) also supports consumer defense in this context.
Regarding the notification, Senacon highlighted that Meta’s actions disregard Brazil’s legislative sovereignty and may result in a sanctioning process. “The State has the obligation to promote consumer defense, in accordance with the law and based on the principles, rights, and guarantees established in the Consumer Protection Code,” Damous stated. “This includes protecting consumers against abusive practices and ensuring their right to information and freedom of choice.”
The notification requires Meta to provide clarifications within five days regarding:
a) The use of consumer data for AI training;
b) The purpose of this use;
c) The impact of AI training on consumers;
d) The information policy adopted for data use;
e) The existence of a customer service channel that facilitates the exercise of consumer rights.
Additionally, Meta must demonstrate that its privacy policy complies with the principles of purpose, adequacy, necessity, and transparency, indicating the legal bases applicable to each purpose and the types of personal data required.
This move by Senacon underscores the importance of protecting consumer data and ensuring that companies abide by legal regulations when handling personal information. It serves as a reminder to internet companies about the need to prioritize consumer rights and comply with data protection laws to maintain trust and transparency in their operations.