By [Staff Correspondent] Published: [Date]

The data privacy landscape is undergoing its most significant recalibration since the General Data Protection Regulation (GDPR) took effect in 2018. This week, three parallel developments in Europe, the United States, and Asia signal a decisive shift from consent-based compliance toward enforcement-driven accountability, with artificial intelligence (AI) training data emerging as the core point of contention.

European Data Protection Board Issues Urgent Guidance on “Legitimate Interest” for AI

On Tuesday, the European Data Protection Board (EDPB) released a draft opinion that, for the first time, provides a structured test for companies using “legitimate interest” as a legal basis for processing personal data to train large language models. The 47-page document, open for public consultation until June 15, proposes a three-step balancing test: necessity, impact assessment, and mitigation measures.

The draft explicitly states that “the mere scraping of publicly available personal data for AI training purposes does not automatically satisfy the legitimate interest condition.” It demands that companies conduct a granular assessment of the “reasonable expectations” of data subjects, particularly when data is repurposed from social media platforms or public forums.

“This is a direct response to the growing number of complaints filed against tech firms that have harvested data without explicit consent,” said Dr. Elena Marchetti, a senior policy analyst at the Centre for Information Policy Leadership in Brussels. “The EDPB is effectively closing the loophole that allowed ‘publicly accessible’ to be conflated with ‘freely usable for AI.’ We expect significant litigation risk for any model trained on scraped data without robust, documented safeguards.”

The guidance arrives amid ongoing investigations into at least six major AI developers by national authorities in France, Germany, and Italy, all centered on the legality of their training datasets.

US State-Level Privacy Laws Reach Critical Mass, Creating Compliance Patchwork

Across the Atlantic, the absence of a comprehensive federal privacy law continues to drive a fragmented state-by-state approach. This month, Tennessee and Indiana became the 18th and 19th states to enact comprehensive consumer privacy statutes, following the model of Virginia and Colorado. However, the new laws contain notable deviations: Tennessee’s “Age Appropriate Design Code” imposes stricter default privacy settings for minors, while Indiana’s law includes an exemption for de-identified data that privacy advocates argue is too broad.

More critically, the Federal Trade Commission (FTC) has signaled a more aggressive enforcement posture. In a closed-door briefing with industry stakeholders last week, FTC Commissioner Rebecca Kelly Slaughter emphasized that the agency will treat the sale of “anonymized” location data as a deceptive practice if re-identification is reasonably foreseeable. This follows the FTC’s landmark settlement with a data broker in January, which prohibited the company from selling precise geolocation data for five years.

“The trend is clear: state laws are becoming the de facto national standard, but their inconsistency creates a logistical nightmare for multinational firms,” noted Marcus Chen, chief privacy officer at a Fortune 500 logistics company, speaking on condition of anonymity. “We now maintain separate data mapping systems for 19 different jurisdictions. The cost of compliance has risen by roughly 40% year-over-year, and that figure will only grow as more states enact their own rules.”

Chen added that the most challenging aspect is not the substantive requirements, but the variance in individual rights mechanisms. For example, some states require a “universal opt-out” signal (like Global Privacy Control), while others mandate a specific web form. “We are seeing a divergence in technical standards that forces us to build parallel infrastructure,” he said.

Asia’s New Frontier: Cross-Border Data Flows and National Security Exceptions

In Asia, the focus has shifted to cross-border data transfer mechanisms. South Korea’s Personal Information Protection Commission (PIPC) announced a major revision to its transfer guidelines, allowing companies to use “certified contractual clauses” as an alternative to the existing rigid approval process. This aligns with Japan’s recent Mutual Adequacy Arrangement with the UK, creating a new corridor for data flows between the three jurisdictions.

However, this liberalization is counterbalanced by a tightening of national security exceptions. India’s Digital Personal Data Protection Act, which came into full effect in February, empowers the central government to exempt any processing activity on grounds of “sovereignty, integrity, and security.” Industry analysts warn that this broad exception could undermine the law’s core protections, as companies may be pressured to transfer data to government agencies without judicial oversight.

“We are witnessing a geopolitical bifurcation of data governance,” said Professor Aisha Tan, director of the Digital Society Institute at the National University of Singapore. “The EU and US are converging on individual rights and algorithmic accountability, while several Asian economies are prioritizing state access and industrial policy. Multinational companies must now navigate a tri-polar world: Brussels, Washington, and Beijing/New Delhi.”

Tan pointed to the recent decision by a major Chinese e-commerce platform to relocate its European user database to Switzerland, citing “regulatory uncertainty” in both the US and mainland China. “This is not a technical decision; it is a strategic hedge against future enforcement actions,” she added.

Expert Consensus: The Era of “Privacy by Design” is Over; “Privacy by Default” is Now

Across all three regions, a common theme emerged in expert commentary: the passive acceptance of privacy policies is no longer sufficient. Dr. Marchetti from Brussels argued that the EDPB’s draft opinion effectively requires companies to conduct a “data protection impact assessment” for every AI training run, not just for high-risk processing as previously understood.

“The bar has been raised from ‘we comply with the law’ to ‘we can prove that our processing is proportionate and necessary,’” she said. “That proof requires technical documentation, algorithmic audits, and a data inventory that is granular to the individual field level.”

Meanwhile, in a keynote address at the IAPP Global Privacy Summit held in Washington, D.C., this week, FTC Commissioner Slaughter delivered a stark warning to corporate boards: “If your business model depends on collecting more data than you can justify, and if you cannot explain to a regulator why you need each specific data point, then your model is not privacy-compliant. It is that simple.”

The practical implications are immediate. Privacy engineering roles are now among the fastest-growing job categories in the tech sector, with average salaries for senior privacy architects exceeding $200,000 in the US. Law firms specializing in GDPR enforcement are reporting a 300% increase in pre-litigation inquiries from companies seeking to audit their AI training pipelines.

Looking Ahead: A Year of Enforcement

The next twelve months are expected to deliver landmark rulings. The Court of Justice of the European Union is scheduled to hear a case on whether the use of personal data in generative AI constitutes “automated decision-making” under Article 22 of the GDPR, which would grant individuals the right to an explanation and the right to human intervention. A ruling against the AI developer could effectively halt the deployment of certain chatbot models in the EU.

In the US, the FTC’s new rulemaking authority on commercial surveillance—proposed in 2022 but still pending—is expected to be finalized before the end of the fiscal year. The rule would establish a national baseline for data minimization and prohibit the use of “dark patterns” in consent interfaces.

For organizations, the message from regulators is unambiguous: the time for voluntary self-regulation has ended. The convergence of AI’s insatiable appetite for data and regulators’ newfound willingness to impose fines—which have reached a cumulative total of €4.5 billion under GDPR alone—creates a high-stakes environment. Companies that fail to embed privacy into their core data architecture, rather than as a legal add-on, will find themselves exposed not only to financial penalties but to irreparable reputational damage.

As one EU case handler put it during a closed session last week: “We do not need more privacy policies. We need fewer data collections.” That sentiment, once considered extreme, now appears to be the operational principle guiding enforcement agencies across the globe.