Meta's Model Capability Initiative (MCI), a surveillance program deployed on US employee workstations to capture keystrokes, mouse clicks, and screen contents for AI-agent training, is collecting European employee data despite Meta's assurances to the contrary. Internal documents reviewed by Reuters show MCI ingests all emails and chats exchanged between US-based employees and their European colleagues, potentially violating GDPR's purpose-limitation principle. Privacy advocacy group NOYB argues the volume and routine nature of this data capture far exceeds any 'incidental' exception, and has called on 11 European data protection authorities to act. The Irish Data Protection Commission, Meta's lead EU privacy regulator, has not yet opened a formal investigation. The case represents the first major GDPR challenge tied to Meta's own employees rather than consumer users.
