Atlassian is s planning to use personal data to train AI models on, as by their website:
Atlassian is changing how we use customer data on August 17, 2026. We’re updating how we use metadata and in-app data to deliver improved AI experiences for all customers. [...]
They have divided the data they will use into two categories so-called "In-app data" and so-called "Metadata", the distinction however appears irrelevant to me as in the end it is user data and data derived thereof.
This in combination with the inability for users (apart from those having an Enterprise level subscription) to turn of the usage of the so-called "Metadata", seems to be a violation of the GDPR:
- User cannot consent (or withdraw the implied consent in this case) for the usage of what is claimed to be "meta-data" as per GDPR, this would be a violation (Art. 6 user must consent, Art. 18 user can restrict processing, Art 21 user can withdraw consent).
- If Atlassian were to argue that it acts on what it claims as "legitimate interests" as per recital 47, it would (to my frankly limited understanding) not hold up. As that argument seems void when considering users of the highest subscription tier can withdraw consent on the usage of so called "meta-data". Therefore, one can argue that such usage of data is not strictly necessary to provide the service.
In short, as Jen put it:
Would such use be within the GDPR's "legitimate interests" avenue for use, given the company simultaneously allows another group of users to opt-out of such collection?
