Irish Data Regulator Investigates X for Utilizing EU Users’ Data in Grok
Data Protection Inquiry into X Internet Unlimited Company
On April 11, 2023, the Data Protection Commission (DPC) of Ireland announced an investigation into X Internet Unlimited Company (XIUC), which is the Irish branch of X, previously known as Twitter. This inquiry centers around allegations that the company improperly processed the personal data of European Union (EU) users to train its artificial intelligence (AI) model named Grok.
Purpose of the Inquiry
The DPC’s inquiry is focused on assessing whether XIUC complies with several essential provisions outlined in the EU’s General Data Protection Regulation (GDPR), particularly concerning the legality and transparency of data processing. The regulator aims to determine if the personal data used was processed lawfully for the training of the Grok Large Language Models (LLMs).
Why the DPC is Investigating XIUC
The DPC has asserted that X unlawfully utilized publicly accessible data from EU users to develop its generative AI models. The claim indicates that the company collected data from user posts to enhance Grok’s capabilities. The DPC has emphasized the importance of ensuring companies like X adhere to GDPR principles surrounding lawful and transparent data use.
Key Principles of Data Protection According to GDPR
The GDPR establishes several fundamental principles for data protection, detailed in Article 5, which influence the overall framework of the regulation.
Lawfulness, Fairness, and Transparency
Organizations handling personal data must maintain transparency with individuals about how their data is collected and processed. The DPC highlights that all personal data processing should be lawful and fair, requiring companies to provide clear and understandable information regarding users’ data rights.
Purpose Limitation
According to the DPC, organizations can only collect personal data for well-defined, legitimate reasons and must refrain from further processing that contradicts those purposes.
Max Schrems, the founder of NOYB, emphasized during recent discussions that companies often mislabel AI as the purpose for data collection. This approach is seen as a loophole that fails to adhere to GDPR standards.
Additional Principles of Data Collection in GDPR
- Data Minimization: Only collect personal data if absolutely necessary for the intended purpose.
- Accuracy: Organizations must ensure the data they collect is correct and up-to-date.
- Storage Limitation: Personal data should only be retained for as long as required for processing.
- Integrity and Confidentiality: Proper security measures must be in place to protect data.
- Accountability: Organizations must prove their commitment to abide by GDPR principles.
Understanding Personal and Non-Personal Data
Article 4(1) of the GDPR defines personal data as any information that can identify an individual. Examples include names, identification numbers, location data, and more. Schrems noted that technology companies often intertwine personal and non-personal data, complicating compliance with GDPR. This blending can make it challenging to isolate which data is used, raising concerns about privacy and legality.
Background Context
The DPC has previously raised issues regarding X’s data collection methods for AI training. Notably, in August 2024, the DPC took X to court over default settings that allowed user posts to be used by Grok without proper notification. This setup violated GDPR since users were not adequately informed about the consent mechanism.
Schrems pointed out that other companies, like Google and OpenAI, have similarly adopted opt-out approaches rather than securing explicit user consent, complicating user control over their data.
DPC’s Record of Actions
The DPC has recently been active in imposing fines on large tech firms for violations of data protection regulations. For instance, in January 2023, the DPC fined Meta €390 million for the unlawful use of user data for targeted advertising. The organization previously issued a €405 million fine in September 2022 for mishandling children’s data on Instagram. In another instance, €225 million was levied against WhatsApp for insufficient disclosure of data handling practices to EU users.
These actions underlie the DPC’s commitment to enforcing GDPR compliance and protecting user rights within the digital landscape.
