Court proceedings by the Irish Data Protection Commission (DPC) against social media platform X are officially over as of Wednesday (4 September), after the company agreed to permanently stop processing some personal data collected in the EU for training artificial intelligence (AI).
This follows a complaint filed by consumer organisations that led the Irish DPC to file a case in Ireland’s High Court for alleged violations of the EU’s data privacy law, the General Data Protection Regulation (GDPR), by Elon Musk’s X. It was the first time the authority had filed such a petition with the court.
“The proceedings have been struck out” because X agreed to adhere to an earlier agreement permanently, said the authority in Wednesday’s press release.
In August, X agreed to suspend the processing of EU users’ personal data collected between 7 May and 1 August to train its Grok AI model. Local media reported that the suspension would last until the next court date.
Today, the Irish DPC has confirmed that these measures are permanent.
However, the DPC did not clarify whether X promised to cease using personal data from EU users to train Grok altogether or if the permanent suspension is only for user data collected from May to August.
The authority did not respond to Euractiv’s request to clarify what the permanent agreement entails at the time of publication.
X “got away without a fine, despite a flagrant violation of the law,” Max Schrems, lawyer and founder of digital rights non-profit Noyb (European Center for Digital Rights), told Euractiv.
“The data already ingested for Grok AI will also not be deleted, and Twitter continues to offer the product based on unlawfully obtained data,” he pointed out.
The Irish data privacy authority is the EU’s lead authority for X’s GDPR enforcement, as the company’s EU headquarters are in Dublin.
European Data Protection Board
The DPC stated it would send a request for an opinion on AI data processing basis and legalities to the European Data Protection Board (EDPB).
“The DPC hopes that the resulting opinion will enable proactive, effective and consistent Europe-wide regulation,” said DPC Commissioner Dale Sunderland.
However, EDPB opinions tend to be broad and imprecise, meaning the DPC will likely need to address X further down the line, a Noyb spokesperson told Euractiv. An EPDB opinion would still be significant, given the current lack of a unified approach among DPAs on this issue.
At the time of publication, the EPDB has not responded to Euractiv’s request to confirm whether they had received a request for an opinion from the Irish DPC.