Elon Musk’s X targeted by nine privacy complaints after EU user data was intercepted to train Grok

Elon Musk’s social media platform X has change into the goal of a series of privacy complaints after it shared user data from the European Union to train artificial intelligence models without asking for consent.

At the top of last month eagle-eyed social media user spotted a setup that indicated X had quietly begun processing regional user post data to train its Grok AI chatbot. The discovery prompted an expression of “surprise” from the Irish Data Protection Commission (DPC), the body that oversees X’s compliance with the bloc’s General Data Protection Regulation (GDPR).

GDPR, which may punish confirmed violations with fines of up to 4% of worldwide annual turnover, requires all uses of private data to have a legitimate legal basis. Nine complaints against X, filed with data protection authorities in Austria, Belgium, France, Greece, Ireland, Italy, the Netherlands, Poland and Spain, accuse it of failing to accomplish that by processing Europeans’ posts to train AI without obtaining their consent.

Commenting in a press release, Max Schrems, president of the non-profit privacy rights organization night who supports the complaints, said: “We have seen countless cases of ineffective and partial enforcement by the DPC in recent years. We want to make sure that Twitter fully complies with EU law, which — at a minimum — requires that users’ consent be sought in this case.”

The DPC has already taken some motion over X’s processing of data to train an AI model, launching legal proceedings within the Irish High Court looking for an injunction to stop using the data. However, noyb argues that the DPC’s actions to date are insufficient, mentioning that X users don’t have any way of forcing the corporate to delete “data they have already collected.” In response, noyb has filed GDPR complaints in Ireland and 7 other countries.

The complaints allege that X has no legitimate basis to use the data of some 60 million people within the EU to train AI without obtaining their consent. The platform appears to depend on a legal basis referred to as “legitimate interest” for AI-related processing. However, privacy experts say it must obtain people’s consent.

“Companies that communicate directly with users simply need to show them a yes/no prompt before using their data. They do this regularly for a lot of other things, so it would certainly be possible to do this for AI training as well,” Schrems suggested.

In June, Meta put an analogous plan to process user data for AI training on hold after noyb backed some GDPR complaints and regulators intervened.

However, Company X’s approach of quietly releasing user data to train its AI without notifying humans apparently allowed it to go undetected for several weeks.

According to the DPC, X processed data of Europeans for the needs of coaching the AI ​​model between May 7 and August 1.

X users got the power to opt out of the processing via a setting added to the net version of the platform — apparently in late July. But there was no way to block the processing from happening. And in fact, it’s hard to opt out of using your data to train AI should you don’t even realize it’s happening.

This is vital since the GDPR goals to explicitly protect Europeans from unexpected uses of their data that might have consequences for his or her rights and freedoms.

In arguing against X’s selection of legal basis, noyb cites a ruling from last summer by Europe’s highest court — concerning an antitrust grievance relating to Meta’s use of private data for ad targeting — by which judges ruled that the legitimate interest legal basis was not valid for this use case and that user consent have to be obtained.

Noyb also points out that generative AI vendors typically claim they’re unable to meet other core GDPR requirements, corresponding to the appropriate to be forgotten or the appropriate to obtain a replica of 1’s personal data. Such concerns are raised in other pending GDPR complaints against OpenAI’s ChatGPT.