The DPC launched High Court proceedings against X for its data collection policies
Ireland's Data Protection Commission launched High Court proceedings against X (formerly Twitter) for collecting European users' data for AI training without proper notification or consent, leading X to halt processing of harvested data pending a compliance review.
Recently, reports emerged that the social media platform X had quietly opted its users into a model training data collection policy from which they could only opt out via a mechanism that was only available on the settings of the platform's web version. Although X stayed temporarily silent on the issue, it eventually confirmed the move. Shortly afterward, the Data Protection Commission (DPC) publicly expressed surprise at X's decision, as the regulator claimed it had been working with X on the subject.
A report by RTE this Wednesday suggests that the DPC discovered that the opt-out mechanism was introduced as a mitigation measure since X had started processing European users' posts for training data. This, together with the fact that the social media platform did not notify users that it would begin collecting their data or that it was making an opt-out mechanism available, and that the company plans to release the next version of its AI Assistant, Grok, which was likely trained on European users' data in August, led the DPC to launched High Court proceedings against X.
The DPC backed the urgency of its petition by pointing out that it must protect users' data rights and freedoms as specified under the GDPR. By following this course of action, the DPC revealed it was seeking orders against X, including one to ensure that the platform stops processing users' data for AI training purposes. On Thursday, shortly after reports of the launch emerged the DPC sought proceedings against X, the regulator publicly shared that it welcomed X's decision to stop processing the public posts it had harvested between 7 May 2024 and 1 August 2024 until the DPC could determine how compliant X's data collection policies were.
The Data Protection Commission also highlighted that this is the first time a Lead Supervisory Authority requested High Court proceedings and the first time the DPC had done so by appealing to Section 134 of the Data Protection Act, which states that, if deemed urgently necessary, the DPC can apply to the High Court for an order requiring the suspension, prohibition, or restriction of personal data processing.
