Social media platform X (formerly Twitter) is the subject of complaints in nine European countries, including Belgium, regarding how it is using personal user data to train artificial intelligence (AI).
Vienna-based NGO Noyb (short for "none of your business") has filed complaints with data protection authorities in nine countries (Austria, Belgium, France, Greece, Ireland, Italy, Netherlands, Spain and Poland) based on what it says is the "unlawful" use of personal data by X to train its AI technologies.
Noyb says that X first started feeding European users' data to its "Grok" AI technology in May 2024, without informing them or asking for consent.
Under the European General Data Protection Regulation (GDPR), any change in the processing of personal data must be announced in a clear and transparent manner, and users have a right to refuse the use of their data.
You've been non-consensually opted into training Twitter / X's Grok AI.
Want to opt out? ✅Go here: https://t.co/Vpn59JsrtC -or- ✅Navigate to: Settings ➡️ Privacy & Safety ➡️ Grok pic.twitter.com/PtUliIkk8v — John Scott-Railton (@jsrailton) July 26, 2024
X is not the first social media platform to come under fire for using personal data to train AI, allegedly without consent, with Meta and LinkedIn also recently called out in Belgium for the practice.
Noyb highlights that the EU's data protection rules allow for users to "donate" their personal data for AI development, if asked for clear consent. It adds that if "just a small number" of X's 60 million users consented to the use of their personal data, the platform would have "more than enough training data for any new AI model".
"Companies that interact directly with users simply need to show them a yes/no prompt before using their data. They do this regularly for lots of other things, so it would definitely be possible for AI training as well," said Max Schrems chairman of Noyb.
Irish data protection case criticised
Noyb criticised recent court proceedings launched by the Irish Data Protection Commission (DPC) against X regarding the processing of personal data, which the Vienna-based NGO says "stopped short of fully enforcing the GDPR".
Last week, the Irish DPC welcomed an agreement by X to temporarily suspend the processing of personal data of European users to train its AI system. The agreement comes against the backdrop of the urgent application made by the DPC to the Irish High Court and its ongoing investigation into whether the processing complies with the GDPR.
Schrems said that while court documents for the Irish case are not public, the oral hearing indicates that the Irish DPC was "not questioning the legality of the processing itself", but brought a case on the basis of mitigation measures and a lack of co-operation by Twitter.
"The DPC seems to take action around the edges, but shies away from the core problem," said Schrems.
Noyb said that it has filed GDPR complaints with the data protection authorities in nine countries "to ensure that the core legal problems around Twitter’s AI training are fully addressed".
When contacted by The Brussels Times, a spokesperson for the Irish DPC said it would be inappropriate to comment further as the matter is "subject to ongoing regulatory engagement".
X has also been contacted for comment.
