X might still be facing fines for possible GDPR violations even though the social media giant has agreed to suspend its processing of European users’ data for its AI chatbot Grok. The Irish Data Protection Commission (DPC) confirmed to Techcrunch that it has received a number of complaints which it will look into.

If it turns out the company (Twitter International Unlimited Company, X’s Irish subsidiary) has violated GDPR, the DPA said to the site that it will “consider whether the exercise of any of its corrective powers is warranted and, if so, which one(s).”

This could mean penalties reaching up to 4% of the company’s global annual turnover.

Suspension on Grok

The Irish High Court recently ended proceedings with X in which the company agreed to suspend processing personal data from public posts of X’s EU/EEA users to train its AI tool Grok, which it started on May 7, 2024.

The DPA brought the case to court under “urgent circumstances” and with “significant concerns” that training Grok on users’ public posts could be a ”risk to the fundamental rights and freedoms of individuals.”

Commissioner (Chairperson) Des Hogan said that the Commission welcomed the outcome, and that “this action further demonstrates the DPC’s commitment to taking appropriate action where necessary, in conjunction with its European peer regulators. We are grateful for the Court’s consideration of the matter.”

This was also the first time that the DPC used its powers under Section 134 of the Data Protection Act 2018, which allows it to make an application to the High Court if it’s urgent to act to protect the rights of data subjects.

The DPA has not listed the violations, yet, according to the European Center for Digital Rights (NYOB), with Grok, X allegedly violated nine GDPR provisions and principles, transparency rules, and operational rules, which include GDPR Articles 5(1) and (2), 6(1), 9(1), 12(1) and (2), 13(1) and (2), 17(1)(c), 18(1)(d), 19, 21(1) and 25.

Issues with training AI models

Besides this action on X, the DPC is also making a request to the European Data Protection Board for an opinion pursuant to Article 64(2) GDPR to “trigger discussion and facilitate agreement” on some of the core issues rising form developing and training an AI model.

“The DPC hopes that the resulting opinion will enable proactive, effective and consistent Europe-wide regulation of this area more broadly,” added Commissioner Dale Sunderland.

“This action further demonstrates the DPC’s commitment to taking appropriate action where necessary, in conjunction with its European peer regulators.”

Commissioner (Chairperson) Des Hogan

“It will also support the handling of a number of complaints that have been lodged with/transmitted to the DPC in relation to a range of different data controllers, for purposes connected with the training and development of various AI models.”

Action on Meta’s AI

The DPC has also addressed concerns regarding Meta’s AI technology, which were put on pause after complaints in 11 European countries brought by the NYOB.

Meta earlier informed millions of European users that it was changing its privacy policy to be able to use user information to train its AI technology. The changes, due to come into force on June 26, would have given Meta the right to use personal posts, private images or online tracking data that were published across both social media platforms since 2007.

“Meta’s new privacy policy basically says that the company wants to take all public and non-public user data that it has collected since 2007 and use it for any undefined type of current and future ‘artificial intelligence technology’,” NYOB said.

The company would also have been able to ingest personal data from any source, both public and non-public, and potentially share this with third parties.

By introducing such AI models, NOYB alleges that Meta would violate EU GDPR Articles 5(1), 5(2), 6(1), 9(1), 12(1), 12(2), 13(1), 13(2), 17(1)(c), 18(1)(d), 19, 21(1), and 25.

Meta expressed its disappointment and said that the pause was a “step backwards for European innovation, competition in AI development and further delays bringing the benefits of AI to people in Europe.”