The European Union’s lead privacy regulator has concluded its court proceedings regarding X’s processing of user data for training its Grok AI chatbot. However, the situation is far from over for the social media platform formerly known as Twitter, owned by Elon Musk. The Irish Data Protection Commission (DPC) has confirmed that it has received several complaints under the General Data Protection Regulation (GDPR) and will investigate them.
The DPC stated, “The DPC will now examine the extent to which any processing that has taken place complies with the relevant provisions of the GDPR. If X has infringed the GDPR, the DPC will consider corrective actions.”
X agreed in early August to suspend data processing for Grok training, which was made permanent later in the week. The agreement required X to delete and cease using data collected from European users between May 7, 2024, and August 1, 2024. However, there is no obligation for X to delete AI models trained on this data.
Despite the urgent court action taken by the DPC, X has not faced any sanctions yet for processing personal data without consent. Penalties under the GDPR can be severe, potentially reaching up to 4% of global annual turnover.
Regulators have the authority to enforce operational changes and order infringements to cease. However, investigations and enforcement of complaints may take a considerable amount of time.
X can still use AI models trained on data from users who did not consent to the processing, without immediate intervention or sanctions.
The DPC clarified that X is not required to delete AI models trained on European data as per the obtained undertaking.
There are concerns that X might exploit a loophole in EU privacy rules by training AI models on data and then committing to deleting the data, leaving the models intact for profit.
Generative AI tools like Grok can produce false information, raising risks for users whose data was used to train the bot.
The novelty of AI tools and uncertainties in enforcing the GDPR against such technology might be causing caution among regulators. It’s unclear if regulators have the authority to order deletion of AI models trained on unlawfully processed data.
As complaints pile up, data protection authorities will need to address the challenges posed by generative AI technologies.
Going sour on Pickles
In other news, X’s head of global affairs, Nick Pickles, has resigned. Pickles, a long-serving employee, announced his departure several months ago without specifying the reasons. X is facing challenges in Brazil, the UK, and the EU, including investigations and political controversies.
