"Elon Musk’s X agrees to pause EU data processing for training Grok" 8 August 2024

Elon Musk has agreed to stop turning Europeans’ X posts into AI training fodder for his Grok chatbot — for now.

Ireland’s Data Protection Commission (DPC), which leads on privacy oversight of X under the bloc’s General Data Protection Regulation (GDPR), announced the development in a press release..., saying it welcomed the social media firm’s decision to “suspend its processing of personal data for the purpose of training AI tool ‘Grok.’”

“The [DPC] welcomes X’s agreement to suspend its processing of the personal data contained in the public posts of X’s EU/EEA users which it processed between May 7, 2024 and August 1, 2024, for the purpose of training its AI ‘Grok’,” the regulator wrote in a press release emailed to journalists. “The agreement was concluded against the backdrop of an urgent High Court application brought by the DPC under Section 134 of the Data Protection Act, 2018. The application was made before Ms. Justice Reynolds who indicated in her concluding remarks that the rights and freedoms of data subjects across the EU/EEA [European Economic Area] were at the core of the application.”

Earlier this week it emerged that the DPC had instigated court proceedings seeking an injunction against X over the data processing without consent. The regulator was also reported by Ireland’s national broadcaster, RTE, which is intending to refer the matter to the European Data Protection Board (EDPB).

In a statement on X’s abrupt U-turn, DPC commissioner Des Hogan added, “My colleague, commissioner Dale Sunderland, and I welcome X’s agreement to suspend processing while the DPC, working in conjunction with our EU/EEA peer regulators, continue to examine the extent to which the processing complies with the GDPR.

“One of our main roles as an independent regulator and rights based organisation is to ensure the best outcome for data subjects and today’s developments will help us to continue protecting the rights and freedoms of X users across the EU and EEA. We will continue to engage with all data controllers to ensure the rights of our citizens under the EU Charter of Fundamental Rights and the GDPR are upheld.”

The DPC has been contacted with questions, including whether it will seek to ensure that any unlawfully processed data is deleted.

The legality of any AI models trained on unlawfully obtained data, and what to do about them, is another pertinent question. But it remains unclear how privacy watchdogs might interpret the law in this area.

OpenAI’s rival chatbot, ChatGPT, attracted early attention from some GDPR enforcers as a result of the public data of Europeans being processed to train the model. Back in January, Italy’s privacy watchdog put OpenAI on notice over multiple suspected breaches of the regulation.

However, an EDPB taskforce that looked at how to apply the GDPR to ChatGPT — issuing its first report back in May — was largely undecided on crux issues such as the lawfulness and fairness of processing.

Ordering the deletion of models trained on unlawfully processed data would represent a further decision leap for privacy watchdogs.

Update: The DPC has now sent us a response. Assistant principal communications officer, Risteard Byrne, told TechCrunch: “The matter was adjourned and will be before the courts again in September.” “The DPC will, in conjunction with our EU/EEA peer regulators, continue to examine the extent to which the processing complies with the GDPR,” he added.

X also responded to our request for comment via its press email by emailing a URL to a post put out by its Global Government Affairs account — in which the company writes: “We are pleased that people using X in the EU can continue to use Grok and control how their data is used with a simple privacy setting. We will continue to work with the DPC about Grok and other AI matters as we have been doing since last year.”

In light of X’s response we asked the DPC for confirmation it has obtained a legally binding assurance from X that it has stopped processing EU users’ information for AI model training.

“The undertaking outlined in our statement was agreed in the Irish High Court, before Ms. Justice Reynolds,” Byrne responded, declining to provide any further details of the undertaking.

In an earlier post X also put out on Global Government Affairs the company rails against the injunction being sought by the DPC, suggesting it is “unwarranted, overbroad and singles out X without any justification”. “While many companies continue to scrape the web to train AI models with no regard for user privacy, X has done everything it can to give users more control over their data,” X also claimed.