Noyb vs X: Illegal data collection for AI training
xAI is no longer allowed to use personalized data from X - at least for the time being. However, Noyb is lodging further complaints.
(Image: vs148/Shutterstock.com)
The Irish data protection authority has opened legal proceedings against X. The platform has been collecting personal data for a while in order to train its AI models. Specifically, it concerns the artificial intelligence of Elon Musk's AI company xAI, which he founded in early 2023. This is not enough for the data protection association Noyb, which has filed complaints in nine EU countries.
According to Noyb, the data is being used without the consent of the people who have contributed to X. According to the association, X has not even informed users that their data is being used for AI training. In a blog post, the data protection experts write that the data of around 60 million people in Europe is at stake. Although the competent Irish data protection authority (DPC) has initiated proceedings as a result, Noyb says that the DPC does not appear to be prepared to fully enforce the GDPR. The DPC is known for being rather friendly to large tech companies.
Data processing requires consent - at Meta and at X
Meta also recently tried to be allowed to use the public data of all people on the Meta platforms for its own AI training. After all, the company had informed users of this via a notice and even created an opportunity to object. Although permission was first granted by the Irish data protection authorities, other data protection authorities complained. This was followed by a request from the DPC, whereupon Meta initially canceled the project completely.
Videos by heise
X has been collecting data from the platform since May 2024 and using it irrevocably for the development of the Grok AI. According to Noyb, the first court hearing was held last Thursday as a result. Data protection activist Max Schrems writes in the article: "The court documents are not public, but it is clear from the oral hearing that the DPC has not questioned the legality of this processing itself. It seems that the DPC is content with so-called 'risk containment' and rather criticizes the lack of cooperation of X (formerly Twitter). The authority seems to be addressing only peripheral issues but shying away from the core problem."
Noyb hopes that with the increasing involvement of national data protection authorities, there will be more clarity about what happens to the data that has already been incorporated into AI models. And that the fundamental question of consent will be clarified. So far, the DPC has agreed with X to pause data collection until September. The GDPR provides for informed consent to the processing of data - this is what data protection experts demand.
(emw)
