Ireland’s Data Protection Commission (DPC) launched legal proceedings against social media platform X on Tuesday (August 6), according to the website of the High Court of Ireland.

The complaint concerns the processing of user data for Grok, an artificial intelligence (AI) model of X, the Irish Examiner reported on Wednesday. X’s Global Government Affairs account confirmed this information in a post on August 7.

Grok was developed by xAI, the artificial intelligence company of X owner Elon Musk, and was used as a search assistant for premium accounts on the said social networking platform.

Among other things, the DPC is asking the court to order X to stop or limit the processing of user data to train its artificial intelligence systems, the Irish Examiner reported, also writing that the DPC plans to refer the matter to the European Data Protection Board (EDPB) for further consideration.

The EPDB told Euractiv that the Irish DPC has not yet referred the case to the body.

The case has been going on for days since on Monday (August 5), consumer groups alleged that X is in breach of the GDPR, the EU’s landmark data protection regulation, in a complaint they filed with Ireland’s DPC.

“The Irish DPC’s order is unjustified, overbroad and singles out X without any justification. This is extremely disturbing,” X said in her post on Wednesday about the case.

“The order applies not only to Grok but to every AI model used by X, potentially affecting our work to keep the platform secure and potentially our ability to make X available in the EU,” X wrote.

The Court is expected to hear the case again this week, the Irish Examiner reported.

The Irish DPC supervises X’s activities in the EU for GDPR compliance, as Twitter International, which manages X, is based in Dublin.

The DPC’s actions under new leadership may be a positive sign of reform, said Johnny Ryan, political and human rights enforcement expert and director of Enforce at the Irish Council for Civil Liberties (ICCL).

This action “may be the first substantive GDPR enforcement action against [εταιριών] Big Tech that Ireland is getting without serious pressure from other member states,” he told Euractiv.

Under the Irish Data Protection Act 2018, which incorporates the EU GDPR, the Irish High Court can order the processing of personal data to stop or be restricted if DPC has an urgent need to protect people’s rights. The DPC can also apply for fast-track, temporary orders in urgent cases.

“It appears that X, unlike Meta, is not complying with DPC’s informal requests to stop processing [δεδομένων]. Under Irish law, the DPC cannot order the shutdown directly, but must go through the Irish courts,” said activist and founder of Noyb, the non-profit European Center for Digital Rights, Max Schrems.

Schrems also told Euractiv that this is unprecedented and they will be watching to see how quickly the matter moves forward or if it faces delays in the coming days.

Other concerns

The DPC is concerned about X’s plan to release the next version of Grok, which is said to have been trained using the personal data of users in the EU and the European Economic Area, sometime in August, the Irish Examiner reported. The institution argues that doing so would rather exacerbate issues for current data processing, the Irish Examiner reported.

In the court filing, the watchdog acknowledged that X implemented some restrictive measures, such as an opt-out option for users, that did not exist when the data processing began, the Irish newspaper also reported. Many of X’s European users, however, fell victim to this processing of their data without timely and effective implementation of these safeguards as required by the GDPR.

Twitter International refused the Irish DPC’s requests to “stop processing the personal data in question” or delay the release of the next version of Grok.

In response to Euractiv’s request for comment, X’s press team referred only to the post cited earlier in this article, while the Irish DPC also declined to comment because the case is ongoing.

X said in its post that it has been cooperative and transparent with regulators since late 2023 regarding its use of public data for AI training, updated its policies to improve transparency and give users more control over their data, and of AI interactions compared to other companies.