X faces scrutiny over AI data practices in Ireland

The Irish Data Protection Commission (DPC) concluded court proceedings against social media platform X on September 4, after X agreed to permanently cease processing certain personal data for its AI tool, Grok. The DPC had initiated legal action due to alleged violations of the EU's General Data Protection Regulation (GDPR), focusing on the unauthorized use of user data for AI training. Despite the resolution, significant concerns about X's data practices and compliance with EU laws persist. Max Schrems, chairman of the NGO Noyb, criticized the DPC for not addressing the fundamental issue of obtaining personal data without user consent. Noyb had filed multiple complaints against X following an interim agreement to halt data processing. The involvement of US-based xAI Corp. complicates the situation, as both entities may share responsibilities as data controllers, raising questions about the effectiveness of the DPC's actions. The DPC's approach has been to prioritize the protection of data subjects' rights rather than to impose penalties or confirm violations. However, the authority's focus on TIUC as the data controller leaves unresolved issues regarding the roles of both TIUC and xAI Corp. in data management. Experts argue that without addressing both companies' responsibilities, compliance with data protection laws remains incomplete. Additionally, the DPC has not clarified how X will stop processing the data, which poses challenges due to the complexities of large language models. While the DPC stated that the datasets involved have been deleted, experts warn that this does not eliminate the influence of the deleted data on the AI models, highlighting the need for more comprehensive measures like algorithmic disgorgement.