Elon Musk's social media platform X, without the consent of its users, illegally used the data of European users to train Ai models, which has led to a series of privacy complaints.

At the end of last month, a keen-eyed social media user discovered a setting indicating that X had quietly started processing regional users' post data to train its Grok Ai chatbot. This discovery surprised the Irish Data Protection Commission (DPC), the supervisory authority responsible for supervising X's compliance with the European Union's General Data Protection Regulation (GDPR).

Under GDPR regulations, all personal data usage must have a legal basis. X, for processing European users' post data without their consent, has faced nine privacy complaints in Austria, Belgium, France, Greece, Ireland, Italy, the Netherlands, Poland, and Spain.

Max Schrems, the chairman of non-profit privacy rights organization Noyb, said in a statement, "We have witnessed countless cases of ineffective and partially implemented actions by the DPC in recent years. We hope to ensure that Twitter fully complies with EU law, which requires the consent of users in such cases."

The DPC has taken action against X's use of data for Ai model training, filing a legal suit with the Irish High Court seeking an injunction to force X to stop using the data. However, Noyb believes that the actions taken so far by the DPC are not enough and points out that X users have no way of getting the company to delete "data that has been obtained". In response, Noyb filed GDPR complaints in Ireland and seven other countries.

These complaints argue that X's use of their data to train Ai without the consent of about 60 million Europeans is not justified. The platform seems to rely on a legal basis called "legitimate interests" when processing data related to Ai, but privacy experts say that it requires people's consent.

Companies that interact directly with users only need to display the "yes/no" prompt before using their data. Schrems suggested, "They often do this for many other things, so Ai training can certainly be done this way."

In June of this year, after Noyb supported some GDPR complaints and regulators intervened, Meta Platforms (META.O) suspended similar plans to use user data to train Ai.

However, X's practice of stealthily helping itself to user data for Ai training without notifying others seems to have been lurking in the dark for a few weeks.

According to the DPC, X processed European's data between May 7th and August 1st, 2021, for Ai model training. X's users apparently only got the option to opt out of processing through the platform's web version at the end of July, but before that, there was no way to stop the processing. In addition, it's difficult to opt out if users don't even know that their data is being used.

This is important because GDPR's explicit objective is to protect Europeans' information from accidental use that could impact their rights and freedoms.

In arguing against X's choice of legal basis, Noyb cites a ruling last summer by the European Court of Justice involving competition complaints against Meta for using user data for ad targeting, in which a judge ruled that the legitimate interests legal basis was invalid in the use case and user consent was required.

Noyb also notes that providers of generative Ai systems typically claim that they cannot comply with other core GDPR requirements, such as the "right to be forgotten" or the "right to obtain a copy of personal data." These concerns are also reflected in other pending GDPR complaints against OpenAI's ChatGPT.