Social media platform X (formerly Twitter) has come under scrutiny as a series of complaints were filed across nine European countries on Monday. These complaints accuse the company of violating the General Data Protection Regulation (GDPR) through the alleged improper use of private data. NGO None of Your Business (Noyb) lodged the complaints in countries such as France, Belgium, Austria, Spain, and the Netherlands, among others, raising concerns over X’s data processing practices and transparency.
The heart of these complaints lies in X’s alleged failure to secure user consent before collecting and utilizing personal data. Critics assert that X’s privacy policies are vague, providing users with insufficient information on how their data is managed or shared with third parties. The complaints also point out that the platform does not offer adequate control options for users to manage their data, including ways to opt-out of certain data processing activities.
The GDPR is a stringent data protection regulation by the European Union designed to protect individuals’ personal data and ensure their privacy. According to GDPR, companies must obtain explicit consent from users before processing their data and must be transparent about its use. Companies found to be non-compliant with GDPR can face fines up to four percent of their global annual revenue.
The complaints brought forth by NGO Noyb particularly allege that X is unlawfully using the personal data of around sixty million EU residents to train its AI models without obtaining explicit consent. Noyb claims that X is relying on the concept of “legitimate interest” to justify this data processing, a legal basis they argue is insufficient for AI training activities. Noyb contends that X has not allowed users the opportunity to either give or withhold such consent, thus infringing upon their GDPR rights.
Particularly noteworthy is the complaint filed in Ireland, which serves as the European headquarters for many U.S.-based tech companies, including X. Consequently, the Irish Data Protection Commission (DPC) has jurisdiction over X’s data protection practices. The DPC initiated legal action against X, seeking an injunction from the Irish High Court to compel the company to halt using personal data for AI training purposes. Noyb has also criticized the DPC, accusing it of taking inadequate enforcement actions against X.
As of now, X has not issued a comment on these complaints.
For more details, visit JURIST.