Norway DPA publishes statement on X’s use of data for AI training
Norwegian data protection authority Datatilsynet recently published overview of X’s use of personal data to train its AI model. This summer, it was revealed that X had trained its AI models on users’ posts without prior notification. The feature was pre-checked in user settings, meaning that users had to actively opt out if they did not wish for their personal data to be used for training purposes.
Given that X’s European headquarters is located in Ireland, the Irish Data Protection Authority has taken the lead in overseeing this matter. Following the discovery of this practice in July, the Irish authority initiated an investigation into the AI model in collaboration with X.
After a legal process in the Irish court system, X and the Irish Data Protection Authority reached an agreement regarding the personal data collected from public posts by X users in the EU/EEA. This data was used to train the AI model Grok between May 7 and August 1, 2024. X committed to permanently halting the processing of data collected during this timeframe for AI training purposes. Furthermore, the company paused the processing of posts from EU/EEA citizens after August 1 for the same reason. However, X has since resumed processing these posts to train Grok, meaning users must again opt out if they do not want their posts used for this purpose.
According to X, the separate company xAI is responsible for processing X posts as well as interactions, inputs, and outputs related to Grok for training and fine-tuning purposes. The General Data Protection Regulation (GDPR) imposes strict requirements on companies that handle personal data. It mandates that personal data must be processed legally and transparently, ensuring that users are informed about how their data is used and that there is a valid legal basis for this processing.
The situation regarding X’s use of public posts to train the Grok AI model remains ambiguous. As X is based in Ireland, the Irish Data Protection Authority is the primary supervisory authority in this case. The authority has received multiple complaints against X and other companies that utilize personal data for training AI models. It is anticipated that the Irish authority will await the European Data Protection Board’s (EDPB) statement before proceeding with these cases. The Data Protection Authority will closely monitor this situation in collaboration with other European data protection authorities and will provide updates as they become available.
Source: X trener KI på brukerdata
