The DPC welcomes X’s agreement to suspend its processing of personal data for the purpose of training AI tool ‘Grok’.

The Data Protection Commission ("DPC") welcomes X's agreement to suspend its processing of the personal data contained in the public posts of X's EU/EEA users which it processed between 7 May 2024 and 1 August 2024, for the purpose of training its AI 'Grok'. The agreement was concluded against the backdrop of an urgent High Court application brought by the DPC under Section 134 of the Data Protection Act, 2018. The application was made before Ms. Justice Reynolds who indicated in her concluding remarks that the rights and freedoms of data subjects across the EU/EEA were at the core of the application.

This was the first time that any Lead Supervisory Authority has taken such action, and the first time that the DPC has sought to utilise its powers under Section 134. This application was made to protect the rights and freedoms of X's EU/EEA users, and came after extensive engagement between the DPC and X regarding its AI Model training.

Commissioner (Chairperson) Dr. Des Hogan speaking on today's decision stated:

"My colleague, Commissioner Dale Sunderland, and I welcome X's agreement to suspend processing while the DPC, working in conjunction with our EU/EEA peer regulators, continue to examine the extent to which the processing complies with the GDPR. One of our main roles as an independent regulator and rights based organisation is to ensure the best outcome for data subjects and today's developments will help us to continue protecting the rights and freedoms of X users across the EU and EEA. We will continue to engage with all data controllers to ensure the rights of our citizens under the EU Charter of Fundamental Rights and the GDPR are upheld."

NOTES TO EDITORS
Section 134 of the Data Protection Act 2018 allows the Commission, where it considers there is an urgent need to act to protect the rights and freedoms of data subjects, to make an application to the High Court for an order requiring the data controller to suspend, restrict or prohibit the processing of personal data.