Irish DPC investigates X over use of EU personal data to train Grok AI

The Grok logo on a smartphone arranged in New York, US, on Wednesday, Nov. 8, 2023. Elon Musk revealed his own artificial intelligence bot, dubbed Grok, claiming the prototype is already superior to ChatGPT 3.5 across several benchmarks. Photographer: Gabby Jones/Bloomberg

Ireland’s data protection watchdog has launched a probe into Elon Musk-owned X over the use of personal data collected from European Union users to train its AI system Grok.

The investigation will focus on how X, formerly Twitter, uses posts from users on the platform to train Grok’s AI language models.

The Data Protection Commission (DPC) said it will examine whether X is complying with Europe’s landmark data legislation – the General Data Protection Regulation or GDPR – as to the lawfulness and transparency of the processing of personal data.

“Grok is the name of a group of AI models developed by xAI,” the DPC said in a statement.

“These Large Language Models (LLMs) are used, among other things, to power a generative AI querying tool/Chabot, which is available on the X platform.” 

It said its inquiry would consider a range of issues around the use of data controlled by X, namely personal data comprised in publicly accessible posts on the X platform from users based in the EU.

“The purpose of this inquiry is to determine whether this personal data was lawfully processed in order to train the Grok LLMs,” it added.

The decision to conduct this probe under Section 110 of the Data Protection Act 2018 was taken by Data Protection Commissioners Dr Des Hogan and Dale Sutherland. X was notified earlier this week.

Last year, the DPC engaged with X around issues to do with AI models and personal data.

In August, the DPC said it welcomed an agreement with X to suspend the processing of personal data between May and August for the purpose of training Grok following an “urgent” High Court application. This was the first time a European data authority had taken such action.

“One of our main roles as an independent regulator and rights based organisation is to ensure the best outcome for data subjects and today’s developments will help us to continue protecting the rights and freedoms of X users across the EU and EEA,” Dr Hogan said at the time.

“We will continue to engage with all data controllers to ensure the rights of our citizens under the EU Charter of Fundamental Rights and the GDPR are upheld.”