Brazil's National Data Protection Authority (ANPD) issued Decision Dispatch No. 29/2024, ordering preventive and corrective measures against X Corp. (X) related to the processing of personal data for training generative AI models. The document highlights the need to comply with Brazilian data protection standards, particularly regarding transparency and the protection of sensitive data.
The ANPD noted that the company's Terms of Use contain generic expressions, such as "for any purpose," which do not meet the principle of purpose specification in personal data processing. X Corp. was required to revise its terms to clearly define the purposes for which data is used, detailing the impact on data subjects' privacy. Additionally, the company must exclude data originating from private accounts or private messages from its processes and immediately cease using data from individuals under 18 years old for AI training purposes in Brazil.
To prove it has stopped processing data from minors, X Corp. must provide technical evidence or a formal declaration signed by the company's legal representatives. The company was also required to disable the data-sharing option for generative AI purposes for accounts belonging to users under the age of majority, and to update its Privacy Policy to include information about these measures.
The ANPD's determinations are preventive in nature, aiming to bring X Corp. back into legal compliance. In the event of non-compliance, more severe sanctions may be applied, including the initiation of a sanctioning administrative proceeding. Conversely, full compliance with the measures will be considered a mitigating factor in any potential enforcement action.
Source: ANPD
This post was summarized from its original version using ChatGPT version 4o, with human review.