Elon Musk’s X (formerly known as Twitter) has faced significant legal challenges this month, with the latest blow coming from a successful legal challenge against the company’s shadowbanning practices. PhD student Danny Mekić brought legal action against X for infringing on his rights under the EU’s Digital Services Act (DSA) and General Data Protection Regulation (GDPR) after his account was shadowbanned without notification.
Details of the Case
Danny Mekić discovered that his X account had visibility restrictions applied after he shared a news article related to his research on the bloc’s proposal to scan citizens’ private messages for child sexual abuse material (CSAM). The restrictions led to his replies being hidden and his account not appearing in search suggestions. Mekić’s attempts to contact X directly were unsuccessful, prompting him to file legal claims in the Netherlands under the EU Small Claims process.
Legal Findings
On July 5, the court ruled in Mekić’s favor, finding that X’s Irish subsidiary violated several provisions of the DSA:
- Article 12: Failing to provide a point of contact for complaints.
- Article 17: Failing to provide a statement of reasons for the account restrictions.
Mekić, a premium subscriber to X, also sued for breach of contract and was awarded compensation for the service deprivation period. Additionally, the court ordered X to provide him with a point of contact within two weeks or face a daily fine of €100.
GDPR Violations
In a separate ruling on July 4, the court found X in violation of the GDPR, particularly:
- Article 22: Automated decision-making affecting Mekić’s professional visibility and employment prospects.
- Data access rights: X failed to provide personal information requested by Mekić.
The court ordered X to provide meaningful information about the automated decision-making and the withheld personal information within one month. Failure to comply could result in fines of up to €4,000 per day.
Wider Implications
These rulings could have broader implications for the enforcement of the DSA and GDPR against X. The DSA focuses on stricter content moderation, while the GDPR emphasizes data protection and transparency. Privacy campaigners have long argued for stronger enforcement of these regulations against major platforms.
Comments from Danny Mekić
Mekić expressed satisfaction with the rulings but emphasized the need for regulatory enforcement to address arbitrary shadowbanning comprehensively. He criticized X’s lack of transparency and commercial motives behind shadowbans, suggesting that platforms should impose transparent, contestable restrictions on users instead.
Regulatory Oversight
The enforcement of the DSA and GDPR falls to various regulatory bodies, including Ireland’s media regulator, Coimisiún na Meán, and the Data Protection Commission (DPC). However, these bodies have been criticized for their slow responses and limited enforcement actions against major tech platforms.
Conclusion
The legal victories for Danny Mekić highlight the challenges users face in holding major platforms accountable for their practices. While individual legal actions can set precedents, comprehensive regulatory enforcement is necessary to ensure transparency and compliance with EU laws. The outcomes of these cases may prompt further scrutiny of X’s practices and potentially lead to broader changes in how social media platforms manage content moderation and data protection.
