It seems that the company formerly known as Twitter is facing a challenging month filled with unfortunate news. Elon Musk’s X has recently faced its first set of complaints from the European Union regarding potential violations of the bloc’s Digital Services Act. This act serves as a rulebook for online governance and content moderation, with penalties of up to 6% of global annual turnover for proven violations.
However, Musk has been facing a series of recent setbacks in terms of high-level decisions. Eltrys has discovered that earlier this month, X was found to have breached several provisions of the DSA and the bloc’s General Data Protection Regulation (GDPR), a comprehensive privacy framework across the EU. This violation was the result of legal disputes brought by a person whose account X had shadowbanned.
X has frequently faced allegations of engaging in arbitrary shadowbanning, which is a highly concerning accusation for a platform that purports to uphold the principles of free speech. 
Danny Mekić, a PhD student, decided to take action when he found out that X had imposed limitations on his account in October of last year. After he shared a news article about a particular area of law he was studying, the company imposed restrictions. This area of law was connected to the bloc’s proposal to scan the private messages of citizens for child sexual abuse material (CSAM). X failed to provide any notification regarding the shadowban on his account, which was a key point of contention in the legal proceedings.
Mekić became aware of the restrictions on his account when he received messages from third parties informing him that they could no longer view his replies or find his account in search suggestions.
Despite Mekić’s unsuccessful attempts to directly resolve the issue with X, he took legal action against the company in the Netherlands through the EU Small Claims process. He claimed that X had violated important aspects of the DSA, such as not providing him with a designated contact person (Article 12) to address his concerns, and not offering a clear explanation (Article 17) for the limitations imposed on his account.
Mekić, being a premium subscriber to X, took legal action against the company for violating the terms of their agreement.
In addition to everything mentioned, Mekić, being well-versed in the field of data privacy, turned to X for guidance on how his personal data had been handled. He utilized the GDPR to exercise his right to access this information. When X failed to provide the personal information requested, he had valid grounds for his second case: filing claims for breach of the bloc’s data protection rules. The regulation grants individuals in the EU the right to request a copy of the information held on them.
In the DSA case, the court made a ruling on July 5, finding X’s Irish subsidiary (which is still referred to as Twitter) guilty of breaching the contract. As a result, the court ordered the subsidiary to provide compensation for the period during which Mekić was unable to access the service he had paid for. Although the amount in question was just $1.87, the significance of upholding the principle is immeasurable.
In order to ensure effective communication, the court has directed X to designate a point of contact for Mekić. Failure to comply within two weeks may result in a daily fine of €100.
In the case of the DSA Article 17 complaint, Mekić emerged victorious, as the court acknowledged that X should have provided him with a statement of reasons when his account was shadowbanned. He regrettably had to take legal action to learn that sharing a news article had resulted in an automated system restricting his account.
“I am pleased with that,” Mekić expressed to Eltrys. There was a significant dispute in the courtroom. Twitter claims that the DSA is not proportional and that shadowbans of complete accounts are not subject to DSA obligations.
In addition, the court found that X’s general terms and conditions violated the EU’s Unfair Terms in Consumer Contracts Directive.
In the recent GDPR case, which was ruled on July 4th, Mekić achieved another impressive string of victories. This case involved the mentioned data access rights as well as Article 22, which addresses the issue of automated decision making. According to this article, data subjects should not be subjected to decisions that are solely based on automated processing if these decisions have legal or significant consequences.
The court recognized the substantial impact of X’s shadowban on Mekić, acknowledging that it had a negative effect on his professional visibility and could potentially harm his employment opportunities. Consequently, X was instructed by the court to furnish him with pertinent details regarding the automated decision-making process, as mandated by the law, within a month’s time. Additionally, X must also disclose the remaining personal information that Mekić had requested under GDPR data access rights.
If X continues to disregard these data protection rules, the company will be liable for fines of up to €4,000 per day.
X was also directed to cover Mekić’s expenses for both cases.
Although the rulings only pertain to individual complaints, their impact on the enforcement of the DSA and the GDPR against X could be significant. The previous situation is, as we have witnessed today, just beginning to unfold, as X faces the initial consequences of a preliminary breach investigation. However, privacy advocates have long been cautioning that the GDPR is not being adequately enforced against prominent platforms. The current state of platform accountability falls short in recognizing the crucial role that core data protections should play in driving strategic outcomes.
According to Mekić, the decision to bring forward the claims was a last-ditch effort to address the unfair shadowban and have it lifted, as stated in an interview with Eltrys. Furthermore, I have high expectations for Twitter to enhance its compliance with legal transparency obligations and improve its low-threshold contact, ultimately leading to a better user experience.
The European Commission appears to be heavily engaged in investigations related to the DSA. Up until now, when it comes to Twitter, the Commission appears to be primarily concerned with enhancing content moderation measures. The Commission should also consider the potential drawbacks: platforms need to exercise caution and transparency in their content moderation practices,” he also informed us.
In my opinion, there is a more straightforward solution: to limit the influence of algorithms on social media, like Twitter. These algorithms are created to prioritize user engagement and profits. Instead, we should return to the good old days of Twitter and other platforms, where chronological timelines were the norm.
As a designated very large online platform (VLOP), the EU plays a crucial role in enforcing the DSA’s rules on X. However, the responsibility for ensuring compliance with the broader general rules lies with Ireland’s media regulator, Coimisiún na Meán, at the European member state level.
The responsibility for enforcing the EU’s main data protection regulations on Twitter/X usually lies with the Data Protection Commission (DPC) in Ireland. However, the DPC often faces criticism for being slow in investigating complaints related to Big Tech.
When questioned about the enforcement of several longstanding GDPR complaints against X, the DPC spokesperson stated that they were unable to provide a response at the time of publication.
It is evident that relying on individuals to file small claims against major platforms in order to enforce pan-EU law is far from ideal. A comprehensive system of regulatory supervision should be in place to ensure compliance.
“By the way, Mekić mentioned the significant amount of time and effort required for litigation in court,” said Mekić. Although it is possible to handle it without a lawyer. Despite the considerable amount of time invested, you find yourself at a disadvantage compared to the other party who can easily delegate the task to a team of well-funded lawyers and disregard it in the interim. It’s worth noting that my interactions with Twitter have solely been through legal representatives, with no direct contact.
When questioned about his optimism regarding the resolution of his two cases and the potential end to X’s arbitrary shadowbanning for all EU users, Mekić expressed doubt that his own achievements alone would suffice. He believes that regulatory enforcement will be necessary to address this issue.
“I have some doubts,” he admitted. Not much attention is given to the underlying commercial motivations behind shadowbans. If a user violates a rule, it may be necessary to temporarily suspend their account. That is clearly evident. However, this also eliminates the user’s ad revenue for the platform. Shadowbans provide a solution to this issue: users remain unaware of any actions taken against them while still actively participating and contributing to the platform’s advertising revenue.
Implementing transparent and contestable restrictions on users instead of shadow bans would be a bold move for social media platforms. However, it is likely that this will result in a decrease in income. I really hope that Twitter sets a positive example for other platforms by being transparent with users about account restrictions, as mandated by the DSA. According to Mekić, platforms should prioritize their commercial intentions less.
“I find it surprising that the Commission has not addressed the issue of large-scale shadowbanning practices, where users are not notified,” he commented. It occurs frequently on a significant level and is more easily substantiated than their current area of focus.
X has been reached out to for a response regarding the rulings.
