X International Unlimited Company (Formerly Twitter International Unlimited Company) – Court Ruling (Netherlands, 2026)

X International Unlimited Company (Formerly Twitter International Unlimited Company) (the controller), formerly Twitter, imposed a temporary restriction on a user’s (the data subject’s) account due to the controller’s automated detection system flagging the post as potentially violating the controller’s policy against child abuse after the data subject used the words “child pornography” in a post about the European plan to combat child abuse imagery. The controller did not notify the data subject of the restriction. The data subject submitted an access request to the controller to determine, among other things, the scope and reasons for imposing the restriction. The controller lifted the restriction without informing the data subject and later on responded to the access request referring to its privacy policy. However, the data subject filed a petition in court arguing that the controller failed to respond adequately to his access request. The controller provided the data subject with information regarding the imposed restriction through a letter in January 2024 and in September 2024 provided additional access to documents and information, including to a partially redacted printout from one of its systems. In front of the first instance court, the data subject requested an order to the controller to respond to the access request under Article 15 GDPR and the request for information regarding automated decision-making under Article 22 GDPR. The court concluded that the controller must respond to the requests and provide specific information regarding “reputation scores”, labels and one of its systems. The controller appealed the first court’s judgement. The appellate court upheld the contested decision but allowed the controller to redact the names of its employees and the exact timestamps of when automated decision-making occurred in the document it was ordered to provide concerning one of its systems. In this sense, the data subject declared that he