X (formerly Twitter) – Court Ruling (Netherlands, 2025)

The controller is X Corp., the provider of the social media platform X, formerly known as Twitter. The data subject, an X user, made an access request to X under Article 15 GDPR, requesting access to personal data held about him, including information about automated decision-making (“ADM”) under Article 22 GDPR. His request was not satisfied. The data subject filed a case before the court of first instance (Amsterdam District Court - Rechtbank Amsterdam) demanding the satisfaction of his rights. On 5 July 2024, the court of first instance ordered X to respond to the data subject’s access request and provide details on ADM including specific information about some function of X like “reputation scores”, “labels“ and a particular system (“system y“). X then appealed the decision of the court of first instance before the Court of Appeal (Gerechtshof Amsterdam - AmsterdamCourt of Appeal). X sought the annulment of the contested decision, or in any case the exclusion from the data to be provided, data from which the operation of X's content moderation systems, spam filters and advertising settings could be deducted. X maintained that the court of first instance should not have ordered it to give (full) access to the data processing in the “system y“. According to X the system contains trade secrets and sensitive security information, which if fallen in the wrong hands could lead to abuses of the platform. X had therefore, for the time being, only provided a redacted version of “system y“ to the data subject, in which all confidential information had been deleted. X further requested the court of appeal to impose a disclosure prohibition (gag order - mededelingenverbod) to the data subject within the meaning of the Dutch Code of Civil Procedure (Rv) (Article 28(1)(b)) with regard to the unredacted version of “system y“ that had yet to be submitted. This request covered all information that has been omitted from the full version of the documentation “system y“