Disciplinary proceedings against X for possible non-compliance with advertisements published by unauthorized entities

Disciplinary proceedings against X for possible non-compliance with advertisements published by unauthorized entities

The CNMV has opened a disciplinary file against Twitter International Unlimited Company, the company responsible for social network X, which was previously Twitter. The measure responds to the massive growth of fraudulent ads on the platform; images of famous people were impersonated, and fake news was used to promote investment products without authorization. 

The CNMV is based on Law 6/2023, of 17 March, on Securities Markets and Investment Services (LMV).

Legal analysis of the infringement

The supervisory body considers that X’s conduct could constitute a “very serious infringement” under article 290.1 n) LMV. This provision classifies as a serious infringement the “publication of advertisements, or outstanding results in a remunerated manner, of investment services in internet search engines, social networks and the media without carrying out the checks contained in article 246.3”. The social network did not verify whether the company Quantum AI was authorized by the CNMV to offer investment services, nor if it appeared on the list of entities warned by the supervisor or by similar foreign bodies.

This omission is not only a breach of current regulations but has also allowed the proliferation of fraudulent schemes that can mislead investors, causing significant economic damage to those affected. The lack of adequate control mechanisms to detect and prevent the dissemination of illegal advertisements highlights a deficiency in due diligence on the part of X, which aggravates its liability.

On the other hand, the CNMV has emphasized the importance of transparency in financial communication, especially in a context where retail investors can be seriously harmed by misleading information. X’s failure to verify the legality of the products promoted through its platform infringed the investor protection principles set out in the LMV. In this sense, article 292 LMV establishes the obligation to supervise and guarantee that the investment services offered in advertising space comply with current regulations, a duty that X has not fulfilled.

In addition, X’s ignorance of controls has aided in the spread of misleading information, considered a breach of the principles of transparency and investor protection. This could also lead to eventual civil liability for damages to the affected users, who could claim that they relied on the information published on the platform to make investment decisions.

Relevance of the GDPR in the procedure

The misuse of images of public figures without their consent also violates the GDPR. According to article 6 GDPR, the processing of personal data is only lawful if it is based on a legitimate cause, such as the consent of the data subject or compliance with a legal obligation. In this case, X allowed the dissemination of advertisements that used images of actors without their authorization, which would be a violation of their rights over their image and personal data.

The absence of measures by X to curb the dissemination of those advertisements constitutes a serious breach of its obligations. This fact is especially relevant given that data controllers must guarantee the security and accuracy of the information they handle, as established in article 24 GDPR. X’s inactivity on the removal of content that violates fundamental rights fuels the seriousness of the infringement.

In addition, article 17 GDPR determines that the right to be forgotten or erasure allows data subjects to “obtain without undue delay from the data controller the deletion of personal data concerning them”. X’s failure to remove fraudulent advertisements may constitute a breach of the provision and aggravate its legal liability. The lack of control over deletion requests by those affected reinforces the violation of rights and could lead to large-scale administrative sanctions.

Possible sanctions

The LMV’s sanctioning regime imposes fines of up to €5 million for very serious infringements, in accordance with the file opened by the CNMV. This sanction could be aggravated if it is considered that X’s conduct has encouraged financial scams to the detriment of investors.

In addition, about data protection, article 83.4 GDPR provides for penalties that can reach up to 10 million euros or 4% of the global annual turnover of the infringing company, which could represent a considerable fine if non-compliance is confirmed considering the size of social network X.

The fact that the CNMV will have sanctioned X is a milestone in the supervision of the securities market, showing the need for greater control over digital platforms in terms of the advertising of financial products. In addition, the case insists on the importance of guaranteeing the protection of personal data, without unduly exploiting the image of third parties for commercial purposes.