So now we know why this took so long. A angle of attack that's completely new.

"These concerns relate to whether personal data has been processed lawfully, fairly and transparently, and whether appropriate safeguards were built into Grok’s design and deployment to prevent the generation of harmful manipulated images using personal data."

(My italics.)

This regulator's definition:

Personal data is ... any and all information that identifies you as a data subject.

A data subject is someone who can be identified from personal data.

Yes, really.