Ireland's DPC reports a 'significant' increase in AI-related engagements

Ireland's Data Protection Commission (DPC) has released the results of its AI Review, highlighting the need for robust transparency requirements and for clarification around AI training.

The report is based on the DPC's dealings with data controllers during the creation and deployment of around 180 AI products and services between 2021 and 2025. This meant assessing thousands of pages of briefings, risk assessments, technical and organizational measures, and compliance documentation in relation to AI.

Two areas of focus emerged, said the DPC: how organizations are invoking 'legitimate interests' as a legal basis for AI training, and the need for robust transparency measures.

In fact, 72% of decisions from the DPC Supervision Function have involved transparency issues - although in some cases, this was for reasons the controllers believed were legitimate.

"For example, AI that is intended to detect fraud or illegal activities could potentially be evaded by bad actors if they learn of the existence of the AI or if they can figure out how it works," said the DPC.

"The DPC has emphasised to controllers that no amount of post-processing transparency will relieve a controller of its obligations to provide transparency prior to processing under Articles 5, 12, 13, and 14 of the GDPR."

Transparency needs to relate to the individual; it said organizations shouldn't rely on transparency notices that are difficult to find, not directed to users, or that are intended for features that individuals don't actually engage with.

Another recurring issue is the legal basis for the processing of data. When, in May 2024, Meta announced its intention to begin training AI with the personal data of users, it claimed it had a legitimate interest under Article 6(1)(f) of the GDPR.

The DPC begged to differ and issued a set of recommendations, including filtering of data and de-identification prior to training, with which Meta ultimately complied.

In terms of emerging issues, the DPC said it's engaged with five separate controllers on their agentic AI launches in the EU.

But it said, "While the DPC has already issued recommendations on a number of Agentic AI engagements, the common themes across controllers were not yet clear at time of writing beyond a continuing lack of transparency and clarity on how the AI processes personal data, how the AI works and its potential impacts on users’ rights."

And while data protection law is important, it said, it's spotted cases where it's being used as a replacement for moral or ethical social norms in the use of AI, even in circumstances where it might not be the most appropriate regulation or law, such as the generation of non-consensual intimate or sexualized images.

The DPC has an unusual position amongst data protection authorities, thanks to the decision by many big tech firms to establish their headquarters in Ireland. As a result, it supervised the creation, training, and deployment of AI by companies including Airbnb, Apple, Deepseek, Google, LinkedIn, Meta, Microsoft, OpenAI, Pinterest, TikTok, X, and others.

"Key findings highlight that innovation and rigorous data protection are not mutually exclusive," it said. "Through a large number of engagements involving different AI, such as Large Language Models and recommender systems, the DPC Supervision Function has secured significant improvements in data protection compliance in the areas of lawful basis, transparency, data minimization, and the protection of children."