Irish DPC publishes report on AI insights
The Irish Data Protection Commission (DPC) has published a report on its supervision of artificial intelligence products and services between 2021 and 2025. The report, titled Responsible Artificial Intelligence Innovation: Insights from the Data Protection Commission’s Supervision of AI (2021–2025), reflects the DPC’s role as the lead supervisory authority for many major technology companies with European headquarters in Ireland.
The report records a significant increase in the DPC’s engagement with AI-related processing. This growth was partly driven by the rapid expansion of generative AI. The DPC’s work covered different types of AI systems, including large language models and recommender systems. Through these engagements, the regulator sought to ensure that innovation remained consistent with the fundamental rights protected by the GDPR.
Several recurring compliance issues emerged from the DPC’s supervisory activities. These included the selection of an appropriate lawful basis, clear and meaningful transparency information, data minimization, and safeguards for children. The report also emphasizes that AI developers and providers must explain complex and sometimes opaque processing operations in a way that individuals can understand.
The use of legitimate interests as a lawful basis for training AI systems is identified as a particularly important area. Organizations relying on this basis must assess whether their interests are lawful, clearly defined, and necessary, and whether they are overridden by the rights and freedoms of individuals. A documented balancing assessment, appropriate safeguards, and consideration of reasonable expectations are essential parts of this analysis.
The DPC also highlights the importance of early regulatory engagement. Most of the AI-related engagements described in the report resulted in recommendations rather than formal enforcement action. However, the DPC confirms that it is prepared to intervene urgently where risks to individuals are not adequately addressed. This demonstrates that cooperation with regulators does not remove the need for strong accountability and effective risk management.
For organizations developing or deploying AI, the report provides practical guidance. They should assess data protection risks at an early stage, limit the data used for training and operation, provide accessible privacy information, protect children, and maintain records demonstrating compliance. The report’s central message is that responsible AI development and data protection can support each other when privacy requirements are built into the design and governance of AI systems.
