AI and GDPR: the DPC report

The report published by the Irish Data Protection Commission, discussed in a Matheson commentary published by Legal 500, states that AI-related supervisory engagements with large technology controllers increased tenfold between 2021 and 2025. The DPC reports that it considered the development, launch or deployment of about 180 AI products and services, including language models, recommender systems, facial recognition and AI agents.

According to the report, the supervision function is separate from the complaints and inquiry functions and does not certify GDPR compliance. It may nevertheless issue recommendations, request a voluntary pause in processing or, in urgent cases, use powers available under Ireland’s Data Protection Act 2018.

Recurring issues include transparency, legal basis, data minimisation, children’s data, the right to object and automated decision-making. The report states that legitimate interests may provide a legal basis for AI training only in certain circumstances and following an assessment of necessity, competing rights and data subjects’ reasonable expectations. It also stresses accessible objection mechanisms before processing begins, detailed documentation, post-launch reassessments and measures such as pseudonymisation, anonymisation and deduplication. These are observations about supervisory practice, not new legislation or general approval of the products considered. The article also reports that inquiries involving two international technology companies remain ongoing.