The Data Protection Commission (“DPC”) has published a report setting out insights from its oversight of artificial intelligence products and services between 2021 and 2025. The DPC, via its Technology Multinational Supervision Unit, is tasked with a supervisory role, responsible for regulating rapidly developing technologies, including generative Artificial Intelligence technologies. The DPC’s report reflects the significant growth in controllers’ engagement in AI regulatory compliance.

The report highlights a number of key takeaways, but the central message from the DPC is that AI innovation and rigorous data protection compliance are not mutually exclusive. The DPC’s supervisory role involving technologies including large language models and recommender systems has resulted in improvements across key areas including lawful basis for processing personal data, transparency, data minimisation (that is, only data which is adequate, relevant and limited to what is necessary for a specific purpose is collected, processed and stored) and the protection of children.

The report identifies a number of practical considerations for controllers developing or deploying AI systems. Legitimate interests is a particular area of focus where personal data is used to train AI models. The onus is on data controllers to carry out an exercise of balancing interests and consider an individual’s reasonable expectations as to how their personal data will be processed.

The report also stresses the importance of transparency given the novel and often complex nature of AI processing. Controllers must inform data subjects when and how their personal data will be used, before processing begins, and should consider implementing measures to de-identify, pseudonymise or anonymise datasets for AI training. The report also emphasises the need for particular care where children’s data is involved.

The DPC has emphasised that data protection assessments should not be treated as one-off exercises. Data protection impact assessments and other risk assessments should be revisited as AI systems develop and following deployment.

Some of the key takeaways from the report are summarised below:

• Early engagement with the DPC can help ensure that foundational design choices meet GDPR standards in developing new systems and products that utilise AI processing
• Where the DPC considers there to be a real risk of harm to the rights and freedoms of individuals, it can and will act to prevent this
• Controllers developing new AI systems should consider implementing measures to de-identify, pseudonymise or anonymise datasets used for the training of the AI system, and the training of a new AI model will likely require a Data Protection Impact Assessment
• Data protection assessments should be treated as an ongoing concern, and compliance does not end with a feature or product launch. The DPC will continue to monitor compliance after products are launched and shall have powers to act if it suspects an infringement has arisen
• New technologies may require additional transparency in relation to the use of the technology. Controllers have a duty to explain that processing of personal data is occurring and explain the associated data protection risks. This is particularly so in relation to processing by AI and LLMs where new technology is concerned. All transparency information should be GDPR compliant and accessible for individuals
• In relation to the use of historical datasets, the DPC considers there is a heightened need for enhanced transparency, as data subjects are unlikely to have expected that their data would be used for the training of AI
• Opt-out provisions should be user-friendly and clear, and should include transparency and notice for data subjects.

While most supervisory engagements resulted in recommendations, the report makes clear that the DPC is prepared to intervene urgently where risks to individuals’ rights have not been adequately mitigated. Ultimately, the report presents early regulatory engagement, robust documentation and ongoing risk assessment as key components of responsible AI development.

For further resoucrses, please click here.