Law note · Ireland
DPC Guidance: AI, Large Language Models and Data Protection
The DPC's July 2024 guidance applies Ireland's existing General Data Protection Regulation (GDPR) and Data Protection Act 2018 duties, lawful basis before collecting personal data for AI training, data minimization, honoring access, rectification and erasure requests where feasible against a trained model, and data protection impact assessments for higher-risk processing, to the specific context of building and operating Large Language Models and other AI systems.
The guidance states directly that publicly accessible personal data still falls within the scope of the GDPR, and that a controller assessing necessity and proportionality for AI training must account for the purposes for which people made their personal data publicly accessible in the first place, not only for the fact of public accessibility.
This interprets Ireland's existing personal-data duties in an AI training context; it does not itself create a duty that attaches because a system is an AI system, and it is filed here rather than as `ai` topic content on that basis. The DPC has backed this guidance with active investigations into Twitter/X's use of EU personal data to train Grok and scrutiny of Meta's and LinkedIn's AI training practices.
What it asks of an app
- Establish a lawful basis before collecting or otherwise using personal data, including publicly accessible personal data, to train an AI model on people in Ireland, and account for the purpose the person originally made that data public for, not only whether it was public.
- Perform a data protection impact assessment before training or deploying an AI system on personal data of people in Ireland where the processing is new to you, combines data sets, or may involve minors or vulnerable people.
When LexLint raises it
Declared activities: crawls_web, trains_models, generates_content, deploys_chatbot, automated_outreach, high_risk_decisions, processes_voice, processes_biometrics
Primary source: Data Protection Commission guidance page, dataprotection.ie