IrelandDPC Guidance: AI, Large Language Models and Data Protection
Data Protection Commission, "AI, Large Language Models and Data Protection" guidance ()
Guidance, not a law: the Irish Data Protection Commission's reading of General Data Protection Regulation (GDPR), Comprehensive Regime. It binds nobody by itself; the law it reads does.
Guidance on a comprehensive regime rule, addressed to public and private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- guidance published by a regulator
- Obligation class
- Disclosure, Governance, DPIA
- Audit expectation
- none
What the regulator expects
- Establish a lawful basis before collecting or otherwise using personal data, including publicly accessible personal data, to train an AI model on people in Ireland, and account for the purpose the person originally made that data public for, not only whether it was public.NIST Privacy FrameworkCT.PO-P1
- Perform a data protection impact assessment before training or deploying an AI system on personal data of people in Ireland where the processing is new to you, combines data sets, or may involve minors or vulnerable people.NIST Privacy FrameworkID.RA-P4
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- MAP 5.1Likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented.
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
Data Protection Commission (An Coimisiún um Chosaint Sonraí), Ireland's supervisory authority under the GDPR and the Data Protection Act 2018.
Settledness
- As of
- Open questions
- What 'reasonable expectations' of the people who made their personal data publicly accessible must an AI developer account for when it assesses the necessity and proportionality of collecting that data to train a model?
What it makes you log
Logging duty
The Data Protection Commission's guidance asks an organization using or developing AI large language models to have appropriate personal data governance, design, policy and decision-making controls in place; it names no log or record to be created, kept or produced.
- Kind
- None
- As of
What this law does
The DPC's July 2024 guidance applies existing General Data Protection Regulation (GDPR) duties, a legal basis that covers the purposes of AI training, the rights of access, rectification and erasure, storage limitation, and data protection impact assessments for higher-risk processing, to the specific context of building and operating Large Language Models and other AI systems.
The guidance states directly that publicly accessible personal data still falls within the scope of the GDPR, and that a controller assessing necessity and proportionality for AI training must account for the purposes for which people made their personal data publicly accessible in the first place, not only for the fact of public accessibility.
This interprets Ireland's existing personal-data duties in an AI training context; it does not itself create a duty that attaches because a system is an AI system. The guidance does not itself distinguish a public-sector from a private-sector controller, but GDPR Article 4(7) defines a controller to include a public authority or body on the same footing as a natural or legal person, so the duties it applies to AI training bind either kind alike.
The DPC has since opened a formal inquiry into X Internet Unlimited Company's processing of EU/EEA users' publicly-accessible posts to train the Grok large language models (LLMs). It also engaged with Meta over its plans to train a generative AI model on public Facebook and Instagram content, leading Meta to pause and later revise the rollout.
And it has stated of LinkedIn's AI training that it has not approved or found compliant LinkedIn's use of members' personal data for that purpose, though LinkedIn's added measures have addressed its concerns enough that no further regulatory intervention is planned for now.
Back to the example · Lint your app
Page updated .