Ireland Data Protection & Privacy Regulation

Lawful Processing & Special Data

The Data Protection Commission's final decision of 21 September 2026 found that Google Ireland Limited infringed the GDPR in its processing of users' location data through the Web & App Activity, Location History and Location Accuracy features. The decision relied on several provisions of the GDPR, including Article 5, Article 6, Article 12 and Article 13, addressing the lawfulness and fairness of the processing, the lawful basis relied upon, and the transparency obligations owed to data subjects, for the period from 25 May 2018 to 4 February 2020. The Commission's own full published decision text, including its complete legal reasoning, was not independently retrieved this cycle; the Article references above are sourced from secondary legal commentary summarising the decision rather than from the Commission's own text directly.

The Commission's finding that Google infringed the GDPR by processing location data unlawfully and unfairly is a significant application of the Article 5 fairness and lawfulness principles and the Article 6 lawful-basis requirement to a major technology company's default data-collection features, rather than to a discrete, opt-in processing activity. The involvement of Article 12 and Article 13 findings additionally points to transparency deficiencies in how the relevant location-data features were presented to users during the covered period.

Outlook

The underlying lawful-processing findings remain subject to the fine's own confirmation process: the fine requires confirmation by the Irish High Court, and an appeal from Google is considered likely. Until that process concludes, the Article 5, 6, 12 and 13 findings described above stand as the Commission's own determination but are not yet settled as a final matter of Irish law. The six-month corrective compliance order, with compliance due 21 March 2027, creates a separate, more immediate timeline for Google to adjust the underlying processing practices regardless of how the confirmation and appeal process proceeds.

Lawful Processing & Special Data

The DPC's 21 September 2026 decision against Google Ireland Limited found infringements of GDPR Articles 5, 6, 12 and 13 in respect of the lawfulness, fairness and transparency of location-data processing carried out through Web & App Activity, Location History and Location Accuracy features. Article 5 sets out the core processing principles, Article 6 the lawful bases for processing, and Articles 12 and 13 the transparency obligations owed to data subjects at the point personal data is collected. The DPC's finding that these provisions were infringed concerns whether Google gave users an adequate legal basis and adequate transparency for processing their location data through these specific product features. The inquiry that produced this finding was opened in February 2020 and ran for approximately six and a half years before conclusion in September 2026, reflecting the scale and complexity of establishing infringement across multiple interlinked product features.

This finding sits within Ireland's broader enforcement context this cycle: the DPC's decision explicitly targets the lawful-basis and transparency dimensions of location processing, rather than, for example, a security or retention failure. The EUR403 million fine and accompanying six-month compliance order reflect a finding of substantive infringement on the lawfulness and transparency principles specifically.

Outlook

Whether Google intends to appeal the 21 September 2026 decision is understood from press reporting but has not been confirmed against a DPC or court filing this cycle. Any appeal would test the DPC's Article 5/6/12/13 findings on location-data lawfulness and transparency before the courts, and would be the clearest next signal for how durable this finding proves to be.

Controller/Processor Duties

The Data Protection Commission published a final decision, dated 1 October 2026, following an inquiry into Children's Health Ireland concerning Tallaght University Hospital. The decision found infringements of the security-of-processing principle set out at Article 5(1)(f) and of the security-of-processing obligation set out at Article 32(1). As a remediation measure, the Commission ordered completion of data protection impact assessments covering two specific processing activities: healthcare-record processing and confidential-waste management.

This is a tightening development for controller and processor accountability in Ireland. The decision concerns a public healthcare body's handling of sensitive health data, a category that attracts heightened scrutiny under the security-of-processing principle given the particular risk of harm from unauthorised access or disclosure. The confidential-waste management element of the order is notable in extending accountability obligations beyond active digital processing systems into the physical disposal of records, confirming that the Commission reads the security-of-processing obligation as covering the full lifecycle of personal-data handling, including destruction.

The ordering of a data protection impact assessment as a remedial measure, rather than solely a financial penalty, reflects the Commission's accountability-first approach for this decision: rather than closing the matter with a sanction alone, the Commission has required the controller to undertake a forward-looking structured risk assessment covering the specific processing activities found deficient. This places an ongoing documentation and process obligation on Children's Health Ireland that will need to be discharged and is, in principle, capable of independent verification.

Outlook

The practical question for subsequent cycles is whether and when Children's Health Ireland completes the ordered data protection impact assessments on healthcare-record processing and confidential-waste management, and whether the Commission takes any further supervisory step in relation to compliance with that order. No further controller/processor-duties development beyond this decision was identified this cycle, so the near-term signal in this module is defined by completion of this specific remediation order rather than by any additional or forecast development.

Controller/Processor Duties

Alongside the lawfulness and transparency findings, the DPC's 21 September 2026 decision against Google Ireland Limited found a distinct accountability-obligation infringement: a failure to demonstrate compliance with the lawfulness, fairness and transparency principle specifically in respect of Location Accuracy processing. This is an accountability finding under the GDPR's Article 5(2) accountability principle and related controller-obligation provisions, and it is analytically distinct from the substantive lawfulness findings addressed under lawful processing — this finding concerns Google's ability to demonstrate its compliance, not solely whether the underlying processing was lawful.

The accountability infringement was found specifically in relation to the Location Accuracy feature, narrower in scope than the lawfulness findings which spanned Web & App Activity, Location History and Location Accuracy together. This distinction indicates the DPC's inquiry examined each product feature separately for both substantive lawfulness and accountability compliance, rather than reaching a single undifferentiated finding across the product suite.

Outlook

The accountability finding, being narrower and feature-specific, may be a discrete point of appeal or compliance-order focus separate from the broader lawfulness findings; whether the six-month compliance order the DPC imposed addresses the accountability gap specifically for Location Accuracy will be a marker of how the corrective order is structured.

Controller/Processor Duties

Two active DPC matters this cycle bear directly on controller and processor security and breach-notification duties. First, the DPC adopted a final decision on 10 June 2026 following an inquiry into a ransomware attack on the laboratory information system at a Midlands Regional Hospital, citing infringements of Articles 5 (principles relating to processing), 28 (processor obligations), 30 (records of processing), 32 (security of processing) and 34 (communication of a personal data breach to the data subject) GDPR. This is a probable-confidence finding sourced from the DPC's own decisions register, and the breadth of articles cited — spanning core principles, processor governance, documentation, technical security, and breach communication — indicates a systemic security-failure finding rather than a narrow technical lapse.

Second, the DPC has commenced an inquiry following Permanent TSB's notification of a series of three data breaches relating to its Open 24 Contact Centre. This inquiry is understood to be ongoing, with no outcome yet determined this cycle; it is recorded here as an active development rather than a concluded enforcement matter.

Outlook

The Midlands Regional Hospital decision, now final, may generate follow-on guidance or precedent value for health-sector processors facing similar ransomware exposure. The Permanent TSB inquiry remains the item to watch: its outcome will indicate how the DPC treats a financial-sector processor facing a pattern of repeated breaches at a single contact-centre operation, rather than an isolated incident.

Cross-Border & Adequacy

The DPC's most consequential cross-border enforcement action this cycle is the High Court's upholding, on 30 June 2026, of a EUR 530 million administrative fine against TikTok. The DPC found infringements of Articles 46(1) (transfers subject to appropriate safeguards) and 13(1)(f) GDPR (information to be provided on transfers to third countries) concerning EEA user data being made accessible from China. This is described as the first such data-transfer fine issued by an EU Member State specifically concerning access arrangements involving China, and is a confirmed-tier finding carrying the highest materiality rating in this cycle's evidence set. A related DPC appeal was dismissed by the Supreme Court on 30 April 2026, removing one procedural obstacle to the fine's enforcement, though the ultimate outcome of TikTok's own response to the upheld fine and any associated suspension order remains pending.

Separately, on the standing transfer-mechanism-administration side, the DPC maintains an updated (January 2026) published list of approved Binding Corporate Rules for which it acts as lead supervisory authority — a lower-materiality, probable-confidence administrative fact reflecting Ireland's continuing role as lead supervisory authority for a substantial cohort of multinational BCR arrangements given the concentration of tech-sector EU headquarters in the jurisdiction.

Outlook

The TikTok matter's next milestone is the outcome of TikTok's appeal against the fine and any associated data-transfer suspension order, which remains pending. Given the DPC's demonstrated willingness to pursue and defend China-linked transfer enforcement through to High Court and Supreme Court levels, this matter is likely to remain the DPC's highest-profile cross-border case for the remainder of 2026.

Cross-Border & Adequacy

The DPC's €530 million fine against TikTok in 2025, over the transfer of EEA user data to China, is this cycle's clearest cross-border-transfer signal. The finding is confirmed with reasonable corroboration, though TikTok is appealing the decision and no primary DPC decision text was independently retrieved this cycle. The fine sits within an established DPC enforcement pattern requiring documented Transfer Impact Assessments for every cross-border transfer mechanism relied upon by controllers and processors under DPC jurisdiction: Standard Contractual Clauses alone are treated as insufficient without a documented analysis of the receiving country's legal framework, mirroring the reasoning previously applied in the Schrems II line of cases and the earlier Meta transfer fine. For controllers relying on SCCs for transfers into jurisdictions without an adequacy decision, the TikTok fine functions as a fresh, high-value illustration of the DPC's willingness to enforce this standard even against a major global platform.

Outlook

The TikTok appeal outcome is the marker to watch: if it narrows or overturns the underlying transfer-adequacy reasoning, that would be a material development for how the DPC's Transfer Impact Assessment expectations are applied going forward; if it is dismissed or the fine substantially upheld, it reinforces the current strict-scrutiny posture for transfers to jurisdictions like China.

Sectoral Watch

Two sectoral matters intersect with the DPC's broader enforcement activity this cycle. In the financial sector, the DPC has commenced an inquiry into Permanent TSB following the bank's notification of a series of three data breaches relating to its Open 24 Contact Centre — a probable-confidence, ongoing matter with no outcome yet determined. In the health sector, the DPC concluded, on 10 June 2026, a final decision following an inquiry into a ransomware attack on the laboratory information system at a Midlands Regional Hospital, citing infringements across Articles 5, 28, 30, 32 and 34 GDPR.

Taken together, these two matters show the DPC's sectoral enforcement reach extending into both financial-services contact-centre operations and health-sector laboratory information systems within the same cycle, indicating that sectoral breach exposure is not confined to any single industry vertical in Ireland's current enforcement environment. Both matters derive from the DPC's own decisions and guidance register, a Tier-1 primary source.

Outlook

The Permanent TSB inquiry is the sectoral matter with the least settled outcome and is the one most likely to generate a further material development in coming cycles, given it remains an open inquiry rather than a concluded decision.

AdTech & Commercial Privacy

The Data Protection Commission's decision against Google Ireland Limited, dated 21 September 2026, is the dominant development in this module this cycle. The Commission imposed a fine of EUR403 million following an inquiry into Google's processing of location data, finding infringements of GDPR Articles 5, 6, 12 and 13 in relation to processing carried out between 25 May 2018 and 4 February 2020. Google has been ordered into compliance within six months of the decision, a deadline falling on 21 March 2027. This decision, confirmed directly from the Commission's own published materials, materially tightens the standard the Commission applies to consent validity and transparency obligations for location-data processing in an advertising-adjacent commercial context, touching Articles governing lawfulness of processing, transparency and the information that must be provided to data subjects.

Separately, the Commission secured a criminal conviction against Brown Thomas Arnotts Limited on 7 September 2026, when the retailer pleaded guilty to five of twenty-one charges brought under Regulation 13 of the ePrivacy Regulations, S.I. No. 336/2011, for sending unlawful direct-marketing emails. The court applied the Probation of Offenders Act and ordered a EUR1,000 charitable donation together with EUR1,000 in costs. Regulation 13 requires a sender of direct-marketing electronic communications to hold the recipient's prior consent and to provide a valid means of opting out of further messages; the conviction confirms the Commission's continuing willingness to pursue criminal prosecution, rather than relying solely on administrative sanction, where direct-marketing consent and opt-out obligations are breached.

Taken together, the two outcomes show the Commission exercising its full available toolkit in the adtech and commercial-privacy space within a single enforcement window: a very large administrative fine for a multinational platform's location-data practices, and a criminal prosecution, albeit resulting in a modest financial penalty, against a domestic retailer's direct-marketing practices. Both outcomes confirm active supervisory attention to consent mechanics, whether for behavioural/location-based advertising infrastructure or for direct electronic marketing communications.

Outlook

Google's compliance deadline of 21 March 2027 is the principal date to track for this module; whether the required changes to location-data processing practices are confirmed as implemented by that date will depend on subsequent Commission statements. The Brown Thomas Arnotts conviction, notwithstanding its modest penalty, signals that other operators conducting direct-marketing email campaigns in Ireland should expect that criminal prosecution under the ePrivacy Regulations remains an active and used enforcement route, not a merely theoretical one, for consent and opt-out breaches.

Algorithmic, Biometric & Surveillance Governance

The Regulation of Artificial Intelligence Act 2026 establishes the AI Office of Ireland as the central coordinating authority for EU AI Act implementation, operating under a distributed model in which sectoral regulators act as market-surveillance authorities for their respective domains. The Act was signed into law on 21 July 2026, and the Office became operational from approximately 1 to 2 August 2026, timed to align with the AI Act's own general application date of 2 August 2026.

The distributed model means that algorithmic and AI-system oversight in Ireland is not concentrated in a single body but is instead coordinated centrally while enforcement responsibility sits with the sectoral regulator already responsible for the relevant domain. This is a structural choice about how AI oversight is organised in Ireland, distinct from the question of which substantive AI Act obligations apply and when.

Outlook

The distributed model's practical operation, specifically how the AI Office of Ireland coordinates with sectoral market-surveillance authorities on overlapping cases, is the detail most likely to clarify as the Office moves from establishment into operation.

Algorithmic, Biometric & Surveillance Governance

Many provisions of the EU AI Act become applicable from August 2026, with some high-risk AI requirements following on later transition dates. This is confirmed as a material EU-level development arriving within this cycle's window, converging with existing GDPR transparency and automated-decision-making obligations for controllers using AI systems in Ireland. No Irish-specific DPC enforcement action was identified alongside this development this cycle, and it is not yet confirmed whether the DPC has issued Ireland-specific coordination guidance for the August 2026 applicability date — that remains an evidentiary gap rather than an asserted absence.

Outlook

Watch for DPC guidance specifically addressing the AI Act/GDPR interface as the August 2026 applicability date approaches, and for the first enforcement actions or investigations that treat AI Act compliance and GDPR automated-decision-making obligations as a combined compliance question rather than two separate regimes.

Children & Vulnerable Groups

Coimisiun na Mean's Online Safety Code imposes specific obligations directed at protecting children online. Section 12.10 requires effective age assurance, stating explicitly that self-declaration alone is not considered effective. Section 14 requires parental controls to be made available where a service permits use by under-16s. Section 17.2 bans the commercial reuse of data collected for age-assurance purposes. Part A of the Code has applied from 19 November 2024, and Part B from 21 July 2025.

On 8 September 2026, Coimisiun na Mean opened its first formal investigation under the Online Safety Code, into the platform X. This is the first occasion on which the Commission has used its investigatory powers under the Code since those provisions took effect, and it marks the transition of the children's-safety framework from a set of standing obligations into one with an active enforcement record.

Outlook

As the first formal Code investigation, the outcome of the inquiry into X is likely to be read as an indication of how the Commission intends to apply the age-assurance and parental-control provisions in practice, and of what evidentiary standard it will require platforms to meet to demonstrate effective age assurance.

Enforcement & Redress

The Data Protection Commission's final decision of 21 September 2026 fined Google Ireland Limited EUR 403,000,000 for infringing GDPR Articles 5, 6, 12 and 13 in its processing of location data between 25 May 2018 and 4 February 2020, with the decision also imposing a six-month compliance order. Within the same period, the DPC concluded two further substantive matters in the health sector. Its decision on the Health Service Executive, dated 2 September 2026, fined the HSE EUR 645,000 in total over paper-record storage failures found to breach Article 5(1)(f) and Article 32(1), together with a separate Article 5(1)(e) finding. A subsequent decision concerning Children's Health Ireland, dated 1 October 2026, required completion of data protection impact assessments following security findings at Tallaght University Hospital.

Against this run of enforcement outcomes sits an active procedural challenge to the Commission's own adjudicative process. The Irish Supreme Court, on 13 October 2026, granted the DPC permission to appeal preliminary constitutional-process issues arising from LinkedIn's challenge to the DPC's EUR 310m fine, with LinkedIn also seeking a cross-appeal. That challenge goes to how the DPC's own decision-making procedure is constituted, rather than to the substance of the LinkedIn fine itself, and its resolution is still pending.

Outlook

The concurrence of a high-value Google decision, two health-sector decisions, and a live Supreme Court appeal concerning the DPC's own adjudicative process makes the coming period one in which both the substance of Irish enforcement and the procedural legitimacy of how that enforcement is reached are under active examination at the same time.

Enforcement & Redress

Three material enforcement outcomes fall within this cycle's window, together describing an active enforcement posture by the Data Protection Commission. The largest is the EUR403 million fine against Google Ireland Limited, dated 21 September 2026, following an inquiry into location-data processing that found infringements of GDPR Articles 5, 6, 12 and 13 for processing carried out between 25 May 2018 and 4 February 2020, with compliance ordered within six months, by 21 March 2027. The second is the Commission's final decision, dated 1 October 2026, against Children's Health Ireland concerning Tallaght University Hospital, finding infringements of Articles 5(1)(f) and 32(1) and ordering completion of data protection impact assessments on healthcare-record processing and confidential-waste management. The third is the criminal conviction, dated 7 September 2026, of Brown Thomas Arnotts Limited on five of twenty-one charges under Regulation 13 of the ePrivacy Regulations, resulting in a EUR1,000 charitable donation and EUR1,000 in costs under the Probation of Offenders Act.

The range of these three outcomes, from a nine-figure administrative fine against a multinational platform to a criminal prosecution carrying a four-figure financial consequence against a domestic retailer, illustrates the breadth of the Commission's enforcement toolkit operating concurrently within a single window. The Google and Children's Health Ireland decisions proceed through the Commission's own administrative inquiry and decision process, while the Brown Thomas Arnotts matter proceeded through the criminal courts, confirming that both routes remain live and actively used by the Commission depending on the nature of the underlying infringement.

Each decision also carries its own redress or remediation dimension distinct from the headline penalty: Google faces a defined six-month compliance deadline for its processing practices; Children's Health Ireland has been ordered to complete specific data protection impact assessments; and the Brown Thomas Arnotts prosecution, while resulting in a modest financial penalty under the Probation of Offenders Act, establishes a criminal-law precedent for direct-marketing consent breaches rather than concluding with a civil remedy alone.

Outlook

The compliance and remediation deadlines attached to the Google and Children's Health Ireland decisions, 21 March 2027 and the data protection impact assessment completion respectively, are the concrete dates and milestones to track in forthcoming cycles. The Commission's concurrent use of administrative fines, administrative compliance orders and criminal prosecution within this single enforcement window confirms that its enforcement and redress function in Ireland currently spans the full range of available mechanisms, a posture that is likely, on current evidence, to continue rather than to be an isolated feature of this cycle alone.

Enforcement & Redress

The Data Protection Commission imposed a EUR 403 million administrative fine on Google Ireland Limited on 21 September 2026, closing a six-year inquiry into the company's location-data processing practices and marking the Commission's first enforcement action against Google specifically. The decision carries a six-month corrective compliance order, with compliance due by 21 March 2027, and the fine itself requires confirmation by the Irish High Court before it becomes final; an appeal from Google is considered likely given the scale of the fine and the novelty of its application to this company.

This decision should be read against the Commission's standing position as Ireland's sole national independent supervisory authority under the GDPR and the Data Protection Act 2018, and its role as Lead Supervisory Authority for numerous multinational technology companies under the one-stop-shop mechanism. A January 2026 press report placed the Commission's cumulative GDPR fines since May 2018 at approximately EUR 4.04 billion, with eight of the ten largest GDPR fines ever issued attributed to the Commission; that aggregate figure pre-dates the Google fine and was not re-verified against the Commission's own statistics this cycle, so it should be read as held context rather than an updated total.

The scale of the Google fine, among the largest GDPR fines issued to date, and its position as the Commission's first action against Google specifically, both reinforce the structural picture of the Commission as the principal enforcement venue for GDPR questions affecting major technology companies within its one-stop-shop remit. The six-year span between the start of the infringement period and the final decision illustrates the structural length of complex, cross-border GDPR inquiries against companies of this scale.

Outlook

Two distinct and separately dated processes now run in parallel. The confirmation and likely appeal process, whose timeline is not yet fixed, determines whether the EUR 403 million figure and the underlying findings stand as a final matter of Irish law. Separately, and regardless of how that process proceeds, the six-month corrective compliance order sets 21 March 2027 as the date by which Google must bring its location-data processing practices into line with the Commission's findings. The Commission's cumulative fine total, last reported at approximately EUR 4.04 billion in January 2026, will rise once this fine is incorporated into a future tally, though that updated aggregate was not itself calculated this cycle.

Enforcement & Redress

September 2026 produced two material DPC fines within a single month, a pace of enforcement activity that stands out against the regime's usual cadence. On 2 September 2026, the DPC fined the Health Service Executive EUR645,000 following an inquiry into personal data contained in paper records stored externally across twelve HSE facilities, with the order combining the financial penalty with a reprimand and corrective orders. Nineteen days later, on 21 September 2026, the DPC fined Google Ireland Limited EUR403 million following a six-year inquiry into location-data processing, with a six-month compliance order attached.

The two decisions differ sharply in scale and subject matter — a domestic public health body's paper-records handling on one hand, and a multinational technology company's digital location-data processing architecture on the other — but their proximity in time is itself the material signal: it indicates the DPC's current enforcement output is not concentrated in any single sector or case type, and that multiple substantial inquiries were reaching conclusion within the same reporting window. The Google fine, in particular, followed an inquiry opened in February 2020, meaning its September 2026 conclusion reflects the closing of a multi-year investigation rather than a newly-initiated action.

Outlook

Whether Google intends to appeal the 21 September 2026 decision is understood from press reporting but has not been confirmed against a DPC or court filing this cycle; an appeal would be the clearest next-step development in that specific matter. More broadly, whether this cluster of two fines within a month represents a genuine step-change in DPC enforcement tempo, or the coincidental conclusion of two independently-timed inquiries, is a distinction that a further enforcement action within the next reporting period would help resolve.

Enforcement & Redress

Ireland's enforcement scale, viewed in aggregate, is the dominant fact of this cycle's data-protection picture. The DPC has issued EUR 4.04 billion in GDPR fines since May 2018 — a confirmed-tier finding — almost four times more than second-placed France, and including the largest single European GDPR fine of 2025, the EUR 530 million fine against TikTok. The DPC holds 8 of the top 10 GDPR fines ever issued anywhere in the EU, a further confirmed-tier finding underscoring the concentration of major GDPR enforcement activity in Ireland relative to every other Member State.

This aggregate enforcement picture sits alongside, and is substantially driven by, the two largest live matters tracked elsewhere in this cycle's brief: the upheld TikTok cross-border transfer fine and the pending Meta data-access-rights fine. Ireland's enforcement posture continues to intensify materially, with these two matters together representing the two largest live GDPR enforcement matters in the EU this cycle, a confirmed-confidence judgment reflecting the DPC's sustained trajectory as the bloc's dominant GDPR enforcer.

Outlook

The aggregate fine total will move further once the Meta fine is finally quantified and once any adjustment to the TikTok fine following its appeal process is resolved. Ireland's position as the EU's leading GDPR enforcer by fine volume is unlikely to be displaced in the near term given the concentration of major technology-platform EU headquarters within its jurisdiction.

Enforcement & Redress

The DPC's cumulative GDPR fine total since 2018 stands at approximately €4.04 billion, the largest of any EU supervisory authority, confirmed via secondary aggregation reporting drawing on the DLA Piper January 2026 Data Breach Survey. Set against that headline figure, only approximately €20 million — about 0.5 percent — has actually been collected, with the balance suspended, under appeal, or in litigation, including the €1.2 billion Meta fine and the €746 million Amazon fine. The Amazon fine was annulled on procedural grounds by the Luxembourg Administrative Court in March 2026, though most of the underlying substantive violations were confirmed notwithstanding that procedural annulment — an important distinction between a fine being vacated and the underlying finding being vindicated. This cycle's most significant new enforcement data point is the €530 million TikTok fine issued in 2025 over EEA-to-China data transfers, now under appeal, which is confirmed via corroborated secondary reporting though no primary DPC decision text was independently retrieved.

Outlook

The persistently low fine-collection rate means headline enforcement totals should be read with caution when assessing near-term realised regulatory pressure; the TikTok appeal and the broader pattern of Meta- and Amazon-scale fines facing years of litigation both suggest that the practical deterrent effect of DPC enforcement lags materially behind its nominal scale.