#
Profiling restrictions and state-surveillance carve-outs are evidenced; ADM transparency, biometric regime and genetic data sub-modules lack directly retrieved DPC-specific sourcing.
Sub-modules (6)
Profiling RestrictionsAmber
The Meta decision's invalidation of the 'contract' legal basis for behavioural advertising constrains profiling-based ad personalisation absent valid consent.
Claims (1):
- The DPC's finding that Meta's 'contract' legal basis was invalid for behavioural-advertising profiling activities constrains how controllers may justify profiling-based ad personalisation absent valid consent.
Automated Decision Making TransparencyRed
No DPC-specific Article 22 ADM-transparency guidance or decision was retrieved in this pass.
Absence provenance: unavailable. Searched: unavailable.
Ai Risk AssessmentsAmber
The DPC's 2024 Annual Report highlights its evolving role under the EU AI Act, reflecting growing overlap between GDPR enforcement and AI governance obligations.
Claims (1):
- The DPC's 2024 Annual Report highlights its evolving role under the EU Artificial Intelligence Act and other digital laws, reflecting growing overlap between GDPR enforcement and AI governance obligations.
Biometric RegimeRed
No DPC-specific biometric-regime (facial recognition, fingerprint, gait) guidance or enforcement was retrieved in this pass.
Absence provenance: unavailable. Searched: unavailable.
Genetic DataRed
No DPC-specific genetic-data guidance or enforcement was retrieved in this pass.
Absence provenance: unavailable. Searched: unavailable.
State Surveillance CarveoutsAmber
The Data Protection Act 2018 preserved national-security, defence and international-relations processing carve-outs from the pre-2018 Acts, exempting these from its general repeal.
Claims (1):
- The Data Protection Act 2018 preserved provisions of the repealed 1988/2003 Acts specifically relating to processing of personal data for national security, defence, and international relations purposes, carving these out from the Act's general repeal.
Algorithmic, Biometric & Surveillance Governance
The Regulation of Artificial Intelligence Act 2026 establishes the AI Office of Ireland as the central coordinating authority for EU AI Act implementation, operating under a distributed model in which sectoral regulators act as market-surveillance authorities for their respective domains. The Act was signed into law on 21 July 2026, and the Office became operational from approximately 1 to 2 August 2026, timed to align with the AI Act's own general application date of 2 August 2026.
The distributed model means that algorithmic and AI-system oversight in Ireland is not concentrated in a single body but is instead coordinated centrally while enforcement responsibility sits with the sectoral regulator already responsible for the relevant domain. This is a structural choice about how AI oversight is organised in Ireland, distinct from the question of which substantive AI Act obligations apply and when.
Outlook
The distributed model's practical operation, specifically how the AI Office of Ireland coordinates with sectoral market-surveillance authorities on overlapping cases, is the detail most likely to clarify as the Office moves from establishment into operation.
1 earlier distinct update(s)
Algorithmic, Biometric & Surveillance Governance
Many provisions of the EU AI Act become applicable from August 2026, with some high-risk AI requirements following on later transition dates. This is confirmed as a material EU-level development arriving within this cycle's window, converging with existing GDPR transparency and automated-decision-making obligations for controllers using AI systems in Ireland. No Irish-specific DPC enforcement action was identified alongside this development this cycle, and it is not yet confirmed whether the DPC has issued Ireland-specific coordination guidance for the August 2026 applicability date — that remains an evidentiary gap rather than an asserted absence.
Outlook
Watch for DPC guidance specifically addressing the AI Act/GDPR interface as the August 2026 applicability date approaches, and for the first enforcement actions or investigations that treat AI Act compliance and GDPR automated-decision-making obligations as a combined compliance question rather than two separate regimes.
Sources and claims (3)
- ProbableIAPP — The DPC's finding that Meta's 'contract' legal basis was invalid for behavioural-advertising profiling activities constrains how controllers may justify profiling-based ad personalisation absent valid consent.observed
- ProbableIAPP — The DPC's 2024 Annual Report highlights its evolving role under the EU Artificial Intelligence Act and other digital laws, reflecting growing overlap between GDPR enforcement and AI governance obligations.observed
- ProbableDataGuidance / OneTrust — The Data Protection Act 2018 preserved provisions of the repealed 1988/2003 Acts specifically relating to processing of personal data for national security, defence, and international relations purposes, carving these out from the Act's general repeal.observed