--- title: "Ireland — Algorithmic, Biometric & Surveillance Governance | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/ireland/algorithmic-biometric-and-surveillance-governance/ source_html: /jurisdictions/ireland/algorithmic-biometric-and-surveillance-governance/index.html description: "Ireland — Algorithmic, Biometric & Surveillance Governance: algorithmic_biometric_and_surveillance_governance Algorithmic, Biometric & Surveillance Governance 6 sub-modules 3 claims Amber ▾ # Profiling restrictions and state-surveillance ca" generated_at: 2026-10-25T04:46:50Z content_sha256: c35bbc3a5d74c5d5f6095effdd110d0a29dc6cfc4c5d217fa36a2ea2832fea36 generator: "fe-fleet/md-twin@1.0" --- # Ireland — Algorithmic, Biometric & Surveillance Governance | Data Protection Monitor ### D8Algorithmic, Biometric & Surveillance Governance6 sub-modules3 claimsAmber▾# Profiling restrictions and state-surveillance carve-outs are evidenced; ADM transparency, biometric regime and genetic data sub-modules lack directly retrieved DPC-specific sourcing. Primary framework GDPR Article 22 + EU AI Act (Regulation (EU) 2024/1689) Supervisory authority [Data Protection Commission (DPC)](https://www.dataprotection.ie/) Traffic-light rationale — Amber Profiling restrictions and state-surveillance carve-outs are evidenced; ADM transparency, biometric regime and genetic data sub-modules lack directly retrieved DPC-specific sourcing. #### Sub-modules (6) #### Profiling RestrictionsAmber The Meta decision's invalidation of the 'contract' legal basis for behavioural advertising constrains profiling-based ad personalisation absent valid consent. Claims (1): - The DPC's finding that Meta's 'contract' legal basis was invalid for behavioural-advertising profiling activities constrains how controllers may justify profiling-based ad personalisation absent valid consent. #### Automated Decision Making TransparencyRed No DPC-specific Article 22 ADM-transparency guidance or decision was retrieved in this pass. Absence provenance: unavailable . Searched: unavailable . #### Ai Risk AssessmentsAmber The DPC's 2024 Annual Report highlights its evolving role under the EU AI Act, reflecting growing overlap between GDPR enforcement and AI governance obligations. Claims (1): - The DPC's 2024 Annual Report highlights its evolving role under the EU Artificial Intelligence Act and other digital laws, reflecting growing overlap between GDPR enforcement and AI governance obligations. #### Biometric RegimeRed No DPC-specific biometric-regime (facial recognition, fingerprint, gait) guidance or enforcement was retrieved in this pass. Absence provenance: unavailable . Searched: unavailable . #### Genetic DataRed No DPC-specific genetic-data guidance or enforcement was retrieved in this pass. Absence provenance: unavailable . Searched: unavailable . #### State Surveillance CarveoutsAmber The Data Protection Act 2018 preserved national-security, defence and international-relations processing carve-outs from the pre-2018 Acts, exempting these from its general repeal. Claims (1): - The Data Protection Act 2018 preserved provisions of the repealed 1988/2003 Acts specifically relating to processing of personal data for national security, defence, and international relations purposes, carving these out from the Act's general repeal. Category narrative 47 words Ireland's DPC increasingly interfaces with the EU AI Act (Regulation (EU) 2024/1689) alongside its GDPR profiling/ADM remit; the Meta contract-legal-basis decision constrains profiling-based advertising. National-security/defence carve-outs preserved from pre-GDPR law remain the operative state-surveillance carve-out. Biometric-regime, genetic-data and ADM-transparency-specific DPC sourcing was not retrieved in this pass. Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance The Regulation of Artificial Intelligence Act 2026 establishes the AI Office of Ireland as the central coordinating authority for EU AI Act implementation, operating under a distributed model in which sectoral regulators act as market-surveillance authorities for their respective domains. The Act was signed into law on 21 July 2026, and the Office became operational from approximately 1 to 2 August 2026, timed to align with the AI Act's own general application date of 2 August 2026. The distributed model means that algorithmic and AI-system oversight in Ireland is not concentrated in a single body but is instead coordinated centrally while enforcement responsibility sits with the sectoral regulator already responsible for the relevant domain. This is a structural choice about how AI oversight is organised in Ireland, distinct from the question of which substantive AI Act obligations apply and when. #### Outlook The distributed model's practical operation, specifically how the AI Office of Ireland coordinates with sectoral market-surveillance authorities on overlapping cases, is the detail most likely to clarify as the Office moves from establishment into operation. 1 earlier distinct update(s) Periodic update · new data 2026-09-05 #### Algorithmic, Biometric & Surveillance Governance Many provisions of the EU AI Act become applicable from August 2026, with some high-risk AI requirements following on later transition dates. This is confirmed as a material EU-level development arriving within this cycle's window, converging with existing GDPR transparency and automated-decision-making obligations for controllers using AI systems in Ireland. No Irish-specific DPC enforcement action was identified alongside this development this cycle, and it is not yet confirmed whether the DPC has issued Ireland-specific coordination guidance for the August 2026 applicability date — that remains an evidentiary gap rather than an asserted absence. #### Outlook Watch for DPC guidance specifically addressing the AI Act/GDPR interface as the August 2026 applicability date approaches, and for the first enforcement actions or investigations that treat AI Act compliance and GDPR automated-decision-making obligations as a combined compliance question rather than two separate regimes. Evidence 3 Sources and claims (3) - Probable[IAPP](https://iapp.org/news/a/irish-dpc-fines-meta-390m-euros-over-legal-basis-for-personalized-ads) — The DPC's finding that Meta's 'contract' legal basis was invalid for behavioural-advertising profiling activities constrains how controllers may justify profiling-based ad personalisation absent valid consent.observed 2026-07-29 - Probable[IAPP](https://iapp.org/news/a/key-takeaways-from-ireland-s-dpc-annual-report) — The DPC's 2024 Annual Report highlights its evolving role under the EU Artificial Intelligence Act and other digital laws, reflecting growing overlap between GDPR enforcement and AI governance obligations.observed 2026-07-29 - Probable[DataGuidance / OneTrust](https://legacy.dataguidance.com/jurisdiction/ireland) — The Data Protection Act 2018 preserved provisions of the repealed 1988/2003 Acts specifically relating to processing of personal data for national security, defence, and international relations purposes, carving these out from the Act's general repeal.observed 2026-07-29