IRELAND

Moderate Guidance Published Ireland · Sep 28, 2026

Data Protection Commission releases AI Insights Report covering 2021‑2025 supervision

The Irish Data Protection Commission published a report on its supervision of AI products and services from 2021 to 2025, noting a rise in AI engagements and improvements in lawful basis, transparency and data‑minimisation. The report…

Data Protection Commission

High Fine Decided Ireland · Sep 23, 2026 · effective Sep 21, 2026

Irish Data Protection Commission fines Google €403 million for GDPR violations over location data

The Irish Data Protection Commission issued its final decision on 21 September 2026, imposing administrative fines of €403 million on Google Ireland Limited. The DPC found infringements of GDPR principles relating to lawfulness, fairness…

Irish Data Protection Commission · General Data Protection Regulation

Moderate Enforcement Decided Ireland · Sep 7, 2026

Irish DPC welcomes court conviction of Brown Thomas for ePrivacy breaches

The Dublin Metropolitan District Court convicted Brown Thomas Arnotts Limited on 7 September 2026 for multiple breaches of Regulation 13 of the ePrivacy Regulations. The company pleaded guilty to five sample charges, including failures to…

Data Protection Commission · ePrivacy Directive

High Enforcement Decided Ireland · Sep 3, 2026 · effective Aug 28, 2026

Data Protection Commission issues €645,000 fine and compliance orders against HSE

The Irish Data Protection Commission issued a final decision on 28 August 2026 concerning the Health Service Executive's handling of paper medical records. The DPC found physical security and integrity failures at external storage…

Data Protection Commission · General Data Protection Regulation

Moderate Data protection authority action Announced Ireland · Sep 18, 2025

Former Meta lobbyist Niamh Sweeney appointed Irish DPC commissioner

Niamh Sweeney, a former senior Meta lobbyist, is set to join the Irish Data Protection Commission (DPC) as a commissioner in October. The DPC is the EU lead privacy regulator for major US tech firms. The appointment raises concerns about…

Irish Data Protection Commission · General Data Protection Regulation

Moderate Data protection authority action Decided Ireland · Jul 16, 2025

DPC issues final decision reprimanding Children’s Health Ireland for GDPR security breaches

The Irish Data Protection Commission concluded that Children’s Health Ireland (CHI) at Tallaght University Hospital breached GDPR security and confidentiality obligations. CHI was reprimanded and ordered to bring its processing into…

Data Protection Commission (Ireland) · General Data Protection Regulation

Low Enforcement Announced Ireland · May 14, 2025

noyb sends cease and desist letter to Meta over AI training using EU personal data

noyb has issued a cease and desist letter to Meta, alleging that the company will use EU personal data from Instagram and Facebook for AI training without opt‑in consent. The letter relies on the EU Collective Redress Directive, which…

EDPB · General Data Protection Regulation

Moderate Court ruling Decided Ireland · Jan 29, 2025

EU General Court rules Irish DPC acted unlawfully for refusing to investigate noyb complaint

The EU General Court held that the Irish Data Protection Commission unlawfully refused to investigate a complaint filed by noyb. The court dismissed the DPC's claims against the European Data Protection Board. The case can now be appealed…

Irish Data Protection Commission · General Data Protection Regulation

Low Enforcement Pending Ireland · Nov 12, 2024

Meta proposes "less personalized" ads that use location and age without consent, sparking GDPR enforcement concerns

Meta announced a new ad option that will still use personal data such as location and date of birth without obtaining consent, which noyb says violates the GDPR. The organization has filed pending litigation against Meta for this and…

Irish Data Protection Commission · General Data Protection Regulation

Low Enforcement Announced Ireland · Jun 14, 2024 · effective Jun 14, 2024

Meta pauses AI training on EU/EEA user data after DPC intervention

The Irish Data Protection Commission announced that Meta has committed to stop processing EU/EEA user data for undefined AI techniques following 11 noyb complaints. Meta had previously relied on a "legitimate interest" argument. The…

Data Protection Commission (DPC) · General Data Protection Regulation

High Fine In effect Ireland · May 24, 2024 · effective Aug 25, 2026

Irish Data Protection Commission fines HSE €645,000 for GDPR breaches over paper record storage

The Data Protection Commission (DPC) issued a final decision on 25 August 2026, fining the Health Service Executive (HSE) €645,000 for multiple GDPR infringements related to the storage and security of paper medical records. The DPC also…

Data Protection Commission (Ireland) · General Data Protection Regulation

Moderate Amendment Passed Ireland · Jun 28, 2023

Ireland passes amendment to Data Protection Act allowing DPC to declare GDPR cases confidential

The Irish government has passed an amendment to the Data Protection Act, creating Section 26A which permits the Data Protection Commission to declare documents relating to pending GDPR procedures confidential and criminalise their…

Irish Data Protection Commission (DPC) · General Data Protection Regulation

Moderate Amendment Pending Ireland · Jun 26, 2023

Irish government adds Section 26A to Data Protection Act, criminalising reporting on DPC procedures

A last‑minute amendment (Section 26A) was inserted into the Courts and Civil Law (Miscellaneous Provisions) Bill 2022, allowing the Irish Data Protection Commissioner to declare most of its procedures confidential. The amendment would make…

Irish Data Protection Commissioner (DPC) · General Data Protection Regulation

Moderate Amendment Proposed Ireland · Jun 26, 2023

Irish Parliament debates amendment to criminalise reporting on DPC procedures

A last‑minute amendment (Section 26A) was added to the Courts and Civil Law (Miscellaneous Provisions) Bill 2022 that would allow the Irish Data Protection Commissioner to declare its procedures confidential and make reporting on them a…

Irish Data Protection Commissioner · General Data Protection Regulation

Moderate Fine Announced Ireland · May 22, 2023

Irish DPC imposes €1.2 billion fine on Meta for EU‑US data transfers

The Irish Data Protection Commission, backed by the European Data Protection Board, ordered Meta to cease all transfers of European personal data to the United States and to return data already transferred to EU data centres. The decision…

Irish Data Protection Commission · Standard Contractual Clauses

Moderate Fine Announced Ireland · Jan 27, 2023

Irish DPC announces €390 million fine on Meta for GDPR consent breach

The Irish Data Protection Commission announced a €390 million fine against Meta, ordering it to obtain valid consent for personalized advertising after the European Data Protection Board issued a binding decision. The fine illustrates…

Irish Data Protection Commission · General Data Protection Regulation

Moderate Enforcement Published Ireland · Jan 11, 2023

Irish DPC fines Meta €60m for unlawful processing and €150m for transparency breaches

The Irish Data Protection Commission (DPC) issued a final decision imposing a €150 million fine on Facebook for transparency failures and a €60 million fine on Meta for lacking a legal basis to process personal data. The decision also…

Irish Data Protection Commission · General Data Protection Regulation

Moderate Fine In effect Ireland · Jan 4, 2023 · effective Jan 4, 2023

EU data protection board fines Meta €390 million and bans personalized ads

The European Data Protection Board, following the Irish Data Protection Commission, ruled that Meta's use of personal data for personalized advertising violated the GDPR and imposed a €390 million fine. Meta must obtain opt‑in consent and…

European Data Protection Board · General Data Protection Regulation

Moderate Data protection authority action Published Ireland · Jul 7, 2022

Irish DPC issues Draft Decision on Facebook EU-US data transfers, starts one-month comment period

The Irish Data Protection Commission issued a Draft Decision under Article 60 GDPR concerning Meta's Facebook EU‑US data transfers. The draft triggers a one‑month comment period for other European DPAs and does not immediately halt the…

Irish Data Protection Commission · General Data Protection Regulation

Moderate Settlement Settled Ireland · Apr 28, 2022 · effective Apr 28, 2022

Irish DPC to pay tens of thousands in costs to noyb over 47‑month delay in WhatsApp and Instagram GDPR cases

The Irish Data Protection Commission settled with privacy group noyb, agreeing to cover tens of thousands of euros in legal costs after a 47‑month delay in drafting decisions on WhatsApp and Instagram cases. The delay contravenes GDPR…

Irish Data Protection Commission (DPC) · General Data Protection Regulation

Low Enforcement Pending Ireland · Dec 19, 2021

Facebook ignores EU Court rulings on data transfers, Irish DPC enforcement pending

noyb reports that Facebook's 86‑page Transfer Impact Assessment disregards the CJEU Schrems I and II rulings that require EU‑US data transfers to stop. The Irish Data Protection Commission has not yet issued a decision despite a complaint…

Irish Data Protection Commission · General Data Protection Regulation

Low Enforcement Announced Ireland · Dec 12, 2021

Irish DPC sends threat letters to noyb over Facebook ROPA publication

noyb published Facebook's four‑page Record of Processing Activities (ROPA) required by Article 30 GDPR. The Irish Data Protection Commission, which received the ROPA on 27.9.2018, sent angry letters to noyb demanding the removal of the…

Irish Data Protection Commission · General Data Protection Regulation

Moderate Guidance Published Ireland · Dec 4, 2021

Irish DPC tried to embed Facebook consent bypass into EDPB Guidelines, but final 2019 guidelines omitted it

A letter shows the Irish DPC held ten meetings with Facebook and agreed on a GDPR bypass by moving consent into terms and conditions. The DPC then drafted EDPB guideline language to allow this approach, but other DPAs criticised it…

Irish Data Protection Commission (DPC) · General Data Protection Regulation

Low Enforcement In effect Ireland · Nov 23, 2021 · effective Nov 18, 2021

Irish DPC removes noyb from GDPR procedure after demanding NDA

The Irish Data Protection Commission (DPC) demanded that privacy activist group noyb sign a non‑disclosure agreement to continue hearing its complaint against Facebook. After noyb refused, the DPC removed the organization from the GDPR…

Irish Data Protection Commission · General Data Protection Regulation

Moderate Enforcement Announced Ireland · Oct 15, 2021

Irish DPC orders noyb to remove draft decision from website

The Irish Data Protection Commission sent a take‑down request to privacy activist group noyb on 14 Oct 2021, ordering removal of a draft decision that allegedly strips Facebook users of GDPR rights. noyb refused, citing Austrian law and…

Irish Data Protection Commission · General Data Protection Regulation

Moderate Fine Announced Ireland · Sep 2, 2021

Irish DPC issues €225 million fine against WhatsApp

The Irish Data Protection Commission imposed a €225 million fine on WhatsApp (owned by Facebook) under the GDPR. The fine was increased from an initial €50 million after pressure from other EU data protection authorities. Max Schrems of…

Irish Data Protection Commission · General Data Protection Regulation

Low Enforcement Announced Ireland · May 21, 2021

European Parliament urges Commission to launch infringement proceedings against Ireland over GDPR enforcement

The European Parliament adopted a resolution calling on the European Commission to start infringement procedures against Ireland due to delays by the Irish Data Protection Commission in handling GDPR complaints. The resolution noted that…

European Commission · General Data Protection Regulation

Low Court ruling Decided Ireland · May 13, 2021

Irish High Court orders DPC to halt Facebook EU‑US data transfers

The Irish High Court ruled that the Irish Data Protection Commission must implement the CJEU judgment and stop Facebook's transfers of personal data from the EU to the United States. The court dismissed all reliefs sought by Facebook…

Irish Data Protection Commission · Schrems II judgment

Low Interpretation Announced Ireland · Apr 27, 2021

Irish DPC admits it does not decide GDPR complaints, handling 99.93% without decision

The Irish Data Protection Commissioner publicly stated that it does not issue decisions on GDPR complaints, with 99.93% of cases remaining without a decision. The DPC argued there is no obligation under the 2018 Act to produce a decision…

Irish Data Protection Commissioner (DPC) · General Data Protection Regulation

Low Enforcement Announced Ireland · Mar 18, 2021

Irish DPC cancels scheduled EU‑US data‑transfer hearing with European Parliament

Irish Data Protection Commission head Helen Dixon cancelled her participation in a European Parliament LIBE Committee hearing scheduled for 18 March 2021 after demanding to be heard alone. The hearing was intended to discuss EU‑US data…

Irish Data Protection Commission (DPC) · General Data Protection Regulation

Low Settlement Settled Ireland · Jan 13, 2021

Irish DPC settles judicial review, pledges swift decision on Facebook EU‑US data transfers

The Irish Data Protection Commission (DPC) settled a judicial review with Max Schrems and agreed to decide quickly on Facebook's EU‑US data flows. The settlement allows Schrems to be heard in the DPC's own‑volition procedure and to access…

Irish Data Protection Commission · General Data Protection Regulation

Low Court ruling Decided Ireland · Oct 29, 2020

Irish High Court orders DPC to cover most of Max Schrems' legal costs in EU‑US data transfer case

The Irish High Court ruled that the Irish Data Protection Commission must pay the legal costs of Max Schrems in his EU‑US data‑transfer case, except for three days of hearing costs which Facebook must cover. The decision follows a series…

Irish Data Protection Commission

Moderate Court ruling Decided Ireland · Oct 12, 2020

Irish High Court grants judicial review to stop Facebook EU-US data transfers

The Irish High Court granted leave for a judicial review filed by privacy group noyb against the Irish Data Protection Commission (DPC) to compel a decision on Facebook's EU‑US data transfers. The action seeks to enforce the European Court…

Irish Data Protection Commission · Standard Contractual Clauses

Moderate Court ruling Announced Ireland · Sep 14, 2020

Irish High Court grants Facebook leave to file Judicial Review, stays DPC EU‑US data‑flow investigation

The Irish High Court granted Facebook leave to bring a Judicial Review (Case No 2020/617 JR) and ordered a stay of the Data Protection Commission's ex officio investigation into Facebook's EU‑US data transfers. The DPC may resume the…

Data Protection Commission (DPC) · Standard Contractual Clauses

Low Enforcement Pending Ireland · Jul 28, 2020 · deadline Jul 31, 2020

Irish DPC provides no clear timeline for enforcing CJEU data transfer judgment

noyb requested the Irish Data Protection Commission (DPC) to act on the CJEU judgment invalidating the EU‑US data transfer mechanisms. The DPC replied that it will not commit to a clear timetable for a decision. noyb set a compliance…

Irish Data Protection Commission · Standard Contractual Clauses

Moderate Court ruling Decided Ireland · Jul 6, 2020

Irish High Court grants leave for judicial review of DPC's slow GDPR complaint procedure

The Irish High Court granted leave to noyb.eu to challenge the Data Protection Commission's handling of GDPR complaints against WhatsApp and Instagram. The DPC has taken two years to produce a first draft inquiry report, the first step of…

Irish Data Protection Commission · General Data Protection Regulation

Low Enforcement Pending Ireland · May 24, 2020

noyb files GDPR complaints against Facebook Group, warns of potential €2.5bn fine

Within hours of the GDPR becoming applicable on 25 May 2018, the non‑profit noyb filed three complaints against Facebook, Instagram and WhatsApp. The Irish DPC has kept the investigation confidential but may issue a fine of up to…

Irish Data Protection Commission · General Data Protection Regulation

Low Enforcement Announced Ireland · May 20, 2020

noyb announces plan to file GDPR complaints over Apple Siri recordings

A former Apple employee alleges Siri records conversations without user activation. noyb says the practice may breach the GDPR and ePrivacy rules. noyb announces it will file complaints under Article 66 GDPR urgency procedure.

Irish Data Protection Commission · General Data Protection Regulation

Low Lawsuit filed Filed Ireland · Dec 18, 2019

Irish DPC files lawsuit against Facebook and Max Schrems over validity of SCCs

The Irish Data Protection Commissioner filed a lawsuit against Facebook and Max Schrems in the Irish High Court to refer the dispute on Standard Contractual Clauses to the CJEU. The case concerns whether SCCs can be used when US…

Irish Data Protection Commissioner · Standard Contractual Clauses

Low Court ruling Announced Ireland · Sep 17, 2019

CJEU to hear Schrems‑Facebook case on EU‑US data transfers under SCCs and Privacy Shield

The Court of Justice of the European Union (Grand Chamber) will hear case C‑311/18 on July 9 2019 concerning EU‑US data transfers to Facebook under Standard Contractual Clauses and the Privacy Shield, focusing on US mass surveillance. The…

Irish Data Protection Commissioner · Standard Contractual Clauses