Ireland: Data Protection

The Court of Justice of the European Union has ruled on when data controllers can refuse data subject access requests as excessive, even if it's the first request received. This landmark decision examines whether publicly available information about a data subject's intentions can justify refusing access requests, and clarifies the circumstances under which data subjects can claim compensation for GDPR violations.

The European Data Protection Board has introduced a draft common data breach notification template designed to standardize breach reporting across EU Data Protection Authorities.

The European Commission has issued interpretive guidelines on Article 50 of the AI Act, clarifying transparency obligations for emotion recognition systems, biometric categorization, and deepfake content.

The European Data Protection Board and European Data Protection Supervisor have issued their Joint Opinion on the European Commission's proposed Cybersecurity Act 2 and amendments to the NIS 2 Directive. While generally supportive of strengthened cybersecurity measures, the opinion emphasizes the need to balance effective security protocols against fundamental rights to privacy and data protection, offering specific recommendations to ensure compliance with EU data protection law.

The European Data Protection Board has released a draft template for Data Protection Impact Assessments, marking a significant step toward harmonizing GDPR compliance across the EU.

The provisional agreement was reached following pressure from various stakeholders to agree the final text ahead of the high-risk AI system rules and other provisions of the AI Act coming into force on 2 August 2026.

On 23 February 2026, data protection authorities (“DPAs”) across the globe published a Joint Statement on AI-generated imagery.

The Government's January announcement of its Large Energy User Action Plan (LEAP) represents a step change in Ireland's approach to data centre delivery...

The European Data Protection Board (“EDPB”) recently adopted a Report on its Coordinated Enforcement Framework (“CEF”) action on the right to erasure (Article 17 GDPR) (“the Report”).