Data Protection Commission (DPC) — Google Ireland Limited (PaLM 2)

Decided by

Data Protection Commission

Parties

Data Protection Commission v. Google Ireland Limited

Appeal

Appeal status not stated

Key holdings

1. The Data Protection Commission initiated a statutory inquiry into Google Ireland Limited under Section 110 of the Data Protection Act 2018.

   “commenced a Cross-Border [1] statutory inquiry into Google Ireland Limited (Google) under Section 110 of the Data Protection Act 2018.” — Data Protection Commission launches inquiry into Google AI model

2. The inquiry assesses whether Google conducted a required Data Protection Impact Assessment under Article 35 of the GDPR before processing personal data to develop PaLM 2.

   “prior to engaging in the processing of the personal data of EU/EEA data subjects associated with the development of its foundational AI model, Pathways Language Model 2 (PaLM 2).” — Data Protection Commission launches inquiry into Google AI model

3. A Data Protection Impact Assessment is essential to protect individual rights when data processing carries high risks.

   “A Data Protection Impact Assessment (DPIA) [3] , where required, is of crucial importance in ensuring that the fundamental rights and freedoms of individuals are adequately considered and protected” — Data Protection Commission launches inquiry into Google AI model

In plain English

On September 12, 2024, Ireland's Data Protection Commission announced the launch of a cross-border statutory inquiry into Google Ireland Limited under Section 110 of the Data Protection Act 2018. The investigation focuses on whether Google complied with its obligations under Article 35 of the General Data Protection Regulation to conduct a Data Protection Impact Assessment prior to processing the personal data of European Union and European Economic Area data subjects to develop its foundational artificial intelligence model, Pathways Language Model 2. Under the General Data Protection Regulation, a Data Protection Impact Assessment is required when data processing, particularly using new technologies, is likely to result in a high risk to individual rights and freedoms. The Data Protection Commission noted that performing such an assessment helps data controllers identify and mitigate data protection risks to ensure processing remains necessary and proportionate. This statutory inquiry forms part of broader efforts by the Irish regulator, working alongside peer authorities across the European Union and European Economic Area, to oversee personal data processing in the development of artificial intelligence models and systems.