Irish Data Protection Commission guidance makes an important point: a model may process personal information when it is trained, deployed and asked to answer questions, even if users never see a traditional database.
Training is not merely technical preparation
The Irish DPC’s July 2024 explanation highlights personal data collected from web pages, other datasets and later fine-tuning. Public availability does not erase GDPR duties. A developer needs an appropriate legal basis, purpose analysis, minimization, transparency and a way to understand the rights of affected individuals.
Output generation can create a new problem
A model may return memorized personal information or invent an inaccurate statement about a person. Filters and prompt restrictions can reduce exposure, but regulators note they can fail. Evaluate whether system design allows a user to retrieve sensitive records or infer information through repeated prompts.
What the 2025 Meta statement actually means
In May 2025 the DPC reported extensive engagement over Meta’s use of adult public social-media content for LLM development, describing safeguards and privacy risks. That statement should not be turned into blanket approval for every model, dataset or training program in the EEA. Regulatory dialogue is not a universal legal permit.
Design an accountable process
Record data collection source, lawful basis, retention schedule, model training conditions, access/erasure request procedures, privacy risk assessment and security testing. Identify parties’ controller or processor roles by actual decisions and contracts. Give support agents a safe escalation path when a user disputes an AI-produced profile.
Use-case decision
An organization generating generic marketing outlines faces a different privacy exposure from an insurer extracting health information to classify applicants. In the latter case require specialist data-protection review, proportionality analysis and human decision authority before launch. Irish guidance applies within GDPR context, not as a separate worldwide AI statute.
Sources & Further Reading
- AI, Large Language Models and Data Protection — Irish Data Protection Commission.
- DPC statement on Meta AI — Irish Data Protection Commission.
Jurisdiction/scope: Ireland and GDPR/EEA; privacy-regulator guidance. This is educational information, not legal, medical or other professional advice. No hands-on product testing is claimed.