Colin Rooney 

I’m Colin Rooney, Partner and Head of the Technology and Innovation Group at Arthur Cox. I’m delighted today to welcome Graham Doyle, who is the Deputy Commissioner and Head of Corporate Affairs, Media and Communications with the Irish Data Protection Commission. Graham has been on a blitz with the media over the last few days discussing the DPC’s annual report for 2025. He’s very kindly come in today to talk to us about some of the key developments covered in that report. And welcome, Graham. I’m looking forward to our conversation. 

Graham Doyle 

Thanks very much. Thanks for having me in, Colin. 

Colin Rooney 

Fantastic. I thought I would start maybe by talking a little bit about the volume of matters that the DPC is dealing with on an annual basis. The report has some very interesting statistics and sorry, the report is a very interesting presentation of statistics, which I’d encourage the audience to take a look at because you get a very good sense of how the DPC is operating. But one of the things that jumped out at me was the, I think it’s unprecedented volume of cases in 2025, up 45%, I believe. I mean, how are the DPC responding to that? And I know your response time has also gone up significantly as well, but what are you doing internally to address that increased volume? 

Graham Doyle 

Yes. So you’re right, Colin, in terms of the volume is up now to over 16,000 contacts to the office and that’s up from over 11,000 last year. So it’s a 45% increase. In terms of the reason, and I’ll come to your exact question, but in terms of kind of the reason why we’re getting these increases in volumes, we think a lot of it is down to the use of generative AI. And I think we have to be careful how we kind of talk about that because there is a positive for individuals because they can, you know, individuals are able to exercise their rights in circumstances that maybe without the use of AI they would not have been able to do so in the past. So that’s a positive. However, not only is the volume increasing, but the complexity of the contacts to the office is increasing. So what we’re seeing a lot of is individuals are going and using your ChatGPT or whichever one it is that they’re using and they’re putting in what their issue is. But what’s been generated back to them then will have a number of various articles of legislation for them to complain about. 

And quite often it’s very hard for us when we get the case in. When we look at it’s very hard for us to actually work out what exactly is the complaint. So quite often we find ourselves going back and forth with the individual to actually work out what’s happening. And it’s not just on first submission. So speaking with the team, what we’re seeing a lot of is individuals submitting complaints. When we then get to the complaint, then we go back to them, ask them questions, we kind of distill what we think is the issue and we go back and within 15-20 minutes we’re getting responses very detailed responses, very clear that AI is being used. And again, it just makes things much more complicated than they previously were. But as I say, I do think we have to be careful how we talk about it because there is a positive to people being able to use it. In terms of response times, just to be clear, I think maybe what you’re talking about from our report are our conclusion rates. 

Colin Rooney 

Yes. 

Graham Doyle 

So we have concluded, again, we concluded a lot more cases than we had in previous years. It’s up by about 12% at over 11,000. Our response times however, have actually gone the other way. So in terms of when we receive complaints in through the website, it is actually taking us longer now due to the volume and that’s just purely down to manpower. 

Colin Rooney 

Yes. 

Graham Doyle 

But in terms of the cases concluded, yes, we got through a lot more last year, in particular our cross-border cases, cross-border complaints. We concluded, I think it was around 43% more cases in 2025 in cross-border complaints than we had in previous years. We’ve got a focus and the new commission when they came in, put a real focus on older inquiries and trying to conclude older inquiries. And equally, that has found its way across to our complaints. We’ve had complaints that have been lying around for quite a long time and that we wanted to try and finalise and we got a lot of that done. We’re also scoping things a bit differently. And what I mean by that is in the past, individuals have lodged complaints with us and it might be a complaint about subject access requests. And again, subject access requests, as has been the case since I joined the DPC in 2017, is the highest driver of complaints to the office and we might talk about that more in due course. But in terms of scoping, how we scope our handling of complaints, previously we would’ve had a complaint from an individual looking for access to information. 

We engage with the controller and the individual then gets the information that they’ve sought. However, then the individual might look at the information and come back to us and say, well, actually I want to know what the legal basis is for that, X, Y, or Z. And we weren’t closing complaints previously in that way. We weren’t saying, you’ve now got your access to your information and a complaint now is now closed. However, that’s the way we’ve moved. And we’re informing individuals of this as they come back to us. And that’s had a knock on impact in terms of us being able to conclude complaints as they come in. 

Colin Rooney 

I think we’re all in a situation where AI is incredibly powerful. It’s transformative. It can be used in so many different myriad ways to improve your ways of working, but certainly in relation to, for example, access requests, which we’ll come on and talk to in a moment, we see that issue in real time as well. We see much more complicated access requests. We see they’re clearly AI generated. They would have been a page before, now it’s several pages. It’s citing case law, sometimes correctly, sometimes you have some questions about what’s being cited. So I think I could absolutely appreciate on the regulator side why that’s arising. 

Graham Doyle 

But if I can say Colin, just on that, one of the things we’re trying to get across to individuals as well who are lodging complaints is if you’re using AI, don’t forget to review it yourself. Make sure that when you have lodged a complaint or when you have a complaint drawn up, that when you look at the complaint yourself and make sure that it is exactly what it is you’re trying to find. 

Colin Rooney 

It’s getting to the essence of what you’re after. 

Graham Doyle 

Absolutely, because if not, it’s going to delay things for you because obviously, human nature being as it is we will have to find out exactly what is at the heart of the issue. 

Colin Rooney 

I think it’s equally an issue for controllers. I mean, I think if you get a DSAR or you have some other correspondence in relation to data protection and what the letter or the inquiry is actually asking is not clear to you, that can kind of slow down the process even before it gets to the regulator. So I think that’s very wise advice. 

Graham Doyle 

Just to say though as well, we are also seeing, the use of AI by controllers in responding tools as well and you know, I’m not making any issue of the fact that happens other than to say, again, it just adds to the complexity, the detail that we’re dealing with ourselves during our work. 

Colin Rooney 

Would the DPC engage the use of AI or is that something that you’re thinking about?

Graham Doyle 

Absolutely, yeah. So to date, no. 

Colin Rooney 

Okay. 

Graham Doyle 

But it is absolutely something we’re examining at the moment. We’re about to go out and do a bit of kind of testing of the market. Some of our regulator colleagues across the EU are already in this space. Look, this is an issue that’s not unique to Ireland. Our colleagues in the European Data Protection Board are all dealing with the same thing and actually, I just had lunch today with a friend who works in another regulator. They’re seeing the very same thing. So I think it’s the same as you say, you’re seeing it yourselves and your clients are seeing it. 

Colin Rooney 

We’re all grappling with it. Yeah, I think and it’s different. I mean, I think it’s incredibly powerful, incredibly useful but it does present challenges in terms of your ways of working. You’ve already touched on it, but I want to talk a little bit about subject access requests. And one of the things that I always look at when the annual report comes out is I wonder what the top issues are and I wonder how that matches against what we’re seeing in our practice, what our clients are bringing to us and perhaps unsurprisingly, but very markedly this year, I noticed that access requests accounted for more than 40% of the complaints that have been received. I won’t ask you to go too much into the statistics on that, but I’d be keen to understand, because I do engage with your colleagues a lot in relation to DSARs, what would you see as being or what would the DPC see as being the common repeat mistakes that controllers are making in answering DSARs. 

Graham Doyle 

So, obviously, some of the basic ones that you would expect, which is not responding at all. 

Colin Rooney 

Yeah. I find that remarkable, I have to say. 

Graham Doyle 

Yeah, you’re speaking to the converted here. Not responding at all to the individual or being incredibly slow at responding. 

Colin Rooney 

Yeah. 

Graham Doyle 

To the individual. But what we’ve seen a growing trend in over the last kind of 18 months or so is in relation to restrictions that are being applied. So as you know, your clients will know, it’s not an absolute right and it’s around the transparency around restrictions. So what we see is, we see individuals come to us, complain and say, I’ve gone to an organisation, I’ve sought the information and the organisation has just come back and said they’re applying a restriction. That means nothing to the individual. 

Colin Rooney 

Yes. 

Graham Doyle 

So we’re saying to organisations to explain to the individuals in more detail exactly what it is, why are you restricting. Give a summary of what’s happening. I’ve got an example, Colin, that I saw myself with the team of an individual had sought information, had been given an Excel spreadsheet with a thousand rows on it and 999 rows were blacked out. And just like, you know, that’s not, apart from anything else, it’s really bad business practice. Because, you know, in this world, consumer trust is so important and if you’re not good at this, if you’re not good, if you’re not transparent with how you do your work in this space, I think you’ve got a problem. So it’s a growing phenomenon that we’re seeing. It’s an issue that we’ve called out in our annual report. I’ve actually been speaking about it over the last number of months at different events and conferences about the need to get a bit better here in this space. 

Colin Rooney 

Yeah. So it’s clear communication of what I’m taking from you. It’s almost if you to a certain extent, think about answering your DSAR with a transparency hat on. Are you making information as clear as possible? Are you giving all the correct information? Speaking on the other side of things, I know that sometimes there can be a tendency to rush towards redaction and I think maybe organisations are becoming more sophisticated in saying, well, hold on, let’s think a little bit about explaining our position to the data subject and I think that sounds like that would be positively received from the regulator side of that. 

Graham Doyle 

Absolutely, because when we actually look at quite, I would say the vast majority of these issues where restrictions have been applied. 

Colin Rooney 

Yes. 

Graham Doyle 

When we look at it, the restriction has been appropriately applied. 

Colin Rooney 

Yes. 

Graham Doyle 

That’s not the problem. 

Colin Rooney 

Yeah. 

Graham Doyle 

The problem is you’re falling foul of transparency. 

Colin Rooney 

Yes. Explaining how it arose, that restriction was applied. And that leads me on to the case studies booklet, which is incredibly helpful and which is, I think you’ve been doing for a few years now. Certainly if you’re practising in this area, It’s a very handy resource, I have to say. You pick it up and you can find it. And I like the way you organise them by reference to subjects, to different themes. Do you see your case studies almost like a kind of a corpus of case law? Are they precedents or do you think every case is slightly different? 

Graham Doyle 

No, I think it gives organisations and individuals a fairly good idea as to the regulator’s thinking when it comes to, as you say, we have them grouped in various ways. We’ve case studies about DSARs about breaches, etc. And look, this is something that we’ve done for many years now. We’ve always had case studies in our annual report, but it’s something that again, I mentioned being out speaking at events. When I go out and speak at events, or any of my colleagues are out speaking at events, we get really good feedback in relation to these case studies, you know. And people want to say want to see, as I say, how we look at things. There’s also, like, all the case studies, now the ones that are in this year’s report, may be a bit different, but we also consider are there good news stories to tell? 

Colin Rooney 

Yes. 

Graham Doyle 

And I think I spoke to you about this before, Colin. There is a clamouring out there for what does “good” look like? 

Colin Rooney 

Yes, there absolutely is. 

Graham Doyle 

And we’ve had a number of different case studies that we’ve published over the years where we show, there’s a couple in the financial sector that I can think of whereby they had breaches and we found there’s no strict liability attached to having a breach. The organisations in question had done everything that could have been expected of them in advance of the breach. Their reaction to the breach was very good. So we actually didn’t find any issue at the end of the investigation. And again, we published that as a case study. So I think people really like to read these. It gives a good idea of our thinking. 

Colin Rooney 

Yes. 

Graham Doyle 

It’s a good repository. It’s actually one of we’ve obviously got the case studies booklets that we’ve produced this year. We’ve got a section on our website that is just purely for case studies. 

Colin Rooney 

Yes. 

Graham Doyle 

And throughout the year, we’ll publish and we’ll put out stuff on social media and they’re one of the most looked at pieces of material that we put out. 

Colin Rooney 

Certainly, I have to say I find it to be a very useful resource. I was talking to a colleague earlier this week and we were recounting we had a particular issue and I said, actually, I can remember a case study. I’m going to age myself a little bit, from 2005. It was incredibly useful. It’s funny how sometimes the case studies can stay in your mind a bit more than the case law can stay in your mind. And so I would very much endorse it, I think it’s one of the best parts of the annual report. 

Graham Doyle 

And actually even with the media, when I’m doing media interviews, they always pick up on— 

Colin Rooney 

Makes it real. 

Graham Doyle 

Absolutely. Absolutely. And that’s exactly I think what’s at the heart of all of this is it’s making it real. We can talk about breaches and DSARs and all of this at a high level, but when you read a case study, it really gets to the number of the issue. 

Colin Rooney 

It’s almost like you’re reading my mind because next we are going to talk about breaches if that’s okay, for a moment or two. I mean, it wasn’t as prominent an issue in the report as it has been historically, which I assume is a positive thing, right? But I think the report does, if I understood it correctly, sort of highlight a significant increase in scams, phishing-related sort of breaches. Can you talk to me about the trends that you’re seeing in that space and maybe the things that the regulator would like to see controllers do to sort of mitigate the risks or address the risks in relation to those kind of breaches? 

Graham Doyle 

Yeah, so we had I think, 6,500 breaches we received last year, which is actually, we’ve had a decrease of about 16% on 2024. And that is very positive, Colin. You know, I think when we look at it, we do a lot of engagement. We’ve done a lot of engagement kind of on our regulatory supervision side where we engage with entities right across the spectrum but also in engaging with organisations when they do have breaches. So I think there’s certainly, and we comment on this in the report, there’s certainly an improvement in compliance standards since GDPR has come in and that’s very much to be welcomed. That said, we’re still seeing I think the statistic is 55% of breaches that we received last year were what we would consider a no-risk or low-risk. So it’s going to be interesting now the procedural harmonisation and regulation is working its way through and as we know and your clients will know, that is changing the notification threshold to— 

Colin Rooney 

In a welcome way, I think.

Graham Doyle 

Absolutely, yeah, I think so. Yeah. So it’ll be interesting to see what way, what way that goes. But in terms of, you’re asking me about the phishing and actually it’s I know we’re talking about breaches here, but when we look at a section of our report actually that deals with the likes of direct marketing complaints, we’ve also seen a significant increase there as well. 

Colin Rooney 

Yeah, I noticed that.

Graham Doyle 

Yeah. Nobody would be surprised because, you can’t go to your phone most days without having either a text message or

Colin Rooney 

It’s the sheer volume of that material that’s coming at you. There’s always going to be issues that arise.

Graham Doyle 

Absolutely, but in terms of what we would say— sorry, just before I come to that, just to remind again, remind your clients, the single biggest reason for breaches to the office again this year at about 50%, is just human error. It’s the wrong information being sent out to the wrong person and quite often this is just individual. It’s just one person might be getting the wrong information about the neighbour or just group settings. So again, what we would say is come up with processes, come up with ways and make sure you’re training your staff, just reminding your staff the importance. We see it ourselves. We have our own breaches, low-level breaches thank God that that’s where they are. But I think all organisations do, but we need to learn from them. And as I say, human error is once again the highest driver of it. But in terms of to actually get to your question that you asked me.

Colin Rooney 

Just before you do, just on that, I mean, I’m struck by two things that you’ve said. One is I think we still see that piece about the low risk. We think that’s, I mean, everyone is still on a learning curve. I’d like to say Arthur Cox clients are very sophisticated in this space and I think they are. But there could be times when you think I should report this and I think it is always worth kind of having that consideration about the risk impact on the individual. That’s centre of mind for the regulator and look, I’ll just endorse your comments on the human error, the importance of training, the making sure that you are trying to make sure that your staff understand what a breach would be. You’re trying to make sure they understand, what they should be doing, how they manage the data. You know, there’s a sense I think that systems are the drivers of a lot of data breaches. Our experience would match yours where it’s more often than not it’s human error, you know. 

Graham Doyle 

And if you’re, again, just a very practical tip, if you’re sending out letters to individuals, consider window envelopes. 

Colin Rooney 

Yes. 

Graham Doyle 

Now I know they bring their own privacy risks, but like if you’ve got an envelope that doesn’t have a window in it. There’s a chance you will put in the letter for Colin Rooney, but you’ll put Graham Doyle’s address down on it. So, you know, practical things such as that are considerations. 

Colin Rooney 

Absolutely. Yes. 

Graham Doyle 

On the phishing and these kind of scams, you say there’s a significant increase this year in those. Again, the very basic multi-factor authentication for organisations to have in place. 

Colin Rooney 

Yes. 

Graham Doyle 

But again, in terms of your staff and when these emails or messages are coming in, I’ll be saying to individuals in the organisations, don’t be opening, don’t be clicking on links, don’t be opening things that you don’t know is a trusted sender and I’d say to organisations, test that. Test that. So do a little bit of testing throughout the year whereby you generate some of these kind of, not fraudulent, but you’d be doing it on purpose. You’d be generating links and you’ll send them around and just see what the reaction is. 

Colin Rooney 

You have to make people live this, don’t you? Experience it and experience the implications and that terrible moment where you think, I shouldn’t have clicked that link. Now I have a problem. And it’s much better in a test environment than it is in the real situation. 

Graham Doyle 

Absolutely. And we say that, like I say that not just in that context. We do it ourselves Colin, in our own organisation, testing all of these things out. I said as well about breaches, just generally about breaches. There’s learning from breaches no matter what and there’s learning from other organisations’ breaches, not just your own. So again, these case studies and the decisions that we publish on our website, maybe test some of them through in your own organisation. Ask yourself the question, okay, that’s happened over there. Could that happen here? 

Colin Rooney 

Test them against a case study. Yeah, no, I think that’s very valuable advice. Now, we talked a little bit about engagement. And one of the things that comes up for clients, for me very frequently is, we’d like to have a conversation with the DPC about this particular feature, product, service, proposed approach. Is that a good idea? And there is a hesitation, a level of nervousness about going in and having a conversation with a regulator. And the answer that we typically give, not always, but typically give is, well, look, we think it’s worth having that conversation, come and talk to us. We’ll set it up, we’ll facilitate that discussion or we’ll tell you that we think you’re far too early stage or there’s a problem here. What I was heartened to see in the annual report, because I think the DPC have a very strong history of positive engagement with the market and I think it’s been a, you don’t have to comment on this, but it’s been a bit of a differentiator against other regulators, for example, who are a little bit more closed doors. But you guys have always been open. 

You’ve a unit that’s open to this. But maybe could you talk to me about how valuable you see that proactive engagement. It’s discussed in relation to AI in particular in the report and in very useful terms, I think. But it’d be good to hear from your perspective in terms of how you find it useful in terms of engaging with controllers. 

Graham Doyle 

That’s incredibly useful, incredibly. So, sorry, I was looking through the report there because I know we’ve got some stats there in terms of the number of engagements we’ve had. And there’s a breakdown like as you say, when we talk about, when you hear about this, it’s normally in the space of big tech and AI and what have you. But actually when you look through the report, the amount of engagement deals with public sector, charity sector, voluntary sector, sports sector and lots of stuff in the space of children. It’s critical for what we do on a number of fronts. Number one, when there are certain circumstances where, say government departments have to come to us when they’re introducing legislation. So there’s pre-legislative consultation with us that has to be done anyway. But then when organisations are considering bringing products and services to market, they will quite regularly reach out to us and engage with us in relation to it. And why I think it’s so important and I’m actually speaking as a parent here, say there’s something in the space of children. It’s really important for me that when products are brought to market, they’re brought in as safe a way as possible. 

This is not about catching you out at the end of the day, you know, this is about making stuff as safe as possible. And that’s why this engagement is so important because we engage with organisations, as I said, right across the spectrum we’ll engage with them, we don’t give a green light per se, but you’re going to have a fairly good idea of your engagement with us, what we think you know. You you will share your DPIA or, you know, your documentation, Europa, whatever it might be and we’ll give you observations and recommendations in relation to it. And there’s actually a number of case studies here in the report itself. I think pages 82 to 86 of the report detail many of them are in the tech. But again, it just gives you an idea. 

Colin Rooney 

They’re very useful and I’m aware of a number of them. I think they provide very good insight into what that engagement would be like with, you know, and as I said, I’m glad you said the thing with the green light. I think that’s a, I mean, let’s be realistic, you’re not in a position to give a green light at that stage, but you’re discussing what’s in front of you and giving candid feedback about your sense of that. 

Graham Doyle 

And I don’t want your clients to take this as a negative and a reason not to engage with what I’m about to say, but we will also take account of, we’ve given you recommendations. 

Colin Rooney 

Yes. 

Graham Doyle 

If you go off and do something else and a problem occurs as a result, you know, it’ll be borne in mind that we’ve given recommendations. From our perspective, it’s incredibly positive as well because we learn a lot. 

Colin Rooney 

Yes. 

Graham Doyle 

You know, in particular in the technology space. 

Colin Rooney 

Yeah. 

Graham Doyle 

You know, we learn a lot about what’s actually happening, what the new technologies are doing and it helps us to kind of, it gets us up to speed before we have issues come our way at all. 

Colin Rooney 

Yeah, understood entirely. I want to just talk a little bit about, you’ve spoken to us before and Dale has spoken to us a number of times before about engagement between the different regulators in Ireland in a very positive way. And I think for a lot of our clients, they’re looking at a lot of new legislation which has come on the books, particularly at an EU level in the tech space over the last 3 to 4 years, and a more complex regulatory environment where for many years, if you were in the tech space, the DPC was by far the most important regulator. You’re still a very important regulator, but there’s an important role now for Coimisiún na Meán, for the CCPC, for ComReg arising from the Data Act, the CBI play an important role, the AI office in due course, once the legislation passes will be important. I get a lot of questions about what will cooperation look like between, say, the DPC and CCPC, etc., etc.? And I know that you had a cooperation agreement recently with Coimisiún na Meán and I just want to get a sense, because I think the clients will be particularly interested in this, like how does that, how will that manifest itself in terms of day-to-day work for the DPC? 

Graham Doyle 

It’s not new. Sorry, the cooperation agreement is new. It was introduced last year. But the engagement is not new. No, and like we’ve been doing it when you think about it, under the GDPR, under the one stop shop, we’ve been doing this with all European data protection authorities since 2018. We have been engaged in this, what we call the Digital Regulators Group here in Ireland, doing that for the last number of years. So you know, you’ve named CCPC, Coimisiún na Meán, ComReg and ourselves. And that gives us an opportunity to go in and have a seat at the table with like the Department of the Taoiseach and senior officials, to talk about the issues that we’re all facing. The agreement that we have with Coimisiún na Meán that we agreed last year. We meet now bilaterally. 

Colin Rooney 

Okay. 

Graham Doyle 

And we’ve got formal bilateral meetings that we discuss issues that we are both facing and dealing with. Some that might be unique to us, but then we’ll find an awful lot of overlap. And as a result of that, actually we have an awful lot of kind of one-to-one meetings with our counterparts in Coimisiún na Meán. We’ve done a piece of work with all of the regulators group in 2025 in relation to just providing information to members of the public. This might sound like a basic thing, but we actually did up a piece, we did up an information leaflet to actually describe exactly what the four of us do. Yes, because a lot of the complaints that we find out— 

Colin Rooney 

I don’t think that is basic at all by the way. I think that’s a very important thing to understand, the different roles that you’re all playing. 

Graham Doyle 

Yeah, I think you’re right. It’s one-on-one stuff, you know. People need to know, because we find a significant amount of the complaints that we actually get is into us are to do with user-generated content. 

Colin Rooney 

Yes. 

Graham Doyle 

And which are actually issues for Coimisiún na Meán. So we got together, we produced some information, We put it out on social media, we have websites, etc. And we’re trying to come up with other ideas and other ways of working together now in that space. We did stuff on Internet Safe Day.

Colin Rooney 

Yes. 

Graham Doyle 

We did a piece of work with Coimisiún na Meán where we sent information posters around to all the schools for the children to do with AI, use of AI. And we’ll look at more in that space, where we’re moving and actually where your clients may be even more interested is going to be in relation to kind of dealing with complaints.

Colin Rooney 

Exactly. If there’s an inquiry, how is that managed vis-à-vis the two or more regulators? 

Graham Doyle 

Yeah. And to be perfectly honest with you, we’re still working our way through all of that. But it is something we’re very alive to, you know, because we don’t want things falling between the cracks number one. And we want to understand one another’s remit and one another’s what we’re doing. So, um, yeah, that’s, that’s part of what we’re working through at the moment. 

Colin Rooney 

That’s I think that’s important for everybody to understand. The things falling between the cracks is obviously a concern, but that overlap, if there’s overlap at least it’s understood that there’s an overlap, but it’s cohesive in that sense. 

Graham Doyle 

And the overlap is not just ourselves and Coimisiún na Meán. We’ve issues as you’re more than familiar with Colin, we’ve issues that strand data protection, online safety and then competition at times. And so there’s lots of overlap between us all. 

Colin Rooney 

Putting on the green jersey for a moment, this jurisdiction is not half as complicated as some of the other member states. I won’t ask you to comment on that when it comes to the number and complexity of regulators. So that’s very good news. One of the things I did want to talk to you about is your “Pause Before You Post” campaign. Fantastic video, really impactful. I think it was one of the most widely watched videos in this space in a long time. It had people asking me, “God, is that the kind of thing you do, Colin?” Which is very heartening that friends and family now sort of understand what it is I do. A very positive campaign. I think a very effective way to deliver some really important messages. You know, if you’re in the space where you have children and you are either posting of or if you don’t have children, the posting of material, it can be very challenging to understand what the rules of the road are. 

Graham Doyle 

Absolutely. 

Colin Rooney 

Would you talk to us a little bit about that, about that campaign? 

Graham Doyle 

Yeah, so there’s two elements and with our annual report, we also publish the findings of what we call a sharing survey. I’ll touch on that maybe in a second of some findings here. But the campaign itself, yes, we did this in collaboration with our French colleagues at the CNIL. And this is it’s about the sharing of information by parents, the habitual sharing of information by parents in the form of photographs normally and other information that identifies the children in some way. So when we were doing the ad campaign, one of the things that there was a kind of collaboration, an internal collaboration. I know you know my colleague Jenny Dolan. 

Colin Rooney 

I do, yes. 

Graham Doyle 

Myself and Jenny, who leads up the Children’s Policy Unit, we worked together with our teams. And really what we were very conscious of, that we didn’t want this to be seen as us pointing the finger of blame at parents in any way, shape or form. This was about raising awareness of the risks. 

Colin Rooney 

Educational. 

Graham Doyle 

Absolutely. And it’s also not saying to parents, don’t share information about children. 

Colin Rooney 

Of course. Yes. Yeah. 

Graham Doyle 

So again, I’m sure many of your clients hopefully will have seen it, will have seen the ad itself and that depicts a young child with mum and dad going around the shopping centre and different stages people come and make comments to her based on stuff that they’ve seen that mum and dad posted online. And the reaction was incredible. It was beyond what we expected. It was viewed over 150 million times globally. I did media for Brazilian television, Australian television, New Zealand, Canada, America and right across Europe. It really resonated because it’s an issue that spans the globe. 

Colin Rooney 

Yes. 

Graham Doyle 

And as part that, then we then looked at doing a survey of both the Irish public and the French public and we had an independent survey commissioned by Ipsos and we asked questions of parents. And the thinking here was, we ran the ad, we did a survey around the same time and we are going to do a lot of work now in addition to the ad, we’ll do a lot of work over the next number of months. We’ll probably run the survey again in about another 12 months time and let’s just see if there’s any changes. But to just give you some of the, I suppose, some of the highlights of and can I say, lots of this won’t be a surprise to anybody. It’s about those, I think it’s about how we think. And I’ll touch on some of that now shortly. 3 out of 4 parents said that they shared information about the children last year. But 1 in 3 parents say they share information about the children at least every week and sometimes many times in the week. In Ireland, 14% of the parents who shared it consider themselves to be parent influencers. 

And what a parent influencer is an individual who has a significant following on social media who quite often tries to monetise from the content that they put out there. So 14% of people identified themselves. 

Colin Rooney 

That’s a high percentage, isn’t it? 

Graham Doyle 

Very high. Yeah, it’s very high. Interestingly, and when you look at the actual report, that’s just the highlight. Look at the report, I think it’s 17% of men so of fathers, consider themselves as influencers, where only 10% of mothers, which I don’t know why I was surprised, but I was surprised. 

Colin Rooney 

The male ego should never surprise you but anyway. 

Graham Doyle 

Yeah like, you know, the reason why parents do it and we know as a parent myself, we do it because we want to, we want to show off our kids’ achievements. 

Colin Rooney 

Indeed, of course. 

Graham Doyle 

Yeah, but interestingly Colin, like, photos at 90% here in Ireland was the main driver. But 17% of parents said they share health information about the children online. I was surprised at that. I didn’t think the figure was that high. It’s not something I think I would have ever, I would ever do, I’d ever do myself. 40% of parents in both Ireland and France share information about their children without asking the children for their consent. Now that’s, that’s a very interesting statistic for me. And you know, some people have already said to me, oh, but what about my 1 or 2 year old child? I can’t get consent. Should you be posting the photographs in such a way that they’re identifiable in the first place? But when we consider that in some spaces we’re creating the digital profile of our children. 

Colin Rooney 

Yes. 

Graham Doyle 

But you know, we’re at least adding to the digital profile of our children and yet we’re not asking children, for their consent, engaging with them on that. 

Colin Rooney 

Yes. 

Graham Doyle 

Yeah. 

Colin Rooney 

And there’s a lot of implications in the future for them in that regard. Yes. Yeah. 

Graham Doyle 

With all that in mind and you know, some of that, as I said, may not come as a surprise. Some of them may not come as a surprise. But I think the benefit of doing this survey and the benefit of doing this piece of work was in the next question for me, because more than half of the respondents in both countries did not know or said there were no benefits to sharing their children’s information. So I would like to think that would get people thinking. If there are no benefits to doing it, why do we do it in the first place?

Colin Rooney 

Yeah. 

Graham Doyle 

In particular whereby, we then ask them, what risks do you think are associated with this sharing? And here in Ireland and it was the same in France, 66% said images being misused by strangers and 55% also said AI, AI deepfakes using their children’s photos. So again, when I say awareness raising, this was an awareness raising campaign it hopefully gets people thinking. 

Colin Rooney 

The participation in the survey is in and of itself educational and it’s getting people to think about the, about the issues. 

Graham Doyle 

Absolutely. 

Colin Rooney 

Yeah. 

Graham Doyle 

And then finally, 9 out of 10 parents said that when they’re sharing their children’s information, they’re doing it to a restricted audience. And again, when you consider it, I think the main platform for sharing information is actually here in Ireland is WhatsApp. 

Colin Rooney 

Yes. 

Graham Doyle 

So, you know, we have family groups, we have friends groups, you might have sports clubs. You know, I was a football coach myself and I know we had, at a point in time, we had a group set up. Can I say it was before I joined the Data Protection Commission. But we had a group set up. But what I would say, one of the things just in relation to those restricted groups Maybe periodically just review the group. If you make sure that the people who are in the group are, you know.

Colin Rooney

Just a quick check to make sure that you understand who the material is being circulated to. Yes. Yeah. 

Graham Doyle 

Absolutely. And think to yourself that this is an online space, but would you hand everybody there, would you hand them, that piece of paper? And then the final thing is just that 1 in 10 parents and I don’t know whether this would be something they would have thought of before the survey privacy. But 1 in 10 parents says that they actually regretted sharing information about their children. 

Colin Rooney 

Yes. 

Graham Doyle 

And it was the same right across, um, both here and in France. 30% of them said they regretted it because they are aware of the dangers of posting on social media. 18% said because they wish they’d maintained their children’s privacy. And the final 14%, they said they had no control over the images once they’re posted. 

Colin Rooney 

Yeah, it’s that kind of realisation isn’t it, of what you’re engaged in and what the implications might be. 

Graham Doyle 

Absolutely. 

Colin Rooney 

I mean, the survey sounds very interesting. I mean, I’ll go back to the video, which I think the beauty’s in the simplicity. It’s a very straightforward video. You understand the issues, you understand the implications very quickly. You see the innocence in the posting, but you see very quickly what the implications are. So it’s absolutely fantastic video. I mean on that, and thank you for sharing those statistics, they’re very interesting. I mean, this is the treatment of children’s data, privacy preserving, age assurance. This seems to be, as you mentioned, it’s a global issue. I would say it’s close to one of the big privacy issues of the day, if not the defining issue. I mean, what’s your sense of the direction of travel here. Particularly around child protection measures but around age assurance? I know there’s some proposals coming from the EDPB, they’ve got their principles and their 10 principles etc. But what’s the DPC’s feeling on that following on from sort of the survey, following on from the video, following on from the educational piece? What do you think the direction of travel is around age assurance now? 

Graham Doyle 

Yeah, look the EDPB guidelines you’re talking about is actually, we were a co-rapporteur on that ourselves. So we were very much involved in it. Look this has been going on, as we know Colin, this conversation has been going on for many years now. 

Colin Rooney 

For a long time, yes, yeah. 

Graham Doyle 

And look at it has progressed and there’s a lot happening at an EU level and here in Ireland. There’s a lot of talk about it. There is no silver bullet to this. And even with introducing age assurance tools or looking to introduce age assurance, it does bring with it other, it brings privacy risks. I think you and I have spoken about this before. It brings privacy risks with it. But we do believe and the EDPB believes that technology and the advancement and the use of new technology, so once we’re using technology to do age assurance, responsible innovation in technology can actually help us to mitigate the risks. 

Colin Rooney 

Yes. 

Graham Doyle 

And I think that’s why it is one of the big talking points of the day. There’s no question of this. And it’s again, it’s a global issue. Like we’re looking around the world at what’s happening with age bands, etc. You know, we engaged with the Australian Commission during the course of the year last year and actually they engaged with us because we engaged with each other, but they came to us because they wanted to learn from the work we had done around the child fundamentals. 

Colin Rooney 

Yes. 

Graham Doyle 

And that’s really useful for us to now have that kind of— 

Colin Rooney 

Yeah. Because many years ago now, which was early in the regulatory cycle space that’s to your credit

Graham Doyle 

Yeah, we’ve done a lot in the space of protecting children online. Like, we’re kind of talking into what some people call the “soft space”. But like on the regulatory side, we’ve had a couple of inquiries, big inquiries. One of the Instagram, one of the TikTok, that dealt with children’s processing that had resulted in significant fines and decisions that are under appeal but importantly, the corrective orders that were put in place have all been, have been put in and have been made. The changes have been made. We’ve supervised those changes. So we’ve done a lot in this space. Again, speaking about the Australians, going to be very useful for us now in this very question. In the space of bans for under 16s that they’ve introduced, to learn from their experience. And depending on what way things go here in Europe. So look, policy is still developing around this whole area.

Colin Rooney 

It’s pulling in several different directions. We can see the direction of travel of the UK. You can see Australia. I think it’s very useful to have engaged with Australia. So no, it’s a real moving feast. But look you’re as close to the action as you can be I think in this and close to current developments. I want to talk to you a little bit about cross-border complaints if I can for a few moments. I mean, I think the report, if I’m not incorrect, states that they increased by 43%, I think, in 2025. But I think to be fair, as I think you alluded to this earlier, you are seeking to try to move them and close them quickly and progress them as quickly as you can. And particularly some of the older ones are being are being progressed. And look, I have some sympathy. I think investigations do take some time. In terms of the Brussels presence, because I think that’s been a game changer, a positive game changer for the DPC. If I understand that you have one attaché there present. Is there a sort of a proposal to beef that office out at all or what’s the plan in that regard? 

Graham Doyle 

We’ll have to see. There’s no immediate plan to beef the office out, as you say. A lot of it is going to depend on resources that we can, you know, we can get going forward. Because, you know, we’re talking about this report highlights a lot of really positive stuff. And yes, it does highlight increases in concluding different things, including our cross-border complaints. 

Colin Rooney 

Yes. 

Graham Doyle 

But with the increases that we’re having coming into the office now, it’s really going to test our resources. So we’ll have to see resource-wise what we can do in terms of increasing the presence in Brussels, but you’re absolutely right Colin. It was a game changer. 

Colin Rooney 

Yeah. 

Graham Doyle 

And I remember being out there a number of years ago with the former commissioner and I remember sitting down and talking to people out there in the know who said, you know what, you could come out here every day. You could get on the red-eye flight in the morning, you go in the evening, you’re still missing out if you’re not here. 

Colin Rooney 

You’ve got to be on the ground. 

Graham Doyle 

That Brussels bubble effect. And it’s been really important. So our attaché has engaged with other DPAs out there, engages with the members of European Parliament. We were out there during last year and actually we’ve already been out there this year meeting with some of the Irish MEPs, had a bit of a briefing for those in relation to the work that we’re doing and meeting with controllers. And so like it’s crucial. And then meeting obviously with the media. Now I’m back and forth quite a lot because the role, the attaché role, has been kind of a communications function. And so I’m back and forth quite a lot working over there with them. But we also have quite a lot of staff who are back and forth to Brussels anyway. 

Colin Rooney 

Because you’re at the EDPB meetings. 

Graham Doyle 

EDPB plenary meetings that are on. 

Colin Rooney 

There’s a lot of those.

Graham Doyle 

So there’s the plenary meetings that are all the commissioners. And every second one of those is in Brussels. And then we have weekly subgroup meetings and we’re involved in them all because, you know, given the nature of the entities that we’re regulating here in Ireland, you know, it’s important that we’re involved and they want us involved. Sometimes you might read some articles and you might think that, you know, the relations are bad. The relations are really good. 

Colin Rooney 

Precisely actually why I’m asking you this. If we cut to the chase. I think there can be a sense sometimes that the DPC, you know and Ireland sits in the sort of, you know, the far reaches of Western Europe but in fact, the reality is, as I know from speaking to you, from your colleagues, you guys are immersed in the centre, right? And like you are there, you’re frequently there, you have a presence on the ground, but it goes beyond that. You have positive engagement. You are close to the centre.

Graham Doyle 

Absolutely. And Colin, it’s been like that since May 2018. We’ve been engaging with our colleagues. 

Colin Rooney 

Yeah. 

Graham Doyle 

Quite often things have been represented in a certain way. An investigation and a decision, a draft decision has ended up going to Article 65. The system is broken. It’s not working. It’s the Irish’s fault, it’s the Irish DPC’s fault because they’ve had to be told what to do by the rest of Europe. That’s just such a simplification of, you know, the reality is when GDPR came in, you know, all your clients will know GDPR came in. It’s a complex, novel piece of legislation that needs to be dealt with, that needs to be worked through. We’ve worked through them. We worked through a lot of the big issues that we needed to work through. We’re getting a lot of clarification now from the courts. There’s a lot of precedents being set by the decisions we’re making across the EU. Yes, we’re putting a lot of investment into bilateral meetings with our colleagues. And this is starting to shine through now. The last kind of year or so, the last two years, I think some of the investigations that started many years ago are coming to conclusion. And I think the last five that have come true came through with Article 60 without needing to go to Article 65. 

But let’s not be fooled. If the next one goes to Article 65, it doesn’t mean that the system is broken. It means the system is working because the GDPR was set up and was devised with disputes in mind. 

Colin Rooney 

Yes. 

Graham Doyle 

You’re dealing with 27 EU member states and the 3 EEA states. 

Colin Rooney 

Yeah. 

Graham Doyle 

And you know, it takes time for the case law to develop. 

Colin Rooney 

I mean, I think it’s only really in place for eight years. Yes I mean, you could say that it was in existence for about ten, but it’s got to take some time for that case law to build up, for decisions to be made, for the guidance to issue. So I wouldn’t say it’s early days with GDPR, but I hear the argument that you’re making and that’s an important point to make about the positioning of this regulator vis-à-vis European colleagues. 

Graham Doyle 

I think absolutely and there’s an overemphasis in my mind on fines as a measurement. But as a measurement, like we imposed over half a billion euro in fines last year. We’ve imposed over €4 billion in fines. That’s more than half the fines that have been imposed across the EU. Now there’ll be arguments made that, oh well, in one of the cases, the EDPB had to tell you to introduce a fine of over €1 billion. That’s correct. That’s correct. The work of the investigation was conducted by the office. What I really would like to get across to people though is the importance of corrective orders. All of those fines, so there’s over €4 billion in fines have been imposed only €20 million have been collected to date because they’re all of the big large scale investigations that we’ve done, the large-scale big tech investigation we’ve done. We’ve had 15 decisions, 13 of those have been appealed and are before the court. So we’ve got some before the Irish courts in terms of appeals, we’ve judicial reviews and then we’ve seven, I think now eight reference cases to the European Court of Justice. 

Graham Doyle 

So as people will know, fines must be confirmed. They can’t be confirmed until the legislative process is finished. The legal process, sorry, is finished. But in the vast majority of these investigations and these decisions, we make orders for the entities to bring their processing into compliance and we make the significant changes. And in the vast majority of those, without prejudice to their appeals, those changes have been made. 

So I gave you the example earlier on of the Instagram for children and people may have heard me say this before, but as a parent, the DPC opened an investigation into Instagram and it was about children being able to access business accounts. 

Colin Rooney 

Yes. 

Graham Doyle 

And during the course of the investigation, Instagram changed their settings to privacy by default. Now, they had been public by default, which meant that if my son went on, set up a business account, his personal details were available to the world at large. We finished that investigation. We then supervised Instagram in making the changes and those changes have been made. As a parent, I don’t care about the fact that the DPC fined Instagram €405 million. I don’t. But what I do care about is that it’s now a safer platform for my son to be on. 

Colin Rooney 

It’s the corrective measure and the implications of that corrective measure in terms of future processing. 

Graham Doyle 

But I want to be very clear, fines are really important. They play a very important role. You know, the dissuasive nature of fines, they’re very important.

Colin Rooney 

I know the point you’re making. 

Graham Doyle 

But it’s really important. The corrective measures piece is really important. And that’s really what I believe is what effects change. 

Colin Rooney 

The piece on sanctions is very interesting actually, Graham. And I’m kind of glad you brought that up. I won’t spend too much time on fines. We talk about fines a lot. I think when the GDPR first came out, all the headlines were around the big fines and the potential for big fines. But rather what I’d like to talk about maybe is some of the other tools that are available to the DPC in relation to sanctions. And in particular, what sort of jumped out at me a little bit in the report was the use of reprimands. And I just kind of want to get a sense of where that tool sits in the DPC’s armoury? Like how do you see reprimands being used? Is this something that you will continue to use? And again, I noticed in a couple of decisions there’s reprimands but there’s no other sanction. I just kind of want to get a sense of really for our audience what, you know, how you see that particular sanction operating. 

Graham Doyle 

Yeah look, I think the reality is there’ll probably be an increase going forward of reprimands. I think that’s that’s probably going to be the case. Like up until I think it was 2023, there was a change to the legislation here in Ireland that enabled us to actually use reprimands outside of inquiries. Reprimands have always been part of the toolkit in inquiries. And, you know, you just have to look back on any of the decisions on our website, that details again fines, corrective orders, reprimands, etc. However, I think there were nine reprimands issued outside of inquiries last year and they’re all detailed in the annual report. What we look at is if we’re dealing with a controller and we’ve got an issue with a controller and look, I should say at the outset, not saying this is the case with the nine that are in there, but just at a very high level, how we think about things in the organisation is if we’re dealing with an organisation and there’s a problem and there’s a breach of some sort or an issue, we will provide guidance in the first instance. 

Graham Doyle 

If, however, we see that there’s a continuation, we get more complaints or more issues or more breaches, we will step that up and that’s something that we’d absolutely look for. We’d be considering reprimands for it. And the level of risk associated with what has happened will also be involved. You mentioned and actually somebody else asked me a question recently along the same lines Colin, but they were saying to me that, well, what effect does a reprimand have? It’s a slap on the wrist in the absence of a fine. And this is not the reason why reprimands are done, but just to say, like the fact that we publish the details of the reprimands is important and it’s something to be borne in mind by, you know, by organisation, by controllers that, you know, like the sometimes that kind of impact can be. 

Colin Rooney 

There’s a deliberate thought process within the DPC in terms of the use of reprimands and when to deploy them and how to deploy them. 

Graham Doyle 

Absolutely. Absolutely. And as I say, this is the start. We’ve only really started in 2025. 

Colin Rooney 

Yes. 

Graham Doyle 

In this space. So what we will see now hopefully over time, is does it have an impact on behaviour? 

Colin Rooney 

Yeah. Is it a tool driving particular outcomes and risk being a key driver? Graham, I want to finish this with one question. Thank you very much for your time and for being so candid with us. We get lots of questions about different inquiries. One of the inquiries that does come up quite a lot and I’m only expecting you to say what you can about this, right? Is the TikTok decision in particular. The fine, €530 million, that arose in the context of the transfers to China. A question that gets asked of me quite a lot actually by clients is why was there a second inquiry? Or why is there a second inquiry? How does that fit? And I give an answer which I believe to be the correct answer. But just while I have you here, it’d be just good to get the DPC’s sense of how that would arise. How does that arise in these circumstances? Is this something that you would normally see or is this just sort of specific to the case in question? 

Graham Doyle 

Can I put you on the spot and see what your answer normally is? I’m joking. 

Colin Rooney 

No, yeah, you can. 

Graham Doyle 

I’m joking. Yeah look, it’s a very net issue in TikTok too. So we’d almost finalised the first TikTok inquiry and very late in the day, information was shared by TikTok that hadn’t previously been shared. 

Colin Rooney 

Okay. 

Graham Doyle 

So it’s around, you know, you’ll see the scope of the investigation detail. But it’s around the accurate provision of information to us as a regulator. Now I’m completely paraphrasing, but that’s, that’s in essence, that’s what it’s about. It’s about providing information, accurate information. 

Colin Rooney 

And so if I can ask the question, not specific to any particular company and certainly not to TikTok, but in certain circumstances then, it’s not the DPC doesn’t sort of operate on the basis that we’ll close one inquiry and we’ll open a new one. Generally speaking, you’re keen to wrap everything up into one inquiry to the extent you can, but it’s within the scope of your remit and then you move on to a new thing. This is exceptional, if you like. 

Graham Doyle 

Yeah, I say there’s a very net issue at play here. Ordinarily in inquiries we open an inquiry you know and including TikTok with children let’s say you open an inquiry, at the end of the inquiry you come up with a decision. The decision will quite often have, as we’ve spoken about already today, quite often have corrective orders. 

Colin Rooney 

Yes. 

Graham Doyle 

There’s a new phase will open then that’s kind of the enforcement phase, whereby we supervise the implementation, you know, we agree an implementation period, etc., etc. Or impose an implementation period that’s agreed ultimately with the organisation. And then we will supervise that implementation and then that sees out an inquiry. But this is actually, as you said with the question, this is a second, it’s a different inquiry anyway. It’s a second inquiry. It’s just into something that kind of arose. 

Colin Rooney 

Thank you for that. I think it’s just understanding the sort of the flow from one inquiry to another and I think that’s, again, not specific to the company in question, but more just about the DPC’s manner of opening and closing inquiries that I just wanted to sort of get you to clarify and thank you very much for doing that. Graham, that has been incredibly informative. Thank you very much for your time. We’ve gotten through some really interesting issues and you’ve been very candid. You’ve been very forthright in your answers and I do really appreciate that. And hopefully you haven’t got too many more media engagements after taking the time to speak to us this week. But in the context of it being a really busy week for yourself and for the regulator more generally, I just want to say thanks very much and really appreciate it. 

Graham Doyle 

Thank you for having me in. 

Colin Rooney 

Thank you very much for joining us today. I hope you found that to be an informative discussion. If you have any questions or follow on queries, please feel free to get in touch with me or your usual Arthur Cox contact.