Govt accused of caving to AI firms over data safeguards

European transparency campaigners have accused Ireland of caving to pressure from Big Tech in order to allegedly water down safeguards preventing technology corporations from using Europeans' personal data without their consent.

The charge comes just days after EU member states adopted a joint position - under the Irish EU Presidency - on simplifying the rules governing AI, and its relationship to personal data.

A report today by transparency NGOs Corporate Europe Observatory (CEO) and LobbyControl claims there was intense pressure by Google and Meta to get the Irish Presidency to weaken safeguards in favour of Big Tech.

However, Dublin insists that the joint position on how to regulate AI reflects a balance of views among member states while also providing legal clarification on how personal data protection should be preserved in the AI age.

A presidency spokesperson told RTE News: "As Presidency of the Council of the EU, we carry out our responsibilities with complete impartiality."

Today’s report reflects ongoing tension between the Government and privacy campaigners over allegations that Ireland remains too close to US tech corporations.

The controversy stems from one of many efforts to simplify EU regulations in order to boost competitiveness and innovation.

Last November, the European Commission proposed a raft of simplification measures governing the digital and AI sphere.

Known as the Digital Omnibus, the updated legislation is designed to adapt the EU’s flagship data protection regime, the GDPR for the AI age, which was in its infancy when the legislation was first adopted.

The Digital Omnibus is also a key plank in the EU’s efforts to keep pace with the US in the sphere of AI, while also reconciling the use of the new digital tool with existing data protection rules.

The Cypriot Presidency of the EU, which preceded Ireland’s assumption of the rotating presidency, was expected to have negotiated an agreed position among 27 capitals before final talks would get under way with the European Parliament.

However, due to differences among member states about the commission’s proposal, the issue was kicked into the Irish Presidency, which got under way on 1 July.

Last week, the Irish presidency successfully adopted a joint EU position, with 24 out of 27 member states agreeing to the compromise text under a weighted majority.

However, the agreement has come under strong criticism from transparency campaigners and consumer groups who have expressed alarm that tech firms could have greater scope to use personal data in order to train AI models as a result of the Irish compromise text.

Today’s report by Corporate Europe Observatory (CEO) and LobbyControl effectively accuses the Irish Government of having weakened safeguards due to intense lobbying by the tech sector in the run up to the Irish presidency.

"Big Tech actively sought to shape the Irish presidency of the EU to push for the deregulation, with meetings in the months before reaching a peak," the report claims.

The Government strongly refutes the allegation.

A presidency spokesperson said: "Our role is to facilitate agreement among all Member States and to advance the Council's legislative agenda.

"The Council mandate agreed on 21 October was supported by a very large majority of Member States."

The report by the transparency NGOs draws on entries in the Irish Register of Lobbying that purports to show a dramatic increase in meetings involving Google, Meta and Ibec and Government ministers and TDs in the months leading up to 1 July.

Freedom of information requests in Germany, Sweden and Denmark also show intense lobbying by Meta and Google, according to the report.

In Ireland, Meta met 41 TDs to discuss digital regulation at EU level while Google met 30 TDs, according to the report.

Many of the lobbying entries, between May 2025 and the present, record that both Meta and Google were seeking the government’s support for the "simplification of digital regulation at EU level."

Likewise, the register notes that IBEC held meetings with the government and Irish MEPs in order to secure their support for "the Technology Ireland position on the EU’s digital fitness check and the EU’s Digital Omnibus."

The Irish government has long prioritized simplifying digital rules at EU level in order to boost competitiveness, including in the sphere of the bloc’s indigenous AI sector and in order to optimise the use of AI to boost innovation.

However, transparency campaigners claim Dublin has taken the side of US tech firms "under the guise of winning the AI race".

The most controversial aspects of the push to simplify AI regulation at EU level relate to the use of personal data to "train" AI models.

One issue revolves around "legitimate interest", an existing legal base within the GDPR that allows a private company to use personal data in order to safeguard against, for example, money laundering or bank fraud.

Officials say one reason for the updated and simplified legislation is that AI was not an issue when the GDPR was first adopted, and that efforts have been made at EU level to adapt existing rules to accommodate the radical new tool.

In 2024, the European Data Protection Board declared that the existing "legitimate use" legal concept could be extended to the use of personal data to train AI models.

These could be valid for certain areas, such as fraud detection, cybersecurity and for certain chat bots, so long as proportionality was applied and that companies using such personal data could prove they were not impacting on fundamental rights.

However, campaigners have argued that allowing a broad interpretation of "legitimate use" could give tech firms a legal presumption that personal data processing is legitimate by default, so long as it is used for AI.

Resistance to changes in GDPR regulation

In its initial proposal, the European Commission suggested that the "legitimate use" concept, as applied to AI, should be inserted into the GDPR legislation itself.

However, there was resistance to this idea by some member states and data protection regulators.

In February, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) jointly called on member states and the European Parliament "not to adopt the proposed changes to the definition of personal data" as they went beyond a "targeted or technical amendment of the GDPR".

The joint opinion also said the new flexibilities went beyond legal precedent as set down in the European Court of Justice (ECJ).

The Cypriot Presidency, in seeking to find consent, decided to not to change the GDPR regulation itself, but instead to put the clarification in as "recital" to the new legislation.

However, the Cypriot text did not get the approval of member states, who remained divided over whether the "legitimate interest" element should be written into the GDPR legislation or simply added as a clarification to the new simplified rulebook.

Once the issue was taken up by the Irish EU Presidency, sources say the priority during the summer was to make a second attempt to forge consensus over the "legitimate interest" issue.

Officials say the result was to have the "legitimate interest" concept placed in the "operative" text of the GDPR legislation but in such a way as to be carefully circumscribed in order to avoid creating a "special regime" for AI.

Sources strongly deny that this provides a carte blanche for AI systems to be trained on personal data, insisting that all the existing safeguards and fundamental rights - such as a ban on the use of biometrics, or the processing of facial data for so-called deepfakes - would remain in place.

The Corporate Europe Observatory and LobbyControl report suggests that the Irish Presidency removed what it regarded as stronger safeguards in the Cyprus text under the influence of Big Tech lobbying.

The report cites an Irish Independent article from July that Minister for Enterprise, Trade and Employment Peter Burke was invited to a dinner at the US ambassador’s residence in February along with four Meta executives in order to discuss the digital agenda during Ireland’s EU presidency.

Sources, however, say that Irish officials met both transparency NGOs and industry representatives in Brussels in January, February and March, and that such meetings tapered off as July 1 approached and Ireland assumed a neutral chair stance.

However, in a letter to Ireland’s deputy ambassador to the EU Cáit Moran in September, the EU’s consumer rights organisation BEUC expressed its "concern" at the government’s text saying it would "represent a significant rollback of EU

protections for personal data and fundamental rights, which stand to have a clear negative impact on consumers."

BEUC said the Irish proposal placed "the personal data of millions of Europeans directly in the hands of US Big Tech, while restricting consumers' ability to seek redress when their data is misused.

"At a time when user data is being exploited more than ever, these proposals would fundamentally weaken the safeguards that protect consumers and could render the GDPR effectively unworkable."

Irish sources insist that its negotiating text was the result of consultations with member states, in the wake of Cyprus’s failure to secure agreement, and that fundamental safeguards and legal clarifications remain in place.

"So far as the use of personal data for AI development is concerned, it is important to underline that the proposal seeks to clarify how existing rules apply in the AI context, not to change the fundamental protections provided by the GDPR or reduce data protection rights," said the presidency spokesperson.

Another contentious aspect of the Irish negotiating text relates to the practice of pseudonymisation, whereby personal data is encrypted so that only the entity holding the data can link it to a specific person and not the recipient of the data, in this context a tech or data processing company.

A landmark ECJ ruling in 2024 held that pseudonymised data could be passed on to a third party as "non-personal" data, so long as that third party did not have the means to re-identify the specific person.

It is understood that, following the inability of Cyprus to secure consensus on the issue, the Irish presidency canvassed the views of member states who ultimately agreed to highlight the ECJ judgment in the text and to add extra safeguards.

A key safeguard will be that if a controller of the data, for example, a bank, passes on the pseudonymised data to a third-party data processing firm, then the controller will be legally obliged to ensure that the processor does not have the means to re-identify the individual linked to the data.

However, consumer organisations have argued that tech firms could use this exemption to avoid GDPR obligations by claiming they have no way of re-identifying personal data, potentially absolving large data-processing industries from the regulation.

The Presidency spokesperson told RTE News: "The Digital Omnibus is not about weakening protections. The goal is to achieve simplification for businesses, in particular SMEs, and to ensure the Omnibus supports digital innovation in the EU while upholding data privacy and fundamental rights of citizens."

With EU member states now having adopted a formal position on the Digital Omnibus and how to regulate AI, the European Parliament will develop its own position in the coming months.

It is expected that the issue will enter a final negotiating process between the Lithuanian Presidency and the European Parliament next spring.