The DPC has launched an enquiry into whether Google Ireland Limited complied with regulations ahead of Cross-Border processing personal data of EU or EEA data subjects when developing its foundational AI model, Pathways Language Model 2 (PaLM 2).

Before individual data is leveraged, organisations must complete a Data Protection Impact Assessment (DPIA) to ensure that fundamental rights and freedoms are considered and protected.

GDPR states that a DPIA is required where a type of processing, in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of individuals.

A DPIA assessment demonstrates compliance and ensures that data controllers mitigate against any data protection risks arising from a type of processing that entails a high risk.

It seeks to ensure, among other things, that the processing is necessary and proportionate and that appropriate safeguards are in place in light of the risks.

This statutory inquiry forms part of the wider efforts of the DPC where they are looking into regulating the processing of personal data in the development of AI models and systems.