Surge in complaints to Data Protection Commission as people use AI to compile submissions 

The briefing heard that a telltale sign AI is being used to compose complaints is when members of the public copy the entirety of the response returned from a portal into the complaint form - including the prompt or question they entered into the engine in the first place, or the chatbot’s follow-up responses. File picture

Complaints to the Data Protection Commission (DPC) surged to an “unprecedented” extent in 2025 on foot of people using AI to compile submissions.

Data Protection Commissioner Des Hogan said the level of referrals, which had already been onerous, jumped by 45% last year to 16,160 new cases, “many of which involved the use of artificial intelligence by persons making complaints”, a trend he said added “to the volume and complexity of the documentation presented”.

The Commission is well on the way to breaching the 20,000-complaint-marker for the full year 2026, the launch of the DPC’s annual report for 2025 heard, though the number of valid breach notifications received in 2025 — 6,521 — represented a 16% drop on 2024.

Describing AI as “a phenomenon”, Commissioner Dale Sunderland said that while the technology “can help someone”, it makes it necessary for the quarter of the DPC’s 295 staff who deal directly with complaints to “hone in on what’s being complained about”.

He stressed that for people who wish to make a complaint or report a data protection breach, their best route remains to “submit something short and to the point”.

The briefing heard that a telltale sign AI is being used to compose complaints is when members of the public copy the entirety of the response returned from a portal into the complaint form - including the prompt or question they entered into the engine in the first place, or the chatbot’s follow-up responses.

The commissioners also noted that AI is increasingly becoming an issue for the DPC in that the scale of personal data used by AI technologies has also increased significantly, “with heightened risks and harms for individuals”.

The DPC completed four large-scale inquiries in 2025, including the investigation of TikTok regarding the transfer of EU user data to China which saw the social media giant handed a €530m fine. A probe regarding the legality or otherwise of the biometric data contained on the Department of Social Protection’s Public Services Card, which saw the Department handed a €550,000 GDPR fine, was a record for a State body.

Mr Sunderland said that a four-day High Court appeal, lodged by the Department regarding the DPC’s decision that all biometric processing related to the card should cease, had concluded last week. 

Asked if the same penalties would apply to the department should the DPC prevail in the action, he said it would be inappropriate to prejudge the pending judgement.

Meanwhile, completed investigations into electronic marketing companies almost doubled in 2025, in a year where online fraud detected by gardaí likewise moved to record levels.

The DPC ran and concluded some 275 cases concerning direct electronic marketing companies — generally involving electronic communications such as text messages or emails — in 2025, an 88% hike on the level of completed investigations seen in 2024, while complaints regarding such companies increased by 20%.

The completed investigations saw 50 warning letters issued to companies on foot of unsolicited marketing communications.

Commissioner Niamh Sweeney noted that some of those cases had an “element” of fraud, particularly about use of direct marketing in relation to the acquisition of new smartphone handsets.

The surge in direct marketing investigations coincides with a gigantic jump in deception offences online, according to garda statistics, with a 183% jump in online auction fraud in 2025 alone.