爱尔兰数据保护委员会《2025年度报告》（Data Protection Commission Annual Report 2025，含"Sharenting"调查结果）

【说明】以下为爱尔兰数据保护委员会《2025年度报告》（2026年6月30日发布）正文（原文，PDF 文字层完整提取）。 官方页面：https://www.dataprotection.ie/en/data-protection-commission-publishes-2025-annual-report 提取范围：全文 140 页，此处提取前约 60 页（目录、前言、2025时间轴、执行摘要、职责、高级团队、案件与投诉、数据泄露、决定与调查）。如需引用，请以官方原文为准。 余下为诉讼、监督、儿童数据保护权、DPO、国际活动、人力与治理及附录，请以官方 PDF 为准。 1 Litigation Annual Report 2025 2 Litigation Glossary CSA Concerned Supervisory Authority DPA Data Protection Authority DPC Data Protection Commission DPO Data Protection Officer EDPB European Data Protection Board GDPR General Data Protection Regulation IMI Internal Market Information System LED Law Enforcement Directive LSA Lead Supervisory Authority OSS One Stop Shop SMC Senior Management Committee AI Artificial Intelligence Contents Foreword 2 Timeline of 2025 4 Executive Summary 6 Mission, Vision and Values of the DPC 10 1. Roles and Responsibilit ies 12 2. DPC Seni or Team 15 3. Cases and Complaints 18 4. Data Breaches 34 5. Decisions and Inquiries 38 6. Litigation 58 7. Supervision 70 8. Children’s Data Protection Rights 90 9. Data Protection Officers 95 10. International Activities 98 11. Human Resources, Communications and Corporate Governance 111 Appendix 1: Report on Protected Disclosures received by the Data Protection Commission in 2025 124 Appendix 2: Energy Report 2025 128 Appendix 3: Statement of Internal Controls 131 Index 133 2 Foreword Foreword 2025 saw an unprecedented 45% increase in complaints received by the Data Protection Commission (DPC), many of which involved the use of Artificial Intelligence (AI) by persons making complaints, adding to the volume and complexity of the documentation presented. At the same time, the scale and complexity of the use of personal data by rapidly advancing AI technologies increased significantly, with heightened risks and harms for individuals. The DPC also experienced a rise in litigation cases during the year taken by companies on foot of cross-border inquiries being initiated and concluded into their data processing activities. Against this backdrop, a hotly debated topic throughout 2025 was the balance between technological innovation and ensuring rigorous protections for our personal data. A pervasive question was whether digital regulation was stifling innovation. The European Commission proposed a series of legislative simplification measures across various regimes including the General Data Protection Regulation (GDPR) while maintaining a consensus view that changes should not be to the detriment to European values including the fundamental right to protection of our personal data as set out in both the EU Charter of Fundamental Rights and the GDPR. In the performance of its functions, the DPC sought to uphold the view that innovation and regulation can and must co-exist in a mutually conducive balance, ensuring the right to data protection while facilitating responsible innovation. During the year the DPC continued to discharge its mandate under the GDPR. Following the harmonised Europe-wide December 2024 European Data Protection Board opinion on Artificial Intelligence, during 2025 the DPC continued to regulate under the GDPR the training of generative AI models by the large technology firms based in Ireland. This work included close cooperation with the DPC’s peer European authorities, in particular in its role as the EU Lead Supervisory Authority for the companies concerned. In April, the DPC concluded its Inquiry into transfers of European User Data by TikTok Technology Limited to China following consensus from its peer EU regulators under the ‘One Stop Shop’ regulatory mechanism of the GDPR where the DPC acts as Lead Supervisory Authority. In May, the Taoiseach and the Minister for Justice opened the new DPC offices on Pembroke Row, in Dublin. With the assistance of the OPW, the new building allowed the DPC to finally house its Dublin-based staff in one centralised modern building. In the same month, the DPC concluded its Inquiry into the use of facial matching technology in the Public Services Card. 3 Foreword During the year the DPC worked with its peer authorities in Europe and agreed the Helsinki Statement in July on how European data protection authorities planned to assist individuals and organisations to remain data protection-compliant through simpler guidance and increased engagement. The DPC increased its cooperation with other digital regulators through the Digital Regulators Group, increased initiatives on advancing the safety of children and the protection of their personal data online and engaged with its European and international colleagues on multiple issues of common concern including on child safety and assurance initiatives. In November, the DPC launched its public awareness Sharenting Campaign which was one of the most watched videos in Ireland in the past five years. The viral #PauseBeforeYouPost ‘Sharenting’ video was viewed world-wide and drew attention to the need to take care when sharing children’s personal data on-line. The DPC deepened its engagement with bodies working on adult safeguarding, produced additional toolkits for schools and established a dedicated group comprising 20 national governing sporting bodies and local partnerships. It also deepened its work with the Irish retail sector. In October, Niamh Sweeney was appointed as a Commissioner for Data Protection, thus completing the move from a one to three-person Commission. The work of the DPC during 2025 could not have been achieved without the untiring commitment of the DPC’s staff which increased to 295 by year end. As Commissioners we wish to acknowledge our staff who drive the DPC’s mission. We also wish to acknowledge our stakeholders including the thousands of data protection officers who with us strive to ensure that the data protection rights of all persons are protected whether by government, private or voluntary organisations. Dr. Des Hogan Chairperson, Commissioner for Data Protection 4 Timeline of 2025 Q1 Data Protection Commission (DPC) signs joint declaration on AI alongside data protection authorities from Australia, Korea, France, and the United Kingdom. Q2 European Data Protection Board (EDPB) statement on age assurance, co-drafted by the DPC, is published. DPC announces Inquiry into X Internet Unlimited Company (XIUC) on the processing of personal data of EU/European Economic Area (EEA) users for the purposes of generative AI model training. DPC fines TikTok Technology Limited €530 million and orders corrective measures following Inquiry into transfers of EEA user data to China. Taoiseach Micheál Martin and Minister for Justice Jim O’Callaghan open new DPC office on Pembroke Row, Dublin. From left to right: Commissioner Dale Sunderland, Minister for Justice Jim O’Callaghan, Taoiseach Micheál Martin and Commissioner Des Hogan opening the new DPC premises on Pembroke Row in Dublin, May 2025. DPC concludes investigation and issues Final Decision into facial matching technology regarding the Department of Social Protection’s Public Services Card. Final Decision published following an Inquiry into a personal data breach at the City of Dublin Education and Training Board. 5 Q3 DPC announces Inquiry into transfers of personal data to China following TikTok Technology Limited’s discovery of an issue in February 2025 that resulted in some EEA user personal data being stored on servers located in China. Launch of Adult Safeguarding Toolkit to protect vulnerable adults. DPC announces Inquiry into Children’s Health Ireland at Tallaght University Hospital. DPC is shortlisted for award under the enforcement category at the 2025 Global Privacy Assembly in Seoul, Republic of Korea. DPC, as part of the Digital Regulators’ Group, launches the Short Guide to Digital Regulation. Q4 DPC and Coimisiún na Meán sign Cooperation Agreement and issue a joint statement on Advancing the safety of children and the protection of their personal data online. Niamh Sweeney appointed as a third Commissioner for Data Protection. From left to right: Commissioner Dale Sunderland, Commissioner Des Hogan and Commissioner Niamh Sweeney. DPC launches #Pausebeforeyoupost ad campaign about ‘Sharenting’ which generates over 150 million views globally. Deirdre O’Donovan is appointed as the DPC’s Director of Legal. DPC hosts the Kick Start Compliance conference in Croke Park, focusing on data protection in sport. DPC issues Final Decision following an Inquiry into University of Limerick. 6 Executive Summary Breach Notifications Key Numbers: January 1 – December 31, 2025 Executive Summary Executive Summary Key Numbers: January 1 – December 31, 2025 New cases1 received 16,160 representing a 45% increase from 2024 (11,091). Cases concluded 11,734 representing a 12% increase from 2024 (10,510). Cases concluded through complaint-handling 2,569 representing a 9% increase from 2024 (2,357). Electronic direct marketing investigations concluded 275 representing a 88% increase from 2024 (146). Cross-Border complaints concluded 208 representing a 43% increase from 2024 (145). Breach notifications received 6,521 Half of all notifications arose as a result of correspondence being sent to the wrong recipient. Calls received 6,654 1 Cases are defined as contacts that require further engagement b eyond the initial query. Cases in this instance can therefore include complaints from individuals, but also encompasses requests for advice and guidance which do not include a complaint element. This figure does not include contacts from the media, speaking invitations, breach notifications or consultation requests. 7 Executive Summary7 Large-Scale Inquiries concluded 4 Final Decisions 10 Provisional Decisions 92 Administrative fines imposed €530,773,000 The largest fine was a €530 million penalty against TikTok Technology Limited regarding the transfer of the personal data of EU/EEA users to China. Since May 2018, the DPC has issued €4.04 billion in fines. 163 Notifications of amicable resolutions were achieved through the GDPR Article 60 cooperation mechanism, representing a 41% increase from 2024 (115). New Inquiries In 2025 the DPC announced the commencement of new inquiries into: • the physical safety and security of children’s health records at Children’s Health Ireland at Tallaght University Hospital; • transfers of EU/EEA personal data by TikTok Technology Limited to China; and • use of EU/EEA user data for AI model training by XIUC. 8 Executive Summary Received 1,015 Article 61 GDPR Mutual Assistance Requests from other European regulators. Participated in over 140 European Data Protection Board (EDPB) meetings. DPC was represented on 13 EDPB subgroups. The DPC provided input and observations on over 77 pieces of proposed national legislation. Binding Corporate Rules The DPC was the lead reviewing supervisory authority (SA) in relation to 13 Binding Corporate Rules (BCR) applications from eight different companies, and acted as co-reviewer for other SAs on nine BCR applications from six different companies. Pause Before You Post Campaign The DPC launched a national public awareness campaign called Pause Before You Post which highlighted the risks associated with ‘sharenting’ – i.e. the habitual sharing of children’s personal information, photos, and videos online by parents. Since its publication, the campaign has reached a wide audience. Pause Before You Post The campaign generated over 150 million views globally. 45 million views across the DPC’s social channels. New Guidance Several new pieces of guidance were also published by the DPC in 2025, including: An Adult Safeguarding Toolkit to support organisations dealing with the personal data of vulnerable adults. A Short Guide to Digital Regulation which was created in collaboration with the other members of the Digital Regulators’ Group – Coimisiún na Meán, ComReg and the Competition and Consumer Protection Commission – to clarify common queries in the digital regulation space in Ireland. An online resource for schools which supports them in taking a proportionate and compliant approach to personal data processing. A series of infographics focusing on data protection in sport. Sharenting – Top Tips – an online resource offering practical tips to limit the risks posed when parents share or post data about their children’s lives online. The DPC’s handling of Subject Access Requests – guidance for data controllers as to how to appropriately respond to a Subject Access Request made under Article 15 of the GDPR. Staff of the DPC presented at over 100 speaking events in 2025, both nationally and internationally. 9 10 Mission, Vision and Values of the DPC Mission The DPC’s mission is to uphold the consistent application of data protection law through engagement, supervision and enforcement, and driving compliance with data protection legislation. The DPC safeguards the data protection rights of individuals and provides clarity for the organisations it regulates by: • educating stakeholders on their rights and responsibilities; • taking a fair and balanced approach to complaint handling; • communicating extensively and transparently with stakeholders; • participating actively at European Data Protection Board level to achieve consistency; • cultivating technological foresight, in anticipation of future regulatory developments; • sanctioning proportionately and judiciously; and • retaining and developing the expert capacities of its staff to ensure operational effectiveness. 11 Mission, Vision and Values at the DPC Vision and Values The DPC is committed to being an independent, fair and consistent regulator of EU data protection law; regulating with clear purpose, trusted by the public, respected by our peers and effective in our regulation. The DPC applies a risk-based regulatory approach to its work, so that its resources are prioritised on the basis of delivering the greatest benefit to the maximum number of people. The DPC is a rewarding and challenging place to work, with a focus on retaining, attracting and allocating the most appropriate people to deliver on its mandate, recognising the value and capacities of its staff as its most critical asset. In the conduct of its duties, the DPC is committed to act always in a way that is: Fair Expert Consistent Transparent Accountable Forward Looking Engaged Independent Results-driven The DPC’s internal values focus on promoting a work culture of trust and respect, where staff feel valued, informed, and confident that decisions are fair and transparent, with strengths encouraged and areas for development supported. The goal is to ensure empathy and understanding among colleagues with opportunities for learning, growth, and advancement accessible to all, fostering equality, diversity and inclusion. Building a workplace that prioritises fairness, friendliness, and collaboration, where innovation is welcomed and supported all form part of the DPC’s internal culture. Regulatory Strategy The DPC’s Regulatory Strategy for 2022-2027 sets out how the DPC delivers on its mandate to uphold the fundamental right to data protection. The Strategy, and the work that flows from it, has been based around five interconnected pillars of equal priority. 1. Regulate consistently and effectively 2. Safeguard individuals and promote data protection awareness 3. Prioritise the protection of children and other vulnerable groups 4. Bring clarity to stakeholders 5. Support organisations and drive compliance The Strategy is arranged according to fundamental goals, underpinned by the DPC’s mission, vision and values, which collectively contribute to the delivery of its strategic priorities. Roles and Responsibilities 1. 13 Roles and Responsibilities Roles and Responsibilities 1. 1. Roles and Responsibilities Functions of the DPC The right to the protection of personal data is set out in EU law in the EU Treaties and in the EU Charter of Fundamental Rights. The DPC is the national independent authority in Ireland responsible for upholding this fundamental right. The DPC is tasked with monitoring the application of the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679). The DPC also has functions relating to other regulatory frameworks, including the Irish ePrivacy Regulations (2011) and the EU Directive known as the Law Enforcement Directive (LED). The statutory functions of the DPC are as established under the Data Protection Act 2018, which gives further effect to the GDPR and to the LED. The core functions of the DPC, under the GDPR and the Data Protection Act 2018 include: • driving improved compliance with data protection legislation by controllers and processors; • handling complaints from individuals in relation to potential infringements of their data protection rights; • conducting inquiries and investigations into potential infringements of data protection legislation; • promoting awareness among organisations and the public of the risks, rules, safeguards and rights incumbent in the processing of personal data; • co-operating with data protection authorities in other EU Member States on mutual issues, involving cross-border processing of personal data; and • acting as EU Lead Supervisory Authority for data controllers with their main establishment in Ireland. The ePrivacy Regulations concern the processing of personal data in the context of electronic communications such as electronic direct marketing. The Law Enforcement Directive (LED) applies to the processing of personal data by bodies with law-enforcement functions in the context of the prevention, investigation, detection or prosecution of criminal offences or execution of criminal penalties. In addition to its functions under the GPDR, the DPC continues to perform its regulatory functions under the Data Protection Acts 1988 and 2003, in respect of any complaints that relate to the period before 25 May 2018 (when the GDPR came into force), as well as in relation to certain limited other categories of processing, irrespective of whether that processing occurred before or after 25 May 2018. 14 Roles and Responsibilities Funding and Administration—Vote 43 (Previously Vote 44) The DPC is funded by the Exchequer and does not derive monetary gain from fines imposed. On confirmation by the Courts, administrative fines imposed by the DPC are remitted to the central exchequer. The Chairperson of the Commission is the Accounting Officer for the Commission’s Vote, Vote 43. The DPC’s 2025 funding was €29.12 million, of which €19.357 million was allocated for pay related expenditure, and €9.763 million was allocated to non-pay expenditure. The funding for 2025 represented an increase of approximately €1 million on the 2024 allocation. DPC Senior Team 2. DPC Senior Team 2. 16 DPC Senior Team 2. DPC Senior Team The DPC’s Senior Management Committee (SMC) comprises the Commissioners for Data Protection, Directors and Principal Officers. The Commissioners and members of the SMC oversee the proper management and governance of the organisation, in line with the principles set out in the Corporate Governance Standard for the Civil Service (2015). The SMC has a formal schedule of matters for consideration and decision, as appropriate, to ensure effective oversight and control of the organisation. The DPC Senior Management Team from left to right: David Murphy, Cathal Ryan, Diarmuid Goulding, Jennifer Dolan, MB Donnelly, Deirdre O’Donovan, Niall Cavanagh, Dale Sunderland, Dr. Des Hogan, Ian Chambers, Gráinne Duffy, Labhras Sammin, Sandra Skehan and Cian O’Brien. Not in photograph: Andrew Carroll, Graham Doyle, Elizabeth Finn, Gráinne Hawkes, Sarah Lea, Ultan O’Carroll, and Niamh Sweeney. 17DPC Senior Team During 2025, the SMC comprised: Dr Des Hogan Chairperson, Commissioner for Data Protection; Dale Sunderland Commissioner for Data Protection; Niamh Sweeney Commissioner for Data Protection (from Q3 2025); Cian O’Brien Director and Deputy Commissioner with responsibility for Large-Scale Inquiries including Investigations & Cross-Border Complaints; Deirdre O’Donovan Director and Deputy Commissioner, with responsibility for Legal (from Q3 2025); Andrew Carroll Deputy Commissioner, Head of Large-Scale Inquiries & Investigations Team 2; Niall Cavanagh Deputy Commissioner, Head of Large-Scale Inquiries & Investigations Team 1; Ian Chambers Deputy Commissioner, Head of Frontline, Breaches, Complaints and Information; Jennifer Dolan Deputy Commissioner, Head of Inter Regulatory Affairs & ePrivacy Prosecutions; MB Donnelly Deputy Commissioner, Head of Strategy, Finance, Governance and Risk; Graham Doyle Deputy Commissioner, Head of Corporate Affairs, Media & Communications; Gráinne Duffy Deputy Commissioner, Head of People and Learning; Elizabeth Finn Deputy Commissioner, Head of Cross-Border Complaints & Inquiries; Diarmuid Goulding Deputy Commissioner, Head of Large-Scale Inquiries & Investigations Team 3; Gráinne Hawkes Deputy Commissioner, Head of EDPB/ International Affairs & AI Act; Sarah Lea Deputy Commissioner, Head of Legal Affairs (from Q2 2025); David Murphy Deputy Commissioner, Head of Consultation & Supervision Team 1; Ultan O’Carroll Deputy Commissioner, Head of Regulatory Technology Affairs; Fleur O’Shea Deputy Commissioner, Head of Legal Affairs (until Q2 2025); Cathal Ryan Deputy Commissioner, Head of Consultation & Supervision Team 2; Labhras Sammin Deputy Commissioner, Head of Enterprise & ICT Operations; and Sandra Skehan Deputy Commissioner, Head of National Complaint Handling & Inquiries including Access Requests, LED, Breach & Processing. Cases and Complaints 3. 19 Cases and Complaints 3. Cases and Complaints In 2025, the DPC experienced its busiest year to date, with the DPC receiving 16,160 new cases2. This represents a 45% increase on the number of cases received in 2024 (11,091). October 2025 was the busiest month ever recorded with 1,879 cases logged. 2024 Cases Concluded (12% increase from 2024) 2025 10,510 11,734 1200 1000 800 600 400 200 100 0 2024 New Cases Processed (45% increase from 2024) 2025 11,091 16,160 1800 1600 1400 1200 1000 800 600 400 200 0 The most common issues raised through email and webforms concerned non-responses to Subject Access Requests, concerns relating to the processing of personal data, and issues relating to social media accounts, many of which fell outside the scope of the GDPR. Telephone contacts reflected similar trends. Callers most frequently sought advice on concerns regarding the processing of their personal data or guidance on making a Subject Access Request. consultation requests. In total, the DPC responded to more than 6,500 calls from individuals and organisations, of which 85% were from individuals. A total of 11,734 cases were concluded in 2025, representing a 12% increase on the number of concluded cases in 2024. 9,435 of concluded cases were received in 2025. 2 Cases are defined as contacts that require further engagement b eyond the initial query. Cases in this instance can therefore include complaints from individuals, but also encompasses requests for advice and guidance which do not include a complaint element. This figure does not include contacts from the media, speaking invitations, breach notifications or Cases and Complaints 3. 20 Cases and Complaints Top Queries to the DPC in 2025 1. Individuals seeking guidance on non- response to Subject Access Requests. 2. Processing of personal data. 3. Social media accounts. 4. How to make a Subject Access Request. 5. Domestic CCTV. 6. Organisations seeking specific guidance regarding GDPR legislation. 7. Breaches/breach notification. When individuals contact the DPC raising a concern, the DPC generally engages directly with the organisation involved, specifically the organisation’s Data Protection Officer (DPO) where one has been appointed. This engagement typically leads to resolution without requiring further intervention by the DPC. In situations where escalation is necessary, it is invaluable for the DPC to have access to written correspondence between the individual and the organisation, detailing the issue and the positions of both parties. This documentation helps streamline the assessment of a matter raised by an individual. Exercising of rights under the GDPR and the use of Artificial Intelligence (AI) tools. During 2025, the DPC observed an increase in individuals using AI tools to assist them exercise their data protection rights. While AI tools can assist individuals in drafting clear and well-structured correspondence, the DPC recommends caution with regards to any inputting of personal data when using these tools. Individuals should also exercise caution when using AI tools to generate complaints on their behalf, as this can often lead to inaccurate or invalid requests being submitted. This can then, in turn, hinder the exercising of rights, as well as the handling of any subsequent complaint. 21 Cases and Complaints Complaints Of the 16,160 new cases3 received in 2025, 3,385 progressed to the complaint-handling process. This represents a 27% increase on the number of cases progressing to the complaint-handling process during 2024. Overall, the DPC concluded 2,569 complaints in 2025. This included 1,691 complaints received prior to 2025 and represents a 9% increase on the 2,357 complaints concluded in 2024. Complaints received under the GDPR: Top 3 Issues in 2025 (75% of overall cases) % of total Subject Access Request 42% Right to erasure 17% Fair processing 16% Subject Access Rights Article 15 of the GDPR provides that an individual may obtain from an organisation sufficient, transparent, and easily accessible information about the processing of their personal data so that they can be aware of and verify the lawfulness of the processing and the accuracy of the processed data. The right of access is one of the fundamental rights conferred on individuals by the GDPR. By the end of 2025, the DPC had received 1,280 complaints solely related to the right to access, accounting for 42% of all complaints received through the year. As in previous years, alleged noncompliance with Subject Access Requests remains the primary source of complaints to the DPC. A review of these complaints indicates that the majority of the complaints received have underlying issues at their core, such as, a deterioration in an employer–employee relationship, disputes involving financial matters, or situations that effectively began as poor customer service rather than a particular data protection concern. The DPC continues to observe that organisations must do more to enhance transparency and provide individuals with fuller, more meaningful information when responding to Subject Access Requests. Although the DPC has noted improvements in practices across most organisations, challenges remain. Subject Access Request Tips Where organisations rely on exemptions when responding to a Subject Access Request, they frequently fail to clearly explain to the individual the rationale for applying those restrictions. Organisations are not adequately documenting how and why they reach particular determinations when assessing a Subject Access Request. Organisations should prepare a schedule listing any documents being withheld or redacted, clearly setting out the reasons for doing so and identifying the specific provisions of the 2018 Act or the relevant GDPR articles relied upon to restrict access. This information should then be communicated to the individual in a clear, concise, and transparent manner as part of the response to their Subject Access Request. 3 Cases are defined as contacts that require further engagement beyond the initial query. Cases in this instance can therefore include complaints from individuals, but also encompasses requests for advice and guidance which do not include a complaint element. This figure does not include contacts from the media, speaking invitations, breach notifications or consultation requests. 22 Cases and Complaints Once a complaint has been submitted to the DPC, an organisation’s ability to clearly demonstrate the analysis underpinning its decision-making process will help expedite the DPC’s examination of the matter. This provides benefits to organisations, individuals, and the DPC alike. Where responses are comprehensive and exemptions have been appropriately and reasonably applied, such cases may be suitable for progression through the DPC’s fasttrack complaint assessment and early-resolution unit. Right to Rectification Article 16 of the GDPR provides for the rectification of personal data where the personal data that is being processed is inaccurate, or, taking into account the purposes of processing, the data is incomplete in some way. Organisations are obliged to rectify inaccurate personal data when it becomes apparent, whether through their own processes or following a request from an individual. If personal data is identified as inaccurate as a matter of fact, or incomplete, the organisation must take steps to amend this by correcting or completing the personal data. If an organisation is unable to correct it directly, it may, where appropriate, meet its obligations by adding a supplementary statement to clarify and rectify the inaccuracy. The right to rectification applies, in particular, to matters of fact, which are often misinterpreted. A ‘matter of fact’ refers to information that can be objectively proven true or false. The right is usually not applicable to requests where the subject m