Regulation of Artificial Intelligence Bill 2026: Committee Stage (Resumed) and Remaining Stages
Seanad Éireann — 2026-07-15
============================================================

Niamh Smyth (FF), Cavan-Monaghan

I thank the Senator for her comprehensive arguments on each of those amendments. As regards the use of personal data, including children's personal data, within the sandbox, I understand and support the underlying concerns motivating the amendment. Nobody in the House disputes that children's personal data warrants the highest standard of protection, including in the context of AI.
Article 57 of the AI Act requires member states to establish an AI regulatory sandbox. The purpose of the sandbox is to promote AI innovation, support the development of compliant AI systems and facilitate regulatory learning across the AI ecosystem. Article 57 also mandates that the national competent authorities must involve national data protection authorities in the establishment and operation of AI regulatory sandboxes.
Article 59 of the AI Act expands on the use of personal data in the sandbox framework. Section 47 of the Bill gives effect to Article 59, which permits personal data, lawfully collected for one purpose, to be further processed solely within an AI regulatory sandbox and for the purpose of developing, training and testing certain AI systems. Article 59 provides a robust safeguard in terms of processing sensitive personal data in the sandbox. Those conditions include, among others, that the AI system is being developed to safeguard a substantial public interest such as public health, safety or the environment, and that the processing of personal data would require consent from the data subject in certain circumstances.
Article 59 does not disapply the general data protection regulation; it operates within it. The GDPR provides that children merit specific protections because they may be less aware of the risks involved. That principle runs through the regulation. Where consent is the basis relied upon for an information society service, Article 8 of the GDPR requires parental consent below the relevant age threshold, which section 31 of the Data Protection Act 2018 sets at 16 in this jurisdiction. The Data Protection Commission's published guidance on children's data goes further, requiring controllers to treat the best interests of the child as a primary consideration, and takes the view that profiling or automated decision-making in respect of children will rarely be justifiable.
None of this is disturbed by section 47. A sandbox participant processing any personal data must identify a lawful basis, satisfy data minimisation and purpose limitation, and conduct a data protection impact assessment, where required, and is directly answerable to the Data Protection Commission, as provided in section 47(2) of the Bill.
The amendment, therefore, does not add a protection that is missing; it duplicates protections that already bind every controller in the State. While I share the underlying objective of ensuring children's data is never processed carelessly in an AI sandbox, I do not accept that the amendment is necessary to achieving that. Article 59 of the AI regulation, faithfully transposed by section 47, confines this process to a narrow, closed set of public interest purposes subject to isolation, no adverse decision, deletion and continuous monitoring conditions, with the Data Protection Commission statutorily embedded in oversight under section 47(2). The GDPR, including child-specific protections under Article 8 and Recital 38, and the enhanced domestic threshold in section 31 of the Data Protection Act 2018, continues to apply over and above all of that, undiminished.
The Department is required to consult with the Data Protection Commission pursuant to Article 36(4) of the GDPR and section 84(12) of the Data Protection Act 2018 with respect to the personal data provisions in the Bill. The Department has concluded that consultation and I am satisfied the personal data provisions in the Bill are well developed and in line with requirements set out under the GDPR.

---

Source: Houses of the Oireachtas. Licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). The Official Report is revised after first publication; the fetch timestamp below identifies the version quoted.

Record URI: https://data.oireachtas.ie/akn/ie/debateRecord/seanad/2026-07-15/debate/main
Retrieved: 2026-08-27T06:52:16+00:00
Sitting date: 2026-07-15