Deference, Diffidence, and Data

“Deference and diffidence… led to insufficient decisive action or even clear and pointed warnings.” – Patrick Honohan, 2010 

“It was a period where I bought into a system of regulation that didn't work. The system failed and I regret that." - Patrick Neary, 2015 

Last week was dominated by news of a potential AI apocalypse, with no less than the United Nations declaring frontier models an existential threat to humanity. So, it was refreshing to see Ireland’s AI minister Niamh Smyth bring such positive energy in her opening statement at the Oireachtas AI Committee.  

“It is clear that this technology offers immense opportunities to benefit society and make our individual and collective lives better… But”, she added, it also has “serious implications for how our societies function and AI creates very real security and autonomy risks that require appropriate oversight.” 

Thankfully, we heard that Ireland’s regulatory environment is up for the challenge:  

“Progress on national legislation is vital in cementing Ireland’s position as a centre of regulatory excellence and as a strong voice in Europe advocating for well-designed digital regulation, that is fit for purpose to protect individuals’ safety and fundamental rights while promoting the adoption of trustworthy AI and enabling innovation.” 

The rest of Niamh Smyth’s engagement with the committee would perhaps have alarmed onlookers concerned primarily with "well-designed digital regulation”, but as Minister of State for “Trade Promotion, AI and Digital Transformation” within the Department of Enterprise, selling the positives of the technology is baked into her role.

She seemed taken aback when grilled on specific negatives, such as whether consultants on loan from the Big Four being allowed to shape AI regulation represented a conflict of interest, or whether a KPMG report on data centres was “doctored” to remove energy or environmental criticisms, or whether Ireland proposed stripping data protections from EU citizens around AI (more on this later). Alas, she did not have many answers to hand for sceptical deputies.  

But in fairness, Smyth is merely the political face of AI; Enterprise minister Peter Burke is the one who must oversee both the AI Office and IDA Ireland, the State’s inward investment agency responsible for attracting AI companies to Ireland in the first place. Moreover, the AI office isn’t a regulator. It was established in the new Regulation of Artificial Intelligence Act, but its role is to “coordinate” compliance and make sure any complaints find their way to the correct regulation authorities (eg. the Data Protection Commission or Workplace Relations Commission).  However, the office also serves to "promote and foster AI innovation and literacy", an aim shared by the department more broadly.  

Niamh Smyth’s messaging did include concerns over the potential impact on the labour market, but when asked if any union, civil society or climate representatives were invited to speak at next month’s International AI Summit in Dublin, she was forced to admit there were none: “It is industry focussed; I’ve never denied that. I’m in the Department of Enterprise”. Arguably there is something of a tightrope walk between promotion and regulation, but for Enterprise ministers, the angry stakeholders are the business executives pointing to the “digital divide” and decrying the slow pace of adopting AI, not the workers or sole traders losing their incomes to it, the parents worried about cognitive offloading happening in their children’s brains or the households competing with data centres for energy.  

Even if you accept that an enterprise minister will take an enterprise stance, the echoes of pre-2008 promotion-above-regulation are alarming.  When Smyth speaks of "cementing Ireland's position as a centre of regulatory excellence", I get the heebie-jeebies.  

I am reminded of former Financial Regulator Patrick Neary. In 2006, two years before the jig was up on Irish banking, Neary wrote of the innovative nature of the firms Ireland is attracting:  

“It is no accident that the international financial services firms at the cutting edge of financial product innovation and with enormous technical know-how and expertise are establishing a major presence in Ireland. The regulatory system we are developing is fully capable of meeting the challenge of overseeing such firms.” 

Neary saw his role as facilitating “innovation and competitiveness" in the years preceding the crash. As regulator he had a mandate to promote financial services, something that he later told the banking inquiry was "a very difficult concept” and "irreconcilable with the role of a regulator”.  

Also in 2006, he delivered a conference speech in praise of light-touch regulation:  

"We feel a regulatory approach is good for business and that it is not overly rules-based and encourages good business practice by allowing each regulated financial service provider to determine for itself how best to abide by regulatory requirements." 

But the regulator wasn't on a solo run back then. This approach was government policy, as set out in ‘Regulating Better’, a 2004 White Paper called from the Department of the Taoiseach. This white paper, according to the banking inquiry report, “reflected the Government’s attitude towards regulation at the time and may have contributed to the continued preference for a moral suasion approach over a more interventionist approach.” 

Ireland’s light-touch approach was its selling point. During the banking inquiry hearings, ex-Taoiseach Bertie Ahern was asked about a 2007 speech he gave at a breakfast meeting for the US financial Services Industry – accompanied by Neary - in which he boasted:

“International benchmarking studies show that Ireland is very lightly regulated compared to most of our European colleagues”.

When this was quoted back to Bertie, he replied:

“you’re trying to put ‘lightly regulated’ as something that’s bad.” 

We now know that this approach was disastrous. The banks ignored the rules governing lending limits on property. A domestic boom, underpinned by lax lending, created a giant bubble. According to the IMF, “In the five years to mid-2008... bank assets grew to some 500 percent of GDP”.  When the music stopped, loan losses across all banks in Ireland "came to well in excess of €100 billion”, .  

Ok, so maybe at this point the analogy starts to creak. The actions of the Irish state and regulators are not in themselves creating an asset bubble. But while the rules governing regulation of Big Tech are written in Brussels, many are enforced in Dublin. Ireland hosts the European offices of sixteen of the world's twenty largest technology companies. They are choosing Ireland’s tax treatment, but also its light-touch regulatory environment around data protection. The state’s dependence on these multinationals for billions in corporation taxes serves as an obvious incentive not to scare them off and feeds a perception that Irish authorities are going easier on the companies.  

"A lot of US firms think that Europe is over the top when it comes to data protection”, John Whelan, head of the A&L Goodbody's Silicon Valley office, told the Irish Independent in 2015, “but they like the approach that Ireland takes and this is why many choose to be regulated here".  

That same year, Peter Schaar, a former Federal Data Protection Commissioner in Germany, remarked: “Of course Facebook would go to a country with the lowest levels of data protection. It's natural they would choose Ireland.” 

Ancient history? In January 2024, Italy's data protection authority, the Garante, notified OpenAI it found evidence of GDPR breaches, including the mass collection of personal data to train algorithms. Three weeks later, OpenAI established its main EU base in Ireland, making the DPC its lead regulator. When the Garante fined the company €15 million later that year, OpenAI appealed, and the Court of Rome annulled the decision, ruling that competence had passed to Dublin. This prompted accusations from campaigners of “forum shopping”, that the company chose Ireland to avoid fines. Even if the timing is purely coincidental, allowing companies experience a different enforcement of the rules depending on which EU country they set up a headquarters in, invites regulatory arbitrage . For most of Big Tech, that country is Ireland.

Some go further, suggesting Dublin is the voice for Silicon Valley in Brussels. This implies that Dublin not only sides with American tech firms and their interests but also actively lobbies on their behalf within the bloc. While some EU members states want to increase the regulation of these firms and expand their own indigenous sector, Ireland wants the opposite: open markets and light touch regulation. More broadly it suggests a tension over our handling of tech oligarchs, fissures that deepen each time our latest corporation tax returns are published. 

This makes controversies like the reported proposal to drop GDPR rights from users of AI products so politically dangerous. It followed the leaking of a draft text relating to the “Digital Omnibus”. Digital campaign group noyb cited Article 88c as effectively stating that the use of personal data “in the context of AI” should automatically be lawful. Digital rights campaigner and noyb founder Max Schrems described this move as ‘digital expropriation’:

“Everything we have ever entered into digital systems, or that AI corporations have otherwise obtained, becomes fair game for AI corporations to use.”

It is not hard to understand why the AI firms want this as it is essential to the product they sell. As Ireland currently holds the EU presidency, while also being home to eight of the world’s leading AI developers, campaigners have understandably been pointing the finger at Dublin.  

Addressing the AI Committee, Niamh Smyth denied that it was Ireland’s text, saying the Council of the EU proposed it, even though it is typical for presidency compromise texts to be drafted by the presidency. 

“These proposals are under active negotiation at the council”, the minister told Solidarity TD Paul Murphy, “member states are still considering their position this week... what is under discussion is a draft simplification proposal... “ 

Ireland, as holder of the EU presidency, stands accused of drafting a text that would weaken data protection around AI. It is hosting an International AI Summit with no union, civil society or climate representatives among the speakers. Its AI Office sits within the Department of Enterprise with a remit to "promote and foster AI innovation and literacy". When the Digital Omnibus negotiations conclude, we may learn whether Ireland's promotion of Big Tech proves, as Patrick Neary said of his own mandate, "irreconcilable with the role of regulator".