Telling Employees About AI Tools: GDPR Transparency for Irish Employers

If an AI tool handles your employees' personal data, GDPR transparency means you should tell them clearly what it does with that data, why, and what rights they have, using plain language and at the right time. This applies whether the tool sits inside an HR system, monitors work activity, or is a general assistant that staff use day to day. This guide explains how to tell employees about AI tools under the Irish Data Protection Commission's published guidance, what the Article 29 Working Party transparency guidelines add, and a practical way to do it. It covers transparency only. Whether you have a lawful basis, or need a data protection impact assessment, are separate questions; our summary of the DPC guidance on AI and large language models covers the wider picture.

What the DPC says organisations must tell people

The Data Protection Commission (DPC) has a page on the right to be informed under Articles 13 and 14 of the GDPR. It says organisations must tell individuals what is happening to their data and that the information should be "easily accessible and easy to understand", typically through a privacy notice. The page does not show a date. For data collected directly from the individual, it lists, among other things:

• who the organisation is and how to contact it, and the Data Protection Officer's details where there is one;
• the purposes of processing and the legal basis;
• who receives the data, and any transfers outside the EU with the safeguards used;
• how long the data is kept, or the criteria used to decide;
• the individual's rights, including access, rectification, erasure, restriction, portability and objection, and the right to complain to a supervisory authority;
• any automated decision-making or profiling, with meaningful information about the logic involved.

The DPC's separate "Transparency" page for organisations gives a shorter checklist along the same lines. It says that for automated decision-making the notice should cover the logic involved and its consequences. Our suggestion: if you use AI in HR processes, check this point first.

When and how to provide it

According to the DPC page, the information must be provided at the time the data is collected when it comes directly from the individual, and before any processing for a new purpose. Where data is obtained from somewhere else, it must be given within a reasonable period and no later than one month, or at the first communication or first disclosure if either comes sooner. The page lists limited exceptions, for example where the person already has the information.

On style, the Article 29 Working Party's Guidelines on transparency (adopted 29 November 2017 and revised 11 April 2018; hosted on the European Data Protection Board's site) are a key EU-level document on transparency. Its key messages for an employer drafting an AI notice are:

• Plain and specific language. Vague purposes such as "to develop new services" do not meet the standard, and hedging words such as "may" and "might" should be avoided.
• Layers. A first layer with the purposes, the controller's identity, individuals' rights and the processing most likely to surprise them, with the full information available in one place.
• Active notice of changes. Substantive changes, such as a new purpose, should be communicated actively and not bundled with other material; telling people to check the policy regularly is not enough.
• No surprises. People should understand in advance what the processing involves.

Why this matters in an employment setting

The DPC has published a case study on an employer that used swipe-card data in a disciplinary process. The DPC found the employer had not obtained and processed the data fairly: it had not told the complainant that swipe-card data would be used in disciplinary proceedings, nor told the complainant or other staff that the data was intended for timekeeping. The DPC also stressed that the Article 5 principles apply "regardless of the legal basis" relied on. The lesson carries over to AI: if a tool starts using existing workplace data for a new purpose, such as scoring performance or flagging behaviour, the staff concerned need to have been told. Our guide to employee monitoring and CCTV under data protection law covers the monitoring side in more depth.

The DPC's employer guidance page is aimed at employers as controllers of employee data and notes that employers hold information such as sick leave records, performance reviews and disciplinary actions. We could read only its introduction, so we do not describe any further content from it.

What the DPC says about AI tools specifically

In its blog on AI, large language models and data protection (dated 18 July 2024), the DPC says organisations using AI products should understand what personal data the tool uses and how, and that the provider's documentation should tell them this "in an understandable and accessible form". It notes that an organisation using an AI tool could be a data controller, that a data protection impact assessment may be required and that carrying one out would be best practice anyway. It also says organisations should consider whether they can honour requests such as access and deletion.

A practical way to tell employees: our suggestions

None of the following is a legal requirement in itself. It is one workable approach for a Dublin employer, or any employer in Ireland:

• Keep an AI tool register. For each tool, note who supplies it, what personal data goes in, what comes out and who can see it.
• Map each tool to the notice items. Purpose, legal basis, recipients (including the supplier), retention, transfers outside the EU and automated decisions are the points the DPC lists.
• Update the employee privacy notice before go-live, not after, and say plainly which tools are involved.
• Use a short first layer. A one-page summary, linked to the full notice, along the lines the Working Party describes.
• Tell staff about changes through a dedicated message, such as an email or briefing, rather than a silent edit to a policy page.
• Separate the two audiences. Employees whose data is processed need a notice; employees who use a tool with other people's data need guidance on what they may enter.
• Train the people who handle the answers. Managers and HR will be asked how the tool works, and our guide to GDPR staff training covers the groundwork.

Telling staff something is also a good test of whether you understand the tool yourself. If you cannot describe in two plain sentences what it does with personal data, ask the supplier for more information before you roll it out.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Do we have to tell employees about every AI tool?

The duty relates to processing of personal data. If a tool processes employees' personal data, the notice items apply. If staff use a tool with no personal data going in, the question becomes one of policy. The DPC pages we read do not give a tool-by-tool rule, so a written register helps you decide.

Is a line in the staff handbook enough?

The Working Party guidelines say information should be easily accessible and clear, and that people should not have to search for it. Whether a handbook line suffices depends on how specific and findable it is; vague statements are not favoured.

Do we need to tell employees if the AI tool is only used by managers?

If the tool processes the employees' data, the transparency information is owed to the individuals whose data is processed, whoever operates the tool (this is our reading of the DPC page; check with your DPO or adviser).

Does telling employees replace the need for a lawful basis?

No. The DPC lists the lawful basis as one of the items to be explained in the notice, so it must exist separately.

Where can we check the latest guidance?

On the Data Protection Commission's website and the European Data Protection Board's site. The DPC pages we read were mostly undated, so check whether newer guidance has been published.

Clear, timely notice costs little and makes every later step, from impact assessments to answering staff questions, easier.