2026 IESC 27 Murray J

(1)(

1. f)of Regulation (EU) 2016/679 (“the GDPR”). The findings arose from the transfer by TikTok of certain personal data of users of its services, to jurisdictions outside the European Economic Area (“the EEA”). As a result, the DPC directed TikTok to (
2. a)suspend those transfers of data, (
3. b)bring the processing of the data into compliance with the GDPR, and (
4. c)pay two administrative fines of €485M and €45M. TikTok responded by initiating these proceedings, a statutory appeal against the decision as enabled by ss. 142 and 150 of the Data Protection Act 2018 (“the 2018 Act”). 2. The matter now comes before this court by way of the DPC’s appeal against a decision of the High Court (Mulcahy J.) granting a stay on the first two parts of this direction pending the hearing of the full statutory appeal ([2025] IEHC 619). The parties agree that the effect of the relevant provisions of the 2018 Act is that the obligation to pay the administrative fines – the third part of the direction – was automatically stayed upon the commencement of these proceedings. 3. Stays on administrative decisions that are the subject of proceedings by way of judicial review, are not unusual. The factors to be taken into account in determining whether to grant such orders have been identified and explained in a decision of this court, Okunade v. Minister for Justice [2012] IESC 49, [2012] 3 IR 152 (“Okunade”). The motion in this case, however, differs from most applications of this kind. This is so not 2 only because of the complexity of the legal and factual background to the appeal, and not only because the application for a stay arises in the context of a statutory appeal rather than proceedings by way of judicial review. It is also different because a significant question arises as to whether this application is governed by Okunade at all, or whether it should be determined by reference to a test developed by the Court of Justice of the European Union (“the CJEU”) in the context of interim measures pending a decision as to the validity of a provision of EU law. The DPC says that by reason of the EU-wide effect of its decision, the test formulated in Okunade does not apply to the grant or withholding of the stay sought by TikTok. It says that, instead, the application should be determined using criteria formulated in Joined Cases C-143/88 and C92/89, Zuckerfabrik Süderdithmarschen AG v Hauptzollamt Itzehoe and Zuckerfabrik Soest GmbH v. Hauptzollamt Paderborn (EU:C:1991:65) (“Zuckerfabrik”). 4. Two issues thus arise: which of these tests governs the application for a stay, and how does that test fall to be applied in this case? The parties 5. The involved legal and factual background to the impugned decision starts with the GDPR. This Regulation has as its object the protection of natural persons with regard to the processing of their personal data. It mandates the establishment in each Member State of the European Union of one or more independent public authorities – ‘the supervisory authority’. That authority is responsible for monitoring the application of the Regulation (Article 51). The DPC is designated by the 2018 Act as ‘the supervisory authority’ in this jurisdiction for the purposes of the GDPR (s. 11 of the 2018 Act). 3 6. TikTok – a company established in accordance with Irish law and having its main establishment here – describes itself as ‘the service provider of the Tik Tok platform for the EEA and Switzerland’. The ‘TikTok platform’ is a social media service that enables its users to create, share and watch short form video content. TikTok’s ultimate parent is ByteDance Ltd., a Cayman Islands registered company. It forms part of a group of entities (“ByteDance”) some of which are based in China (“the China Group Entities”). 7. When providing services to users of its platform, TikTok processes certain personal data of those users and (together with TikTok Information Technologies UK Ltd.) functions in the EEA as the ‘controller’ in respect of that data within the meaning of Article 4

(7)of the GDPR. By reason of that status, TikTok is subject to particular obligations, insofar as it is the person that determines the purposes and means of the processing of personal data.

1. The operation of the TikTok platform involves the processing of such data on a significant scale: there were more than 1 billion monthly active users of these services as of September 2021, and between July and December 2024 TikTok had on average 159 million monthly active recipients in the European Union Member State countries alone. As explained shortly, some of that data processing takes place in jurisdictions outside the EEA (“third countries”), and the GDPR imposes significant restrictions on cross-border processing of this kind (the GDPR has been incorporated into the EEA Agreement).
2. The supervisory authorities may discharge an important role in regulating transfers of personal data to third countries. Having regard to the location of TikTok’s main establishment, the DPC is competent to act as the ‘lead supervisory authority’ in respect 4 of any cross-border processing carried out by TikTok (Article 56 of the GDPR). As such, the DPC is ‘the sole interlocutor’ under the GDPR for that cross-border processing (Article 56

(6)). While, pursuant to Article 60, it discharges that function in co-operation with other supervisory authorities, the GDPR envisages the lead supervisory authority operating as what Advocate General Bobek in Case C-645/19 Facebook Ireland Ltd. and ors. v. Gegevensbeschermingautoriteit (EU:C:2021:5) described as ‘a one-stop-shop’. The legal context

1. The law of the European Union attaches high importance to the protection of personal data. Article 8 of the Charter of Fundamental Rights of the European Union (“the Charter”) expressly guarantees that protection, and this is given effect to by inter alia the GDPR.
2. These protections can be readily applied to activities occurring within the EU/EEA. However, more difficult questions present themselves when data is transferred to third countries. In an effort to ensure that similar protections can be enforced in respect of such transferred data, Chapter V of the GDPR lays down conditions that must be complied with in making such transfers. These transfers may, in particular, be authorised where they are made to a jurisdiction which the European Commission has determined ensures an adequate level of protection for such data. Provision is made for these ‘adequacy decisions’ of the European Commission by Article 45 of the GDPR. 5
3. In respect of transfers of data to third countries that do not benefit from an adequacy decision, Article 46 of the GDPR provides that a controller or processor must ensure that ‘appropriate safeguards’ are provided, and that such transfers may only occur on condition that ‘enforceable data subject rights and effective legal remedies for data subjects are available.’ These safeguards, rights and remedies may be afforded by inter alia what are termed ‘standard data protection clauses’ (“SCCs”) adopted by the European Commission. TikTok adopted the SCCs approved in 2010 (Commission Decision 2010/87/EU), thereafter replacing these with SCCs that had been similarly approved in 2021 (Commission Implementing Decision (EU) 2021/914).
4. However, neither the existence of, nor the fact of compliance with, SCCs exhausts the obligation imposed by the GDPR on controllers or processors who are responsible for the transfer to a third country of personal data. The CJEU has decided that while that third country is not required to have protections governing personal data that are identical to those applicable in the EU, those responsible for data transfers must ensure ‘a level of protection … that is essentially equivalent to that guaranteed within the European Union by virtue of the regulation, read in the light of the Charter’ (Case C311/18 Data Protection Commissioner v. Facebook Ireland Ltd. and Maximillian Schrems (EU:C:2020:559) (“Schrems II”) at para. 94). If the jurisdiction to which the data is transferred does not itself provide this ‘essentially equivalent’ level of protection, then it is incumbent on the data controller to put in place supplementary measures that compensate for the lack of such protection.
5. It is, moreover, specifically provided in Article 13

(1)(f) of the GDPR that where personal data relating to a data subject is collected from that person, the controller shall 6 at the time the data is obtained provide the data subject with inter alia information that the controller intends to transfer the personal data to a third country as well as information regarding the existence or absence of an adequacy decision by the Commission, or reference to the appropriate or suitable safeguards attending the transfer, together with the means by which to obtain a copy of, or access to, same. The data processing

1. The impugned decision, and the investigation that preceded it, arises from the fact that personnel of the China Group Entities perform a range of tasks and functions which, TikTok says, are critical to the operation of the TikTok platform. During the period relevant to that decision, these tasks included functions related to software engineering, maintenance and development. In order to execute these functions, staff of the China Group Entities required access to, and use of, the personal data of TikTok users. TikTok says that the analysis of this data by these staff enabled research and development, security, analytics, online payments and customer and technical support. It also says that there were significant limitations on the identity of staff who could access the data, and the purposes for which they were permitted to do so. The DPC has said that these tasks and functions ‘appear essential to the operation of the Tik Tok platform.’
2. All of this involved not merely the processing of data of TikTok users but, more importantly for present purposes, the accessing of that data by personnel in the People’s Republic of China (“China”). That jurisdiction does not benefit from an adequacy decision of the European Commission. However, while the personnel who engaged in this processing are based in China, the data was not permanently stored there. It was 7 stored in data centres in Singapore, Malaysia and the United States. The personnel of the China Group Entities accessed this data by what TikTok terms as ‘secure and controlled remote access’. In order to do this, the data must be transferred to and temporarily processed in China.
3. The potential interaction between personnel of the China Group Entities who are based in China and this data, might be seen as arising in two ways. First, they have the ability to remotely access the data physically located in Singapore, Malaysia or the United States, as the case may be. Second, where they actually access this data, they may and do temporarily transfer some of it to China. This temporary transfer, TikTok says, is necessary for the data to be available remotely to be displayed to, and used by, personnel of the China Group Entities. At some points in the proceedings the term ‘remote access solution’ was used to describe the process whereby the data is thus temporarily transferred to, and processed in China by, personnel of the China Group Entities. Without local temporary processing, remote access is not possible.
4. Some of the issues in the substantive appeal depend on questions arising from these two related aspects (there is a third feature of this that emerged in the course of the DPC investigation, which is that contrary to representations made by TikTok in the course of that process, some personal data of EEA users was in fact being stored on servers in China, but while – understandably – a source of grave concern to the DPC, this is not relevant to the decision of the DPC in issue here). However, two points in particular should be noted. First, the DPC accepted TikTok’s position that insofar as the issues that were presented by the inquiry are concerned, there is no permanent ‘bulk’ storage of EEA users’ personal data in China: remote access involves processing data 8 permanently stored in other countries, while temporary transfer does not result in permanent ‘bulk’ storage. Second, TikTok does not dispute the DPC’s conclusion that the transfers were, at various times, made to between 16 and 26 China Group Entities, with access to the data being granted to thousands of individuals working in those entities, and that where remote access was authorised for a specific business purpose it was in general authorised for up to 12 months.
5. Nor can there be any question but that that the data in question constitutes ‘personal data’ for the purposes of the GDPR. At the times relevant to the impugned decision, it comprised the customer’s user ID and TikTok username, subscriber data, user profile, interaction and activity data, content data, technical and advertising data and purchase information. It also included survey responses, payment information, information as to the user’s location, advertising data and details of push notifications sent to users. Collectively, these would show the user’s engagement on the platform, content generated by the user, interest category selection, inferred demographic and interest profiles, and the purchase history of the user. While TikTok says that it is not its intention to collect from users the categories of sensitive personal data referred to in Article 9 of the GDPR (which enjoys particular protection), it accepts that such data may be collected incidentally or be uploaded by the user.
6. In the course of 2021, the DPC became concerned as to whether the conditions imposed by the GDPR in respect of transfers of data outside the EEA were being complied with at the interface between TikTok, its users’ data, and the personnel of the China Group Entities who were undertaking the various functions to which I have earlier referred. To that end, in September of that year, it opened an inquiry under s. 110 of the 2018 9 Act with a view to examining TikTok’s compliance with the requirements of the GDPR as they relate to the transfer to China of the personal data of users of the TikTok platform in the EEA, and the provision of information to users in relation to such transfers as required by Article 13

(1)(f) of the GDPR. The inquiry

1. The inquiry spanned over a period of three and half years, generating a significant body of inter partes correspondence, submissions, assessments and supporting material, and a preliminary draft decision, draft decision and a final decision from the DPC that extends to some eight hundred and thirty dense paragraphs. The proceedings are characterised by an extensive collection of lengthy affidavits, thousands of pages of exhibits, and pleadings.
2. At the nub, however, of a substantial part of the statutory appeal is the view of the DPC that where an undertaking such as TikTok transfers data to a third country, and where the DPC conducts an investigation into the transfer of that data, the undertaking is required to satisfy the DPC that it has assessed the law of the jurisdiction to which the data is being transferred, and that it has by that assessment satisfied itself that having regard to that law and any relevant measures adopted by the undertaking, the level of protection of the personal data is essentially equivalent to that provided by the law of the European Union. If it has not so satisfied itself, the DPC says, the data transfers are unlawful. In this regard the DPC makes reference to what it terms the ‘accountability obligations’ expressed in Articles 5

(2)and 24 of GDPR and the obligations in Chapter V of the GDPR. The DPC says in its decision that ‘a controller or processor must be 10 able to demonstrate that is has verified and guaranteed an essentially equivalent level of protection for the transferred personal data’. 23. From there, the DPC states, it is its responsibility to review the assessments made by the controller so as to ascertain whether the transfers comply with the GDPR. If the controller is not in a position to guarantee the requisite level of protection, then the DPC as the competent supervisory authority is (the DPC says) empowered to suspend or end the transfers. It is to be stressed that in framing the obligation of the data controller in this way, the DPC may find a breach by the controller of the GDPR in and around data transfers to a third country without the DPC itself determining whether the country to which the data is transferred provides the requisite level of protection (with or without regard to any SCCs or supplementary measures). It is sufficient, on this view, for the DPC to decide that the data controller has acted unlawfully in itself failing to conduct an adequate assessment and in failing to satisfy the DPC that it has done so. 24. TikTok accepted at an early stage that it could not say that the law of China provided the requisite protection based on the SCCs alone. It noted, in particular, that there are Chinese laws that materially diverge from EU standards (these are referred to by the DPC as ‘the problematic laws’). However, TikTok said that this did not matter, having regard to two factors. The first was the steps TikTok had taken to ensure the protection of that data and the identity of the persons to which it related (these protections were, TikTok said, further enhanced as the inquiry proceeded by means of a series of measures adopted under what it terms ‘Project Clover’, to which I will later return). 11 25. The second arose from the fact that the data was not itself permanently stored in China. TikTok said that insofar as the fact that TikTok personnel in China could access the data remotely meant that the data had been transferred to that jurisdiction, Chinese law did not permit the authorities there to compel those personnel to grant them access to the data. TikTok contended that the ‘Chinese authorities are not lawfully entitled to compel organisations and individuals to provide data that are not domestically stored within the territory of China’. This was referred to throughout as the ‘territoriality principle’. An expert in Chinese law whose reports were furnished by TikTok to the DPC (Professor Xu) said, in his second report (dated 8 September 2023), that the Chinese authorities did not have the power to compel companies related to TikTok based in China, or those working for them, to disclose remotely accessible EEA user data that is stored on servers outside of China in the specific circumstances of the transfers the subject of the DPC inquiry. That report was furnished by TikTok to the DPC on 8 September 2023 as part of its response to a Preliminary Draft Decision of the DPC that had been circulated in May 2023 (“the PDD”). In the PDD, the DPC had proposed making orders suspending data transfers and requiring TikTok to bring its processing into compliance. There, the DPC recorded as follows (para. 367): ‘TikTok Ireland has failed to clarify precisely how the territoriality principle applies in the context of the relevant laws and practices and to clarify whether, and the extent to which such laws may apply in the context of the transfers. This directly impacts on its ability to select appropriate measures and its ability to verify, guarantee and demonstrate that the supplementary measures and the SCCs are effective in respect of potentially problematic laws.’ 12 26. TikTok’s response to the PDD was followed by an extensive exchange of correspondence between the parties, included in which was a specific request by letter dated 8 February 2024 from the DPC that TikTok clarify inter alia whether remote access by personnel in China involved storage of EEA user data, including temporary storage. 27. The second report of Professor Xu was also appended to a revised Data Transfer Assessment (“DTA”) sent as part of the inquiry by TikTok to the DPC on 31 July 2024. The following was said in that DTA: ‘taking account of the relevant aspects of China’s current legal framework in the specific context of the secure Remote Authorised Access, the SCCs together with the various Supplementary Measures ensure that EEA User Data is afforded a level of protection essentially equivalent to that guaranteed within the European Union. There is no impediment as a matter of Chinese law to the China Group Entities complying with their obligations under the SCCs in the specific circumstances of the transfers made by way of remote access and the China Group Entities are able to satisfy those obligations.’ 28. A footnote to that DTA (footnote 113) recorded as follows (referring to ‘Fangda’, a leading Chinese law firm which advised TikTok, and to Professor Xu’s conclusions including those to which I have just referred): ‘We have been advised by Fangda and Professor Xu that the transient processing inherent to the facilitation of remote access in China does not alter 13 the above analysis. This is because the relevant data is still stored outside of China (and only remotely accessible from within China), and so is still subject to the requirements set out above. In addition: (

1. i)such transient processing is strictly protected by the constitutional right to confidentiality of correspondence under Article 40 of the PRC Constitution and (
2. ii)such transiently processed data would in any event still be considered offshore data when considering the scope of Chinese authorities jurisdiction…’ 29. The DPC says that it was not furnished with the content of the advice furnished by Fangda Partners and Professor Xu to TikTok as referred to here. It does not appear to have sought it. In the principal affidavit sworn by the DPC for the purposes of resisting the stay application, it says that footnote 113 constituted TikTok’s first and up to that point only engagement with the treatment under Chinese law of the personal data of EEA users of TikTok’s services transferred to China and processed there on the devices of employees of China Group Entities. It stresses that this was notwithstanding the fact that the DPC had specifically raised this issue, most recently in its letter of 8 February 2024. Professor Xu, the DPC says, first dealt with this point in a report delivered on 18 March 2025. It also says that neither that report, nor this footnote, consider the potential power of the Chinese authorities to directly access data processed on devices in China. TikTok, on the other hand, says in the affidavits sworn for the purposes of the stay application that at the time it delivered the DTA it ‘understood the DPC’s concerns to be those set out in the PDD, which made no mention of the temporary processing’. 14 30. Article 60 of the GDPR requires that where a lead supervisory authority proposes to make a decision of the kind in issue here, it should submit a draft of that decision to other supervisory authorities. This allows those authorities to express any objections to the draft decision. If agreement cannot be reached in relation to those views, provision is made for the European Data Protection Board (“the EDPB”) to intervene (I will return later to this body, and the process envisaged by these provisions). On 14 February 2025, TikTok advised the DPC that it intended to share an update on its new safeguards and security measures implemented under Project Clover, stating that this would be furnished before 10 March 2025. On 21 February 2025, the DPC advised TikTok that it had finalised and circulated its draft decision pursuant to these provisions. A copy of the draft decision was provided to TikTok. In that draft decision, the DPC found that TikTok had ‘continually failed’ to address the application of Chinese law to data that was temporarily transferred to and processed in China in the course of remote access. The decision recorded that TikTok had ‘overlooked’ how the territoriality principle applied in respect of that data. 31. The draft decision proposed that it was appropriate, necessary and proportionate to order the suspension of the data transfers on the basis that TikTok had infringed Article 46 of the GDPR. Particular emphasis was placed by the DPC on its view that TikTok had failed to address whether data that was temporarily transferred to China could be accessed by the authorities there. TikTok responded on 14 March 2025, requesting that the DPC withdraw the draft decision. In that letter it drew the DPC’s attention to footnote 113 to its July 2024 DTA. TikTok said inter alia that the draft decision contained and was premised on a fundamental factual error insofar as it said that TikTok had not assessed how Chinese law applied to the processing of EEA User Data. It also 15 complained about the failure to allow TikTok to make submissions in response to the DPC’s view, as expressed in the draft decision, that Project Clover was insufficient to ensure essentially equivalent protection. 32. On 18 March TikTok provided a third opinion of Professor Xu. That third opinion recorded that Professor Xu had understood at the time he delivered his second opinion that the data transfers entailed some temporary processing on computer information systems in China as a result of remote access and that, for the avoidance of any doubt, it was his opinion that the principles set out in his second opinion applied to the data temporarily processed in China. On 25 March the DPC refused TikTok’s request that the draft decision be withdrawn. The final decision was adopted on 30 April 2025. The decision 33. The decision of the DPC was made under s. 111 of the 2018 Act, and Article 60 of the GDPR. In it, the DPC found that TikTok had infringed Article 46 of the GDPR by carrying out the data transfers while failing to verify, guarantee and demonstrate that EEA User Data subject to those transfers was afforded a level of protection essentially equivalent to that guaranteed within the European Union. It expressed this finding as follows (para. 373 of the decision): ‘The DPC has considered all information submitted by TikTok Ireland during the Inquiry regarding the territoriality principle. This includes the Legal Opinions, the updated Data Transfer Assessments, and the submissions made after the Preliminary Draft Decision. However, for the reasons set out below, 16 the DPC finds that TikTok Ireland has failed, on a continuing basis, to adequately assess the level of protection of EEA Users under the Chinese legal framework in respect of the territoriality principle and the divergences that TikTok Ireland acknowledges to exist. In particular, TikTok Ireland failed to adequately assess the law and practices in effect in China regarding the level of protection of personal data of EEA Users the subject of the Data Transfers.’ 34. Key to that conclusion was the DPC’s opinion that TikTok had ‘continually failed to address the application of those laws to the processing of EEA User Data that does occur on computer information systems in China by means of the Remote Access Solution’ (para. 375), that it ‘has not considered the application of the territoriality principle to the personal data while that data is processed in China’ (para. 377), that TikTok’s ‘assessment of the territoriality principle failed to properly address the fact that the personal data routinely subject to the Remote Access Solution is processed in China, and therefore is located within China albeit on a temporary basis’ (para. 380), and that ‘it has failed to consider how Chinese law and practices apply in respect of the personal data that is transferred to China’ (para. 383). The decision recorded that TikTok’s assessment ‘appears to assume’ that the only form of problematic access that could occur was by Chinese authorities compelling access to EEA user data stored outside China but ‘overlooks’ access that may be obtained while data is temporarily processed (para. 384). It stressed that TikTok had not addressed whether access by Chinese authorities to those computer information systems could lawfully occur without the knowledge of the China Group Entities and/or their employees (para. 410). It said ‘TikTok Ireland’s assessment of the territoriality principle failed to consider the issue of Chinese authorities obtaining access to EEA User Data that was routinely 17 transferred to China and that was temporarily processed in China …’ (para. 512). The DPC decision referred (at para. 96) to the fact that TikTok had delivered the third opinion of Professor Xu on 18 March 2025, and specifically recorded that it had considered that report, commenting ‘[h]owever, fundamental flaws in TikTok Ireland’s assessment … remain unaddressed and are ongoing’ (para. 691). 35. Essentially, as the DPC itself puts it, the decision found that TikTok had not provided proper verification and guarantees in respect of its account of Chinese law. It emphasises that the decision expressly referred to the lack of legal authorities put forward by TikTok in respect of that interpretation. In its decision, the DPC did not provide any further reasoning as to why the third report of Professor Xu was not accepted by it, and it did not address footnote 113 of the DTA. In the course of its argument in this appeal, however, it highlights the passages in the PDD and correspondence to which I have earlier referred which, it says, made quite clear that it was concerned at all times with the protections afforded by Chinese law to the temporarily transferred data. 36. The DPC also found that TikTok had infringed Article 13

(1)(f) of the GDPR from 29 July 2020 to 1 December 2022 by failing to provide data subjects with the required information on its transfers of personal data to China and information as to how the processing involved remote access to personal data stored in Singapore, Malaysia and the United States by personnel based in China (these deficiencies were found to have been rectified in TikTok’s December 2022 EEA Privacy Policy). 18

1. The decision concluded that where TikTok had failed to verify, guarantee and demonstrate that the supplementary measures and the SCCs were effective to ensure that the personal data of EEA users was afforded a level of protection essentially equivalent to that guaranteed within the EU, the decision in Schrems II meant that the DPC was empowered to suspend or end the transfers. It found that TikTok had not established that the risk of access by the Chinese authorities to EEA user data the subject of the data transfers was theoretical, remote, or hypothetical and unlikely to arise in practice, as TikTok had contended. Here, the DPC again emphasised that TikTok’s assessments had failed to clarify whether and the extent to which the ‘problematic laws’ may apply in the context of the transfers, and therefore failed to set out in a clear way the deficiencies it acknowledged existed in the Chinese legal framework. Because the assessment was flawed, the DPC said, this interfered with TikTok’s ability to select appropriate safeguards and supplementary measures, and prevented it from demonstrating an essentially equivalent level of protection. Similarly, the decision concluded that while Project Clover (which is addressed by the DPC in the context of whether data transfers should be suspended) resulted in significant changes to the manner in which the data transfers were implemented, it had not changed the fact that the data transfers on an ongoing basis entailed the processing of EEA user data on computer information systems in China.
2. Having found that it was, in the circumstances, appropriate, necessary and proportionate to do so, the DPC made an order pursuant to Article 58

(2)(j) of the GDPR requiring TikTok to suspend the data transfers. In reaching this conclusion it explained (at para. 708): 19 ‘There is a risk to EEA User Data where this data is transferred to a third country that does not provide a level of protection that is essentially equivalent, and for which, TikTok Ireland has not verified, guaranteed and demonstrated that the supplementary measures and the SCCs are effective to ensure that the personal data of the EEA users is afforded a level of protection essentially equivalent to that guaranteed within the EU … this infringement is serious in nature.’

1. The decision thus directed TikTok to ensure ‘that any EEA User Data located in China, as a result of the Remote Access Solution, when the order takes effect must cease being processed in China immediately at that point in time. This includes any ongoing temporary processing of EEA User Data on computer information systems in China’ (para. 704). This part of the order is referred to throughout as ‘the suspension order’.
2. The DPC also made an order pursuant to Article 58

(2)(d) of the GDPR requiring TikTok to bring the processing into compliance in the manner detailed in the decision (‘the compliance order’). The effect of this order is to require that TikTok remove access to EEA user data by China Group Entity personnel. The decision provides for a process intended to enable TikTok to implement measures giving effect to the compliance order and the suspension order. This involves it being given approximately three months from the decision to tell the DPC how it plans to give effect to these orders, with the DPC then engaging with TikTok on that plan, and following agreement to the terms of that plan, TikTok having a further two months to give effect to it. 20 41. The DPC imposed administrative fines pursuant to Article 58

(2)(

1. i)of the GDPR in the amount of €485M and €45M. It made clear in its decision that the suspension might, in the future, be lifted (at para. 673): ‘This order provides for the situation whereby, if measures become available to make the Data Transfers compliant, then the suspension could be re-considered. The DPC is not imposing a permanent ban on the Data Transfers, recognising that new measures, not currently in operation, may yet be capable of being developed and implemented by TikTok Ireland to compensate for the deficiencies identified in this Decision. If that situation were to arise, the DPC would then be in a position to reconsider the suspension.’ The Appeal 42. In these proceedings, TikTok alleges a series of errors in grounding its statutory appeal against the decision (it has also instituted judicial review proceedings, although these are not before the court). It says, in particular, that the finding in the decision that TikTok had continually failed to address the application of Chinese law to the temporary data was ‘the lynchpin of the Decision’ was a ‘new finding’, was premised on a ‘new and different concern’ that was not highlighted in the PDD circulated in May 2023, and that this finding was erroneous. 43. TikTok says that there was a failure by the DPC to either assess the third opinion of Professor Xu or provide any explanation as to why that opinion was rejected by the DPC. It stresses that the DPC did not advert in its decision to footnote 113 to the July 2024 DTA. It objects that ‘Project Clover’ was addressed by the DPC for the first time 21 in the draft decision, TikTok not having had the opportunity to make submissions on that assessment. Project Clover, on TikTok’s case, involved the introduction of very significant changes to its operations, costing in the region of €12bn over a period of ten years. Project Clover has three key elements: (
2. a)the creation of a European Enclave for the default storage of EEA user data to which personnel of the China Group Entities do not have access, (
3. b)the removal of access by China Group Entities personnel to more private data (‘protected data’) so that those personnel can remotely access only what it terms ‘allowable data’ in TikTok’s internal systems, and (
4. c)the implementation of pseudonymisation measures in respect of the data that personnel of the China Group Entities are authorised to access to prevent the re-identification of EEA users. All of this (it is said) results in a significant difference in the content of the data being temporarily processed. It is also said that this minimises data flows so that only a limited subset of EEA user data is transferred from the European Enclave to TikTok’s global data centres in Singapore, the United States and Malaysia in controlled circumstances, and where necessary for the proper operation of the global TikTok platform. Project Clover is supervised by an independent third-party security provider. Included in the evidence submitted by TikTok for the purposes of the stay application was an affidavit from an independent expert attesting to the effectiveness of the pseudonymisation measures forming part of the project, which the expert describes as ‘appropriate and in line with industry good practice’. 44. TikTok says that the DPC having originally failed to identify the temporal scope of its inquiry, it then (at the end of 2022, and in its Preliminary Draft Decision issued on 17 May 2023) said that it was concerned with transfers taking place from 29 July 2020 and ‘ongoing’, limiting this for the first time to the period from 29 July 2020 to 17 May 22 2023 in the draft decision. This, TikTok says, had the effect that its ongoing compliance with Article 46

(1)of the GDPR and the steps taken on foot of Project Clover were not assessed and that its rights to fair procedures were in this way breached. The DPC was advised of measures being put in place as part of Project Clover on 28 March 2023: by thereafter retrospectively and without notification changing the time span of the inquiry without notice in the interim, TikTok says, Project Clover never became part of the substantive assessment made by the DPC. While the new processes thereby introduced by TikTok were considered at the point of the DPC’s consideration of remedy, TikTok says that the DPC never identified precisely what its concerns with Project Clover actually were.

1. Referring to Schrems II, TikTok says that the power to suspend the transfer of personal data to a third country arises only where the controller or processor has not itself suspended or put an end to the transfer, and where in the view of the supervisory authority (in the light of all the circumstances of the data transfers), the SCCs are not or cannot be complied with in the third country, and where the protection of the data transferred that is required by EU law cannot be ensured by other means. Therefore, TikTok says, the DPC could not find either a breach of Article 46 or make a suspension order where it has not itself conducted an assessment of relevant aspects of the Chinese legal system. It objects that the DPC thereby wrongly reversed the burden of proof of inadequacy, shifting it via ‘the accountability obligation’, onto TikTok. It contends that the DPC did not conduct a risk analysis as, TikTok says, is required by Article 24 of the GDPR, and as it ought to have done before making a suspension order. 23
2. There are other issues identified by TikTok. It argues that the DPC erred in finding that its privacy policy in place up to December 2022 was in breach of Article 13 of the GDPR. It says that absent a sustainable finding of negligence (which it says was not made) administrative fines should not have been imposed on it. TikTok argues that the DPC erred in calculating the fine imposed upon it by reference to the turnover of ByteDance, in particular in circumstances where it did not impute liability to ByteDance for the infringements found in the decision. It argues that the DPC erred in wrongly concluding that TikTok and ByteDance form part of the same undertaking and in misapplying a presumption of decisive influence. Complaints are also made that ByteDance was not advised by the DPC of its intention to determine the fine in this way, and that the incorrect financial year was chosen for the purposes of calculating the turnover on the basis of which the fine was imposed. It is also said that the DPC failed to provide adequate reasons for its decision, and that the fines are not proportionate. The legal basis for the stay application
3. The inquiry the subject of this appeal is governed by Part 6 of the 2018 Act. This includes ss. 142, 143 and
4. Section 142 provides for an appeal to the High Court or Circuit Court against the imposition of an administrative fine (the relevant jurisdiction depends on the amount of the fine). Section 143

(1)provides that where a controller or processor does not appeal in accordance with s. 142, ‘the Commission shall, as soon as is practicable after the expiration of the period referred to in that subsection, and on notice to the controller or processor concerned, make an application in a summary manner to the Circuit Court for confirmation of the decision’. Section 143

(2)allows the Circuit Court, on the hearing of an application under subsection

(1), to confirm the decision the subject of the application unless the court sees ‘good reason not to do so’. 24 Section 150 provides that a person affected by certain legally binding decisions of the Commission may, within 28 days of notice of that decision, appeal same, the High Court and Circuit Court enjoying concurrent jurisdiction over such appeals. 48. The decision of the DPC provides that the order to suspend data transfers will take effect on a date six months from the later of (

1. i)the date on which the period allowed for an appeal against the DPC’s final decision under s. 150 of the 2018 Act has expired; and (
2. ii)the date on which the period allowed for the bringing of an application for annulment of any decision of the EDPB under Article 263 of the Treaty on the Functioning of the European Union (“TFEU”) has expired. Neither the decision nor the 2018 Act specifies whether, and if so how, the bringing of an appeal against a decision within the period fixed by s. 150 impacts upon the efficacy of that decision. 49. However, the parties agree that the effect of these provisions is that the obligation to pay the administrative fines does not arise until the confirmation of the Circuit Court has issued under s. 143. They also agree that because TikTok has appealed the fine, the payment obligation is effectively stayed. The parties were in further agreement that there was no automatic stay on the suspensory or corrective orders made by the DPC, and they agree that the terms of the decision did not itself result in any such stay once an appeal was brought. 50. While the parties also agreed that the High Court had jurisdiction to grant such a stay, their respective understandings of the basis on which the court had the power to make such an order, diverged. The DPC argued that the power derived from EU law, citing the decision in Case C-213/89 R v. Secretary of State for Transport, ex parte: 25 Factortame Ltd. and others (EU:C:1990:257) (“Factortame”’) at para. 21. TikTok contended that the power derived from the inherent jurisdiction of the High Court, and the provisions of O. 84C r. 8

(2)of the Rules of the Superior Courts (“RSC”). That provision – part of the Order governing statutory appeals generally – states that on the return date of a notice of motion initiating such an appeal the court may ‘where it appears just and proper, make orders for relief of an interlocutory nature, whether in the nature of an injunction or otherwise.’ 51. In circumstances where the parties are in agreement that there is a jurisdiction to grant a stay, it is not necessary to choose between these different versions of its source. Indeed, it appears to me that it is at the very least arguable that the power to make what is in substance a form of interlocutory injunction in support of a legal proceeding before the court (the statutory appeal) can be rooted in s. 28

(8)of the Supreme Court of Judicature (Ireland) Act 1877. That being so, and while noting the force, logic and coherence of the judgment of Hogan J. insofar as he locates the authority to make such an order in Articles 40.3.2° and 34 of the Constitution, for my part I would prefer to postpone a consideration of this issue to a case in which it is both necessary to answer the question, and it has been fully argued. It is, of course, the case that the Constitution envisages a scheme of effective legal remedies. What may not be quite as clear is what, precisely, this entails, when the entitlement to such remedies arises, what remedies, exactly, it envisages, whether the initial obligation to enable those remedies in particular classes of case lies with the Oireachtas, or with the courts, and whether there are situations in which the Oireachtas can validly decide not to enable suspensory orders of a particular kind in a particular situation. The answers to these questions may well throw further light on whether, and if so when, Articles 40.3.2° or 34 of the Constitution 26 afford a free-standing legal authority for such relief, or whether they are better viewed as a basis for implying the power to grant such relief into a statutory scheme providing for appeals of the kind in issue here. The stay 52. As I have previously observed, the decision was to take effect six months after its delivery on 30 April 2025. The appeal was commenced by originating notice of motion issued on 27 May, a stay being sought on 5 June at the same time as an application was made to admit the proceedings to the High Court’s Commercial List. A temporary stay was then granted, and this was continued until the hearing of the stay motion, being thereafter continued again until the determination of that application. 53. TikTok contended that the legal test fixed for that application was as stated in Okunade. There, Clarke J. (as he then was) (at para. 104) explained how a court should proceed where it is asked in the course of judicial review proceedings to stay or injunct the operation of an administrative measure. He explained that the court should first determine whether the applicant has established an arguable case on the merits; if not the application must be refused. If such an arguable case is established, the court should consider where the greatest risk of injustice would lie. In deciding that question it should give ‘appropriate weight’ to the orderly implementation of measures which are prima facie valid. It should give such weight as may be appropriate (if any) to any public interest in the orderly operation of the particular scheme in which the measure under challenge was made and give appropriate weight (if any) to any additional factors arising on the facts of the individual case which would heighten the risk to the public 27 interest of the specific measure under challenge not being implemented pending resolution of the proceedings. The court, Clarke J. said, should moreover give ‘all due weight’ to the consequences for the applicant of being required to comply with the measure under challenge in circumstances where that measure may be found to be unlawful, it should, in those limited cases where it may be relevant, have regard to whether damages are available and would be an adequate remedy, and it also should consider whether damages could be an adequate remedy arising from an undertaking as to damages. Finally, he said ‘subject to the issues arising on the judicial review not involving detailed investigation of fact or complex questions of law, the court can place all due weight on the strength or weakness of the applicant's case’ (id.). 54. The DPC, in response, contended that the correct approach was that adopted by the CJEU in Zuckerfabrik. This requires establishment of three distinct conditions: (

1. a)that there are ‘serious doubts as to the validity of’ the measure in question, (
2. b)that a stay is required as a matter of urgency in the sense that it is necessary in order to avoid serious and irreversible damage to the party seeking the stay, and (
3. c)that taking account of the interests of the EU, the urgency outweighs those interests and any other interests arising (see Case C-334/95 Krüger GmbH & Co. KG v. Hauptzollmamt Hamburg-Jonas (EU:C:1997:378) at paras. 43-47 and the summary in the judgment of Collins J. in Three Ireland (Hutchinson) Ltd. and others v. Commission for Communications Regulation [2022] IECA 300 (“Three”), in particular, at para. 70). 55. The differences between the Okunade test, and that formulated in Zuckerfabrik may be threefold. First, it has been suggested that the Zuckerfabrik formulation might be different from the threshold of ‘arguability’ arising in domestic law, in the sense that it 28 may be necessary to establish a greater degree of doubt as to the validity of the measure than applicable in the domestic test (Pringle v. Ireland [2012] IESC 47, [2013] 3 IR 1 at paras. 484-485). This, it should be observed is not without doubt: in the course of his judgment in Eircom Ltd. v. Commission for Communications Regulation [2022] IEHC 165 (at para. 31), MacDonald J. suggested that the requirement that there be ‘serious doubts’ as to the validity of the EU measure arising under Zuckerfabrik might be ‘substantially the same’ as the requirement in domestic law that there be a serious issue to be tried, and Mulcahy J. proceeded on that basis in his judgment in this case. It is not necessary here for me to decide if he was correct in so doing, but I cannot but observe that the confusion around this issue may be a result of the fact that the test for what is a ‘serious doubt’ for the purposes of the Zuckerfabrik test may itself be variable, depending in particular upon the urgency attending the award of interim measures (see Henry G. Schermers and Denis F. Waelbroeck Judicial Protection in the European Union (6th edn, Kluwer Law International 2001) at §1401). 56. Second, it has been proposed that the Zuckerfabrik test envisages that interim relief will not be available unless a threshold of ‘urgency’ is met, the ‘irreparable damage’ that is viewed as being part of this requirement not being satisfied by purely financial loss, at least absent very unusual circumstances. Third, while Okunade requires that once arguability is made out, the court engage in a composite analysis that is ultimately directed to where the least risk of injustice lies, Zuckerfabrik seems on at least one view to involve a staged test so that if an applicant fails to establish a probability of serious and irreparable damage, the application for a stay fails without any necessity to address the balance of interests (although, as TikTok observed in the course of its submissions, it has been said that a court hearing an application for interim measures enjoys a broad 29 discretion, and that there is no rule of EU law imposing a pre-established scheme of analysis on which the application must be assessed (Case C-397/24 P(R) AQ v. European Chemicals Agency (ECHA) (EU:C:2024:634) at para. 47)). 57. The DPC maintained that its decision fell to be considered by reference to Zuckerfabrik rather than Okunade because of the particular position of a lead supervisory authority under the GDPR. In particular, it said that the provisions of Article 60 of the GDPR, which require mandatory co-operation between supervisory authorities, had the consequence that the DPC decision was, in effect, a decision of all supervisory authorities that is binding across the EEA. It also attached importance to the provisions of Article 65 of the GDPR, which governs the operation of the EDPB. This entity is established by Article 68 of the GDPR as a union body with legal personality. It is comprised of the head of one supervisory authority of each Member State. It may also render decisions under the GDPR that are addressed to and binding upon the lead supervisory authority and all other national supervisory authorities concerned where it is not possible to obtain agreement between the national authorities (Article 65

(2)). The DPC maintained that decisions of the EDPB would, were an attempt made to suspend them, be governed by Zuckerfabrik and thus, decisions of the national supervisory authorities should be subject to the same legal regime. 58. The parties being in agreement that TikTok’s challenge met both the threshold of arguability in national law, and the equivalent threshold according to Zuckerfabrik, the focus of their respective arguments was upon the damage that TikTok contended it would suffer were the stay not granted, and the injury to the public interest (and the rights of data subjects) that the DPC argued would follow if the stay were granted. 30 59. While I will return later to the detail of its case in this regard, at a general level TikTok divides its user data into two categories – ‘protected data’ and ‘allowable data’. It classifies all user data as ‘protected’ unless it has been defined through TikTok’s internal governance policies as ‘allowable’. Allowable data, in turn, is divided into three categories – public data, interoperable data and aggregated data. Public data is publicly available data on the TikTok platform. Interoperable data is data that is required to make the application work across different regions of the world (for example where an EEA user wishes to block a non-EEA user). Aggregated data is statistical data aggregated from public or interoperable data (for example a count of the number of public videos posted by a user on a given day in a given country). TikTok contended that implementation of the suspension and compliance orders would require it to (

1. a)apply technical measures to anonymise any aggregated EEA user data that can be accessed remotely by authorised personnel of the China Group Entities, and (
2. b)remove access to EEA user data that is still accessible to those personnel at the end of the compliance period. 60. To do this, it says, would involve incurring billions of euro in expenditure, that this would entail considerable disruption to its workforce and business, and would impact adversely upon the experience of users. It says that a number of its critical business processes will be severely impacted if access to the data is removed from the China Group Entities. It claims that thousands of personnel of those entities will have to be transferred and relocated outside China in order to enable TikTok to return to the same level of operations in its critical business processes. That, TikTok says, will result in the loss of valuable skill and knowledge, and it would not be in a position to return to 31 its previous level of operations until 2029. It says that the measures will be difficult or impossible to reverse, and that undoing the steps it would have to take would be as disruptive as putting them in place in the first instance. It also said that these measures would delay for a short period the introduction of a TikTok service – TikTok shop – in new countries in the EEA. Stakeholders will, it is said, be driven to competitor platforms and the degradation of the user experience will damage TikTok’s brand perception. An expert forensic accountant has prepared a report at TikTok’s request projecting a consequent lost profit contribution at US$1,716 million, the methodology of this report being challenged by an expert accountant on whose behalf the DPC has sworn an affidavit. 61. The DPC, in response (while emphasising the requirement it said was imposed by Zuckerfabrik that a stay could not be granted to protect purely financial losses, save in very exceptional and extreme circumstances, and while urging that the losses alleged by TikTok were entirely financial for this purpose), stresses the central importance to the proceedings of the rights of TikTok’s EEA users. TikTok having failed to establish that the protections it had put in place operated to ensure equivalent protection for the data rights of those availing of its services, the DPC said that transfers were taking place that did not comply with the GDPR. Those subjects had the right not to have their data removed from the EU/EEA in those circumstances, and that right was breached for as long as TikTok was permitted to proceed with the transfers that had been suspended by the DPC decision. Much of the evidence adduced by TikTok addressing the consequences for its business if the orders made by the DPC are not stayed are disputed, and the methodology underlying that evidence was contested by the DPC in its responding affidavits. The DPC emphasises that the figures suggested by TikTok as 32 representing the financial impact of the decision represent 4.9% of the net profit of ByteDance for 2024 and just 1% of the revenue reported for that year. It also stresses that neither it nor the court is in a position to interrogate the evidence relied upon by TikTok in this regard. Much of that evidence is dependent on assumptions produced primarily by reference to information and considerations internal to TikTok that have not been independently tested and verified. Moreover, it is said, TikTok’s calculations of its losses assume that there are no alternatives to the solutions proposed by it to obtain compliance with the DPC decision. The High Court judgment 62. The application for a stay proceeded over four days from October 7 to 10, 2025. Mulcahy J. delivered a detailed and comprehensive judgment on 13 November explaining why he proposed to grant the stay. His reasoning, essentially, was as follows: (
3. i)He felt that the decision-making procedure created by the GDPR was novel, and accordingly that the identification of whether the application is governed by national procedural law or by the criteria governing an application to stay an EU measure cannot solely be resolved by reference to the distinctions drawn in Zuckerfabrik or another decision of the CJEU to which I will come presently, Case C-432/05 Unibet (London) Ltd. v. Unibet (International) Ltd. (EU:C:2007:163) (“Unibet”). Instead, he felt, the answer must be found in the terms of the GDPR itself. 33 (
4. ii)Mulcahy J. stated that it appears from Article 60

(6)of that regime that a decision of a supervisory authority is only binding on the supervisory authorities concerned, as defined in Article 4

(22)of the GDPR. However, he held that where the transfers in issue are occurring across the EEA, the decision will have binding effect on most, if not all, supervisory authorities. He held that where the State has jurisdiction to regulate the activities of a data controller whose main establishment is in the State, the fact that a decision binds that data controller within the EU was not a sufficient point of distinction from any other decision by a national regulator made pursuant to EU law to warrant the disapplication of national procedural autonomy in proceedings before a national court. He stated that the novel aspect of the GDPR regime is that the decision binds other supervisory authorities concerned and observed that this must be understood as a manifestation of the ‘one-stop shop’ regime. Mulcahy J. held that the decisions of a lead supervisory authority are not binding as to the interpretation of the GDPR, rather the purpose is to ensure the integrity of the one-stop shop mechanism and to enable data subjects and data controllers to deal with a single supervisory authority in respect of any given issue. (iii) He found that the GDPR clearly provides that a decision of a supervisory authority is a decision of that body with the important legal consequence that a challenge to that decision must be brought in the courts of the Member State in which that supervisory authority is established. Mulcahy J. stressed that the GDPR makes no provision for harmonisation of procedural rules for challenges to decisions made under that Regulation, and noted that Recital 143 of GDPR expressly provides that ‘proceedings … should be conducted in accordance with 34 that Member State’s procedural law’. The judge stated that the conferring of jurisdictions on national courts and the express invocation of national procedural law must be regarded as a deliberate choice by the legislature. He stated that it would be a surprising omission if the GDPR does require harmonisation in relation to applications for interim measures. (

1. iv)He held that since the EDPB is an EU body established under the GDPR, the Zuckerfabrik criteria would likely apply to interim relief sought in connection with a challenge to a decision of that body. He said that while any challenge to a decision adopted by a supervisory authority on the basis of an EDPB ruling pursuant to the consistency mechanism must still be brought in the Member State of that lead supervisory authority, where the validity of a decision of the EDPB is at issue a national court must refer that question to the CJEU for determination. He held that where the GDPR expressly recognises that the validity of decisions of supervisory authorities and of the EDPB must be determined in different fora, there is nothing anomalous about different criteria applying in relation to decisions the validity of which must be challenged before national courts or before the CJEU. (
2. v)The judge found that the relevant case law is based on the proposition that either national procedural rules apply or the Zuckerfabrik criteria apply, which, he stated, reflects the reality; if a national court were required to apply the Zuckerfabrik criteria to a stay application this would involve a departure from procedural autonomy, insofar as those criteria differ from those applicable to stay applications in that jurisdiction. He held that there is nothing in the case 35 law of the CJEU or of the national courts which suggests that national procedural autonomy should not apply to applications for a stay. (
3. vi)Mulcahy J. noted that the issue in the application before him arose from the procedural rules applicable to a preliminary application and not from the interpretation of the GDPR. Therefore, he said, the possibility of differing interpretations or applications of EU law did not arise. He observed that this court confirmed in Dowling v. Minister for Finance [2013] IESC 37, [2013] 4 IR 576 (“Dowling”) that the national law procedure in relation to the granting of interim measures respects the principles of equivalence and effectiveness. (vii) Mulcahy J. said that in this case, not only is there no challenge to an EU measure, but a significant part of the challenge is advanced on what might be regarded as purely domestic law grounds. He held that although the decisions of the DPC are capable of having EU-wide effect, that effect is confined to the decision concerned and, in substance, the affected parties. Mulcahy J. noted that such a scope does not require that the procedural autonomy of the courts of a Member State conferred with jurisdiction be displaced. He held that the decision fell to be considered in accordance with the principles set out in Okunade. (viii) As to the adequacy of damages/serious risk of irremediable damage limb of the test in Okunade, Mulcahy J. was satisfied that TikTok had established to the requisite standard that it would suffer significant loss if required to give effect to the suspension order pending the hearing of its appeal. As to the question of whether any loss which it would suffer would be financial, he stated that the 36 loss of institutional knowledge and expertise TikTok says it will suffer should properly be regarded as a pecuniary loss since its impact is on the value of TikTok’s business. He held that other purportedly non-pecuniary losses, including damage to TikTok’s brand or its competitiveness must also be regarded as financial or pecuniary. However, Mulcahy J. stated, the classification of these losses as financial or pecuniary did not mean that damages were an adequate remedy, or that the losses should not be regarded as serious and irreparable. Mulcahy J. noted that the question arose as to whether damages would be recoverable at all if TikTok incurred losses and ultimately succeeds in its appeal. He stated that there must be a question over whether an emanation of the State could rely on a statutory immunity (as is provided for in s. 154 of the 2018 Act) to defeat a claim for Francovich damages. Accordingly, he noted that this is a hurdle which any party would have to overcome if seeking to recover damages in the event of a successful appeal. Mulcahy J. held that given the scale of potential losses which may be suffered by TikTok, a hypothetical remedy in damages is not an adequate remedy for TikTok in this instance. He held that even if the applicable threshold were a risk of serious and irremediable harm, on the evidence available that threshold would be met. (
4. ix)As to the least risk of injustice, Mulcahy J. stated that no injustice will have been done to TikTok by reason of it having to implement the decision, and in particular, the suspension order pending the determination of its appeal, if the appeal ultimately fails. He held that all data controllers are required to comply with the same rules; TikTok cannot be heard to complain if those rules have a more significant impact on it than on its competitor because of the manner in 37 which its business is structured. Mulcahy J. held that the potential injustice which must be weighed in the balance is that of being required to comply with a decision which is subsequently proved invalid, which must be set against the injustice which might result if TikTok avoided, or delayed, complying with a decision the validity of which is upheld. He commented that in Okunade the Supreme Court indicated that all appropriate weight should be given to the importance that presumptively valid decisions be implemented. Mulcahy J. held that that requirement is of particular significance where what is at issue is a risk to fundamental rights. However, he held that the application cannot simply be resolved by an invocation of such rights. He stated that were it the case that the engagement of fundamental rights by a decision defeated any private interest which might be asserted, this would negate the balancing exercise mandated by national and Union law rendering a stay unavailable, undermining the potential effectiveness of that remedy. Mulcahy J. held that there were a variety of factors which point to the conclusion that the least risk of injustice would be served by a limited stay on the suspension order, subject to certain conditions. (
5. x)As to the length of the stay which is required to avoid the most immediate risk of injustice, Mulcahy J. noted that the decision provided a period of six months before the suspension order comes into effect. He stated that as a consequence of the temporary stay, which was granted when the proceedings were entered into the Commercial List, that period would expire towards the end of March 2026 if he refused to continue the stay. He stated that TikTok will be required to take steps in advance of the suspension order taking effect and therefore it does not have the full benefit of the six-month implementation period before 38 needing to take potentially irreversible steps. Mulcahy J. held that a short further delay in TikTok’s compliance with the orders pending the determination of these proceedings does not greatly increase the risk that TikTok’s failure to comply with Article 46 of the GDPR poses. He noted that the DPC has not concluded that the personal data at issue is not subject to equivalent protection in China to that which it would enjoy in the EU, rather that TikTok has failed to discharge its obligations to establish that the personal data is subject to such protection. The judge held that there is no finding that there is a current breach of Article 46. He held that a stay posed no risk to the orderly implementation of the GDPR regime, nor to the implementation of the decision in due course. Mulcahy J. stated that it was not clear whether TikTok’s users had been advised of the DPC’s findings against TikTok, in particular, that it has not complied with Article 46 in relation to the transfers. He held that any concern about the limited short-term risk to TikTok users’ fundamental rights would be somewhat ameliorated if their continued engagement with the platform was on a basis where they were was informed as to the issues identified by the DPC. 63. Mulcahy J. granted the stay pending the determination of the substantive appeal. He did so on the basis of an undertaking by TikTok to prosecute its appeal with all reasonable diligence and, in any event, to ensure insofar as it is within TikTok’s power to do so, that the appeal is heard not later than March 2026. He stated that TikTok was required to notify, in a manner to be agreed, or in default as directed by the court, all of its users of the DPC’s decision in clear and easily understood language. Zuckerfabrik 39 64. The test posited by the Court of Justice in Zuckerfabrik falls to be understood against the background of its earlier decision in Factortame. There, it was found that national courts when applying community measures having direct effect must enjoy the power to make interim orders protecting the rights thereby asserted against Member States. The issue in Factortame arose in proceedings in which it was said that primary legislation introduced in the United Kingdom imposing nationality requirements on the ownership of fishing vessels was contrary to Community law. Interim relief was sought before the English courts suspending the application of that legislation pending a challenge in those courts to the validity of the measures. The Court of Justice answered a referred question of whether it was permissible for national law to preclude interim relief in these circumstances – as the law of the United Kingdom did – on the basis that national rules which prevented, even temporarily, Community rules and judgments from having full force and effect are incompatible with requirements of the full effectiveness of Community law. Moreover, it held that it would impair the effectiveness of the provision then governing the making of references to the Court of Justice, Article 177 of the EEC Treaty (now Article 267 TFEU), if a national court having stayed proceedings pending a reply by the Court of Justice to a referred question, was not able to grant interim relief until it delivered its judgment following the response of that court. 65. The Court of Justice did not answer a second question referred to it as to the criteria to be applied in deciding whether or not to grant such relief. The Advocate General had proposed that those criteria would be a matter for national law, subject to the national law rules not rendering exercise of the rights impossible and to these being no less 40 favourable that those available in cases relating only to national law (para. 34; Advocate General Tesauro). Before the Court of Justice, all parties appear to have accepted that the test was governed by national law, the European Commission in fact urging that the approach set out in American Cyanamid Co. v. Ethicon Ltd. [1975] AC 396 was appropriate in the circumstances. That view commanded some support in the academic commentaries at that time (see, in particular, Peter Oliver, ‘Interim Measures: Some Recent Developments’

(1992)29 Common Market Law Review 7, 12). It might be thought that this was understood by all involved as following inevitably from the principle of national procedural autonomy: the substantive issue in the case was addressed to the validity of a national law, not of a community measure, and would be decided by the national courts applying their own procedural law. There was every reason to assume that the conditions attached to the grant of any suspensory relief would also be a matter for the national courts applying their own rules of procedure.

1. While it might be said that Zuckerfabrik concerned the same general issue as did Factortame – the power of national courts to grant interim relief the effect of which was to suspend the implementation of measures that were said to conflict with EU law – it did so in a fundamentally different context. In Zuckerfabrik, the underlying challenge sought the annulment of both Council Regulation (EEC) 1914/87 and of a national decision (“the decision”), imposing levies that implemented that Regulation. The effect of the impugned provisions was to require payment by the applicant sugar producers of significant sums intended to contribute to losses sustained by the Community from sugar exports. The applicants brought an action before the national courts seeking annulment of the decision, in support of which they contended that Council Regulation (EEC) 1914/87 was invalid. They sought interim orders suspending 41 the obligation to make payments on foot of the decision until the Court of Justice had ruled on the validity of Council Regulation (EEC) 1914/87 pursuant to the necessary reference from the national courts to that end. One of the questions referred to the Court of Justice was directed to whether a national court had the power to grant the interim suspensory orders in question.
2. Whereas in Factortame the preclusion on the grant of interim measures derived from national law (the common law of the United Kingdom not permitting orders suspending the operation of primary legislation), in Zuckerfabrik the apparent obstruction to the grant of this relief arose from EU law and, in particular, from the view that for national courts to interfere with the implementation of Community law would be beyond their competence having regard to the supremacy of Community law. That clog was easily removed: the legal protection guaranteed by Community law, it was found, includes the right of individuals to challenge the legality of Community regulations before national courts and to request those courts to make a reference for a preliminary ruling. That right would be compromised if individuals were not, pending the decision of the Court of Justice on foot of that reference, in a position to obtain a decision granting suspension of the enforcement of regulations thereby impugned (the national courts, of course, themselves not having the power to rule that a Community act is invalid, Case 314/85 Foto-Frost v. Hauptzollamt Lübeck Ost (EU:C:1987:452 ). In that regard, the court, referring to Factortame, said that the interim legal protection which Community law ensures for individuals before national courts must remain the same irrespective of whether they contest the compatibility of national legal provisions with Community law, or the validity of secondary Community law, in view of the fact that the dispute in both cases is based on Community law itself (para. 19-20). That statement, however, 42 was made in a context in which the validity of the national measure was entirely dependent on the validity of the Community law, and in which the decision of the national court as to the former would be dictated by that of the Court of Justice regarding the latter.
3. Thus, it was the fact that Article 185 of the EEC Treaty (in the context of applications for annulment) expressly enabled applicants to request the suspension of enforcement of a contested act by the Court of Justice itself, that drove and determined scope of this conclusion. Logically, if in such an annulment action the Court of Justice could order interim suspension of an impugned measure, the national courts should be able to grant similar relief where they referred the same question of validity to the Court of Justice. As the court put it: ‘the coherence of the system of interim legal protection therefore requires that national courts should also be able to order suspension of enforcement of a national administrative measure based on a Community regulation, the legality of which is contested’ (para. 18). Since the power thus deduced by the court corresponded to that under Article 185, the conditions it imposed were those established and applied by the court in deciding applications in proceedings brought pursuant to that provision. Such uniform application, the court said, is a fundamental requirement of the Community legal order. So, while the suspension of enforcement of administrative measures based on a Community regulation was ‘governed by national procedural law, in particular as regards the making and examination of the application’, the ‘conditions’ to which the application was subject must be ‘uniform so far as the granting of such relief is concerned’ (para. 26). One of those conditions was that suspension was necessary ‘in order to avoid serious and irreparable damage to’ the party seeking the order (para. 28). Importantly, it was said, ‘purely financial damage 43 cannot, as the Court has held on numerous occasions, be regarded in principle as irreparable’ (para. 29).
4. The conditions thus imposed by the court were conditions of Community law, and not of national law. That corresponded not only with the theory on which the power was based (that the right to challenge Community legislation in national courts and to request a reference to the CJEU would be diminished if those courts were unable to make such suspensory orders) but it reflected the fact that the national court was never going to decide the issue of validity; its interim orders were not merely suspensory, but preliminary to the decision of the Court of Justice itself on the underlying challenge to the validity of the Regulation. The parasitic attack on the national measures was entirely dependent on the success of the claim that the Regulation was invalid. That decision, obviously, would be made by the European Court only by reference to EU law.
5. The criteria by reference to which such suspensory orders are made was developed in the subsequent cases (see Case C-465/93 Atlanta Fruchthandelsgesellschaft mbH and ors v. Bundesamt für Ernährung und Forstwirtschaft (EU:C:1995:369) and Joined Cases C-453/03, C-11/04, C-12/04 and C-194/04 ABNA Ltd. and ors v. Secretary of State for Health and ors (EU:C:2005:741)), propounding the factors to which I have earlier referred – proof that there are serious doubts as to the validity of the measure in question, that a stay is required as a matter of urgency in the sense that it is necessary in order to avoid serious and irreversible damage to the party seeking the stay, and that the urgency outweighs the interests arising. Moreover, and as the DPC points out in its submissions, the law is now that pecuniary damage will generally be considered serious and irreparable only where the applicant can establish that absent a stay it would find 44 itself in a situation likely to jeopardise its financial viability, or its market share would be significantly altered and there would be structural or legal obstacles preventing it from regaining that share (Case T-139/24 R Webgroup Czech Republic v. Commission (EU:T:2024:475) at paras. 77-81, upheld in C-620/24 P(R) WebGroup Czech Republic v. Commission (EU:C:2025:136) at para. 19).
6. The CJEU case law suggests that at least part of the reason that financial losses will not constitute an irreparable damage is that they can be recovered in an action for damages under the theory recognised by the Court of Justice in Joined Cases C-6/90 and C-9/90 Andrea Francovich and Danila Bonifaci and ors. v. Italian Republic (EU:C:1991:428) (“Francovich”). However, this means that a person who might have a theoretical claim to damages under Francovich if the challenged decision is declared invalid, may well never obtain such damages, with the result that their application for interim relief has been refused on an assumption that has not materialised. The consequence is, as Collins J. put it in Three (at para. 87): ‘…financial loss might be regarded as reparable even though the prospect of actually recovering monetary compensation was limited by reason of the restrictive rules governing the non-contractual liability of the Union and its institutions (rules which, as mentioned, apply also to the non-contractual liability of Member States under Francovich).’
7. The ‘restrictive rules’ to which reference is made here derive from Joined Cases C46/93 and C-48/93 Brasserie du Pêcheur SA v. Germany and R v. Secretary of State for Transport, ex parte: Factortame Ltd. and ors (EU:C:1996:79) (“Brasserie du Pêcheur”). There it was explained that the right to recover financial loss consequent 45 upon breach of provisions of EU law depended not merely upon the rule of law infringed being intended to confer rights on individuals, and that loss causation be established, but also that ‘the breach must be sufficiently serious’ (para. 51). That latter requirement meant that the Member State ‘manifestly and gravely disregarded the limits on its discretion’ (para. 55), that in turn enabling a consideration of the following factors (para. 56): ‘the clarity and precision of the rule breached, the measure of discretion left by that rule to the national or Community authorities, whether the infringement and the damage caused was intentional or involuntary, whether any error or law was excusable or inexcusable, the fact that the position taken by a Community institution may have contributed towards the omission and the adoption or retention of national measures or practices contrary to Community law.’
8. In the course of his opinion in Francovich, the Advocate General (Mischo) observed the combined effect of Factortame and Zuckerfabrik as being that Community law could directly confer on national judicial authorities the power to ensure effective protection of rights and could lay down conditions governing the exercise of the jurisdiction which it thus conferred on national courts (para. 55). He also said that it was ‘not to be excluded’ that the conditions for the grant of the suspension of the operation of a national administrative measure set out in Zuckerfabrik might also govern the suspension of the operation of a national statute which was contrary to Community law (id.). 46
9. That this was not so was made clear in Unibet. There, a series of questions were referred by a Swedish court in proceedings brought by claimants seeking to challenge the compatibility with EU law of provisions of national legislation prohibiting the advertising by foreign gaming companies of their services. One of the questions was directed specifically to whether in such a case, an application for interim relief was governed by national law, or whether the national court must apply the criteria outlined in Community law for interim protection. Both the Advocate General (Sharpston) and the court concluded that, provided the remedies met tests of effectiveness and equivalence, the criteria governing their grant were fixed by national and not Community law.
10. In reaching that conclusion each started from the premise that it is for the domestic legal systems to lay down the detailed procedural rules governing actions for safeguarding Community law rights subject to principles of effectiveness and equivalence. From there, the opinion and judgment variously observed (a) that the case was concerned with a national law measure, (b) by definition it applied in only one Member State, (c) that it was more logical for the procedure governing interim suspension of a national law on grounds of alleged incompatibility with Community law to be the same as that governing interim suspension of a national law on other purely domestic grounds, (d) that the rationale of Zuckerfabrik (that there was a Community interest in having uniform criteria governing interim orders where only the CJEU has jurisdiction to declare the measure invalid) was inapplicable where the underlying challenge was to a measure of national law (the foregoing all appear in the opinion of the Advocate General at paras. 91-94) and (e) that where the issue in the underlying proceedings was: 47 ‘…the effects of national legislation where the compatibility of that legislation with Community law is contested … in the absence of Community rules governing the matter, it is for the domestic legal system of each Member State to determine the conditions under which interim relief is to be granted for safeguarding an individual’s rights under Community law’ (judgment of the court paras. 79 and 80).
11. In Dowling (where the court confirmed that the Okunade test satisfies the requirements of equivalence and effectiveness), this court fixed the test derived from Zuckerfabrik as operating where there is a challenge to the validity of an EU act. It observed of the decision in Unibet (at para. 86): ‘where there is a challenge to a national measure, national procedural rules are to apply subject to the principles of equivalence and effectiveness. It follows that it is possible that different results might arise in different member states, in the event of a challenge to similar national measures, because of the applicability of different procedural regimes, provided always that each such regime must provide an effective remedy.’ Which test?
12. The argument advanced by the DPC – urged forcefully and at points ingeniously by Ms. Smith SC and Ms. Donnelly SC – revolved around what they presented as the sui generis and unique nature of the DPC decision in issue. In that regard, the argument focussed on the ‘one-stop shop’ put in place by the GDPR. The DPC emphasised that 48 the effect of Article 60 GDPR is that the lead supervisory authority cannot reach a decision of the kind in issue here without the agreement of all ‘supervisory authorities concerned’ (that is authorities in states in which data subjects who are substantially affected or likely to be so affected by the processing reside (Article 4

(22)of the GDPR)). Where a draft decision is submitted to the supervisory authorities concerned (as is required) and where a reasoned objection is communicated by such a supervisory authority, the lead supervisory authority must submit the decision to a consistency mechanism provided for in Articles 63-65 of the GDPR. That mechanism, broadly, involves the formation by the EDPB of an opinion which, if not accepted by the lead supervisory authority, will be followed by a decision of the EDPB which shall be binding on the lead supervisory authority and the other supervisory authorities. The lead supervisory authority must, under Article 65

(6)then adopt its final decision ‘on the basis of’ the decision of the EDPB. Thus, if that process had been exhausted in the inquiry undertaken by the DPC into TikTok and the decision questioned by a supervisory authority concerned, the ultimate decision would – although legally that of the DPC – comprise a decision in substance made by the EDPB.

1. Recital 143 expressly provides that: ‘where a decision of a supervisory authority implementing a decision of the Board is challenged before a national court and the validity of the decision of the Board is in issue, that national court does not have the power to declare the Board’s decision invalid but must refer the question of validity to the Court of Justice …’. 49
2. The DPC says that that decision, thus, could only be annulled by the CJEU, could only be suspended in accordance with Zuckerfabrik, and, it followed, the same legal theory should apply to all such decisions of the DPC. There would, the DPC argues, be a ‘fundamental illogicality’ if one test governed the suspension of a decision where there had been disagreement between the supervisory authorities concerned, but another where there had not. Indeed, it was observed in submissions, it was in theory possible that a decision of a lead supervisory authority could be challenged on grounds that could only be adjudicated upon by the CJEU, but also on other grounds that were not dependant on the EDPB decision. That, it was suggested, demanded that the same test for the grant of an interim stay be applied across the board.
3. If, in contrast, the decision is not the subject of a reasoned objection, Article 60

(6)provides that the supervisory authorities concerned are ‘deemed to be in agreement with that draft decision and shall be bound by it’. Although normally the lead supervisory authority is responsible for adopting and notifying the controller or processor of the decision (Article 60

(7)), Article 60

(8)provides that where a complaint is rejected, the supervisory authority where the complaint was lodged, instead of the lead supervisory authority, is responsible for adopting the decision and notifying the complainant. Article 60

(9)provides that where a complaint is upheld in part and rejected in part, the lead supervisory authority is responsible for adopting the portion of the decision wherein the complaint is partially upheld and notifying it to the controller, while the supervisory authority where the complaint was made is responsible for adopting the portion of the decision wherein the complaint is partially rejected and notifying it to the complainant. This, the DPC explains, is for the purpose of determining the Member State within which the decision can be challenged. In this way, it urges, the consistency 50 and co-operation mechanism ensures that all decisions of supervisory authorities involving cross-border processing are made either jointly with the consensus of all supervisory authorities concerned under Article 60, or are made pursuant to a binding decision of the EDPB, an EU body, under Article 65. All such decisions are binding throughout the EU/EEA. 81. The DPC framed these provisions as part of a broader context whereby the object of the GDPR is to obtain a consistent, equivalent and high level of protection of personal data across all Member States, arguing that this demanded that the approaches adopted by different supervisory authorities are not fragmented, and are homogenous. All of this, it contended, dictated that the conditions attaching to the making of interim orders the effect of which would be to suspend a decision of a lead supervisory authority had to be uniform and thus governed by EU law. Moreover, it said, decisions of a lead supervisory authority of the kind in issue here necessarily affected data subjects throughout the EU/EEA, thereby demanding a single rule of law governing the making of such interim suspensory orders. Thus, it contended, the position was closer to Zuckerfabrik than to Unibet, in the latter of which the Advocate General had emphasised that it was appropriate that interim orders be governed by national procedural law because they applied in only one Member State. 82. The various facets of this sophisticated argument break down when attention is paid in the first instance not to the legal regime governing the grant or withholding of interim measures, but to (

1. a)the law that ultimately determines whether the decision challenged is valid or invalid, (
2. b)the location of the power to hear and decide that challenge, and (
3. c)the fact that only one national court can entertain challenges to a decision of a 51 supervisory authority. It follows from the third of these, in particular, that only one national court can stay that decision, so the risk of inconsistent decisions across the network of national courts that featured in Zuckerfabrik, does not arise. Each of these three features of the legal context should, moreover, be viewed in the light of the fact that notwithstanding the need for agreement with other supervisory authorities, decisions of the lead supervisory authority such as that in issue here, are those of that authority alone, and this remains the situation even where the EDPB has issued a decision (Case C-97/23 P WhatsApp Ireland v. European Data Protection Board (EU:C:2026:81)). 83. Article 78 of the GDPR provides that each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. It states that proceedings against a supervisory authority shall be brought before the courts of the Member State where that authority is established. This means – and there was no dispute about this – that it is Irish law that will determine not merely the substantive law by reference to which the legality of the decision is determined, but also the standard of review, the admissibility of evidence on review, the procedures governing that review, and the threshold for judicial intervention. This point was specifically debated by members of the court with counsel for the DPC in the course of the hearing: when the court at the end of the day decides to allow the statutory appeal, or to disallow it, it does so on the basis, counsel said, of Irish law, not European law. Of course, some challenges will be based on the principles of EU data protection in general, and the provisions of the GDPR in particular, but this is not the only basis on which a decision of the DPC could be found invalid. As this case shows, it is to be expected that some challenges will raise issues of procedural 52 fairness, and the exact parameters of those principles will be products of national law. In a similar vein, counsel urged that even if a ground of appeal was solely and exclusively based on national law, the Zuckerfabrik test would continue to apply, yet in that very situation Francovich damages would not lie. 84. All of this exposes an incoherence in the legal framework as it is viewed by the DPC – that a court would apply a test which, as Zuckerfabrik shows, is one of EU law, to determine the incidental question of whether a decision should be suspended, but an Irish law test to the fundamental and substantive question of whether the challenged decision is actually valid. It also reveals that the GDPR enabled a far more fundamental fragmentation of the decision-making process than will follow from the application of national law to the question of an interim suspension. To take one example instanced in the DPC’s submissions, where data controllers with their main establishments in different Member States infringe the GDPR in the same manner, not only might one obtain a stay, while the other might not, but one may secure a determination of invalidity by reference to legal or procedural rules that are not applicable to the other. It would also mean that in a case in which the ground of challenge was only one of national law, the court would be applying that EU law test to determine if there should be suspension, the test incorporating a consideration of the merits of the case, but those merits being determined not by EU law, but by domestic law. The test would function on the basis that financial losses alone would not suffice to ground a stay because of the availability of Francovich damages, yet in that situation Francovich damages would not – on the DPC’s account of the law – be available at all. This is far removed from the position in Zuckerfabrik where the entire basis for the challenge to the national law measure was predicated on the challenge to the validity of the underlying Regulation, 53 that challenge being one determined by the Court of Justice by reference to its procedural law, and exclusively by reference to EU law. 85. Some discordance, as it were, is a necessary consequence of the failure to harmonise the rules governing substantive legality and, indeed, this was expressly recognised by this court in Dowling (at para. 86, which I have earlier quoted). The real question is where the discordance should lie, and how it can be minimised. What the DPC contends for is the deduction from the GDPR of partial – and selective – harmonisation of the rules governing interim suspension pending an adjudication as to validity, where there has been no comprehensive harmonisation of the rules that actually govern legality. That is both illogical and unprincipled. There has never been a case in which it has been remotely suggested that EU law dictates the terms of an interim suspension of a challenged decision where EU law does not itself exclusively determine the basis on which the decision can be challenged, let alone a case in which the issue of validity would in actuality be decided not by the CJEU, but by the national court. The effective qualification of national procedural autonomy demanded by the decision in Zuckerfabrik was the product of the need to align the jurisdiction of national courts to receive a challenge to the validity of an EU measure, with the legal framework within which such a measure could be annulled by the CJEU itself. The context was one in which, as I have earlier observed, the challenge to the national measure was entirely parasitic upon the CJEU’s decision as to the validity of the EU measure. It followed logically that the conditions for suspension of each must be the same. That rationale is of no application to the challenge the subject of these proceedings, which will be decided by national courts quite independently of the outcome of any proceeding before the CJEU. 54 86. In fact, far from authorising that partial harmonisation, the GDPR proposes the opposite. Noting – as counsel for the DPC acknowledged in the course of submissions – that national procedural autonomy is the ‘default position’, Recital 143 provides that: ‘[p]roceedings against a supervisory authority should be brought before the courts of the Member State where the supervisory authority is established and should be conducted in accordance with that Member State’s procedural law. Those courts should exercise full jurisdiction, which should include jurisdiction to examine all questions of fact and law relevant to the dispute before them’. 87. That unqualified assertion of national procedural autonomy does not – as the DPC stresses – appear in the text of the GDPR, but it affords a strong indication of legislative intent and an affirmation of what follows from what the Advocate General in Unibet – hardly controversially – described as ‘the general rule’. That she made that comment when considering the test to be applied to interim suspensory measures demonstrates that these are indeed matters of procedural and not substantive law, that prima facie fall within the purview of national law (subject of course to requirements of equivalence and effectiveness). When viewed in that way, it is difficult to accept the argument suggested by the DPC that the reference to national procedural law incorporated tests developed by the CJEU and imposed by reason of the requirements of EU law. National procedural autonomy arises precisely because there are no EU rules governing a matter, and thus demands that the Member States ‘lay down the detailed rules of administrative and judicial procedures designed to ensure a high level of protection of rights which individuals derive from EU law’ including ‘how the remedies provided for by 55 Regulation 2016/679 must be implemented…’ (Case C-132/21 BE v. Nemzeti Adatvédelmi és Információszabadság Hatóság (EU:C:2023:2) (“BE”) at paras. 45 and 46). 88. Indeed, the CJEU has consistently referenced the interpretation of Article 78 of the GDPR to the provisions of Recital 143 (see BE at para. 41 and Joined Cases C-26/22 and C-64/22 UF and AB v. Land Hessen (EU:C:2023:958) at para. 52). From that, one might generally expect some express deviation from the apparent terms of Recital 143, had such a deviation been intended, not least of all in a context in which the departure from the application of national law contended for is partial rather than complete. At issue in this case is – as in Unibet and Factortame – a national measure the legality of which will be judged by the standards applied by national law to all such decisions. It would be surprising in those circumstances were EU law to prescribe the mechanisms that will protect the effectiveness of any remedy ultimately granted (subject of course to the national rules complying with principles of effectiveness and equivalence), and astonishing if the displacement of those rules were to occur implicitly and without any indication of a legislative intent to do so. For those reasons, the contention of the DPC that the appropriate test to be applied to this application is that derived from Zuckerfabrik must be rejected. The request for a reference to the CJEU 89. The DPC has requested, in the event that the court disagrees with the position it urges as to the applicability of the Zuckerfabrik test to this application, that we make a reference to the CJEU as to that issue. The DPC urges – and in this respect I think it 56 correct – that the disapplication of the obligation on a final instance national court to make a reference in interlocutory matters as suggested in Case C-107/76 Hoffmann-La Roche AG v. Centrafarm Vertriebsgesellschaft Pharmazeutischer Erzeugnisse mbH (EU:C:1977:89) (at paras. 5-6) operates only where the issue provisionally decided in the interlocutory proceedings may be re-examined in the substantive proceedings and may be subject to a reference to the CJEU at that point. Nonetheless, I agree with Hogan J.’s explanation in his judgment of the difficulties that arise when seeking to apply the third paragraph of Article 267 to decisions such as that in issue here, given the disinclination of the CJEU to address a matter that is no longer live and/or has been overtaken by events. It is, I think, for this combination of reasons that the texts recognise the reality that references are but rarely made in applications for interim injunctions (see Schermers and Waelbroeck at §542). To that extent, and for the reasons outlined by Hogan J., a reference should not be made. 90. That said, for my part I do not believe that this is a case which meets the conditions for an obligatory reference as postulated in the case law of the CJEU. The substantive argument advanced by the DPC runs directly contrary to the decision of the court in Unibet. There is no decision of the CJEU subsequent to Unibet that comes close to suggesting the decision in Unibet should be limited in the manner necessary to sustain the DPC’s argument – that is restricted in its scope to measures that may have an effect only in the Member State in which the relief is sought. Any such test would be hard to formulate with any useful precision, and the reference in Unibet to this consideration must be understood as descriptive of the case before the court, and not prescriptive of any test. 57 91. The decision in Zuckerfabrik was addressed to the grant of interim suspensory relief pending the determination by the CJEU of a challenge to the validity of an underlying EU act. It is only where an applicant seeks to stay a national measure implementing such an EU act pending such a challenge, that the test outlined in Zuckerfabrik is engaged. The rationale for the decision does not extend to a measure promulgated by a national authority, the validity of which is tested before a national court, and the legality of which may be decided in accordance with national law. It would be counterintuitive and illogical to render the grant of interim relief pending the outcome of a legal proceeding subject to a rule of EU law derived from the decision in Zuckerfabrik, when the legal proceeding itself will be determined in accordance with national law. Far from the GDPR suggesting any basis on which such a principle could be adopted by national courts, its terms are consistent only with the contrary. That the material provided by the parties (while noting the reservations of the DPC on some aspects thereof) suggests that this is the view seemingly adopted in all other jurisdictions to have addressed this or similar issues only reinforces the conclusion that this case comes within the construction of the third paragraph of Article 267 TFEU posited by the court in Case C-561/19 Consorzio Italian Management and anor. v. Rete Ferroviaria Italiana SpA (EU:C:2021:799) (at para. 33): the issue is the subject of a decision of the CJEU (Unibet), and the correct interpretation of EU law is ‘so obvious as to leave no scope for any reasonable doubt’. 92. Finally – and in this regard also I agree with the judgment of Hogan J. – if the approach to the grant of interim stays to decisions of bodies such as the DPC I suggest later in this judgment is properly applied, the differences between the test applied by national 58 law and that proposed in Zuckerfabrik are not necessarily substantial. In and of itself, this is a basis for refusing to refer. Okunade 93. The significance of the decision in Okunade lay in the fact that, for the first time, the court sought to take account in structured way of the particular features of suspensory orders made in the course of legal challenges to the validity of administrative decisions. I have outlined earlier the approach formulated by the court to that end. In this appeal, however, the question of how that methodology falls to be applied arises in a very particular context. Unlike some administrative decisions – including that in issue in Okunade itself – the application in issue here arises from a decision that does not just directly affect one person or a small number of persons. It impacts TikTok, obviously, but also potentially affects the interests of many users of its services, whose fundamental rights in the protection of their personal data may be impacted by the decision of the DPC and, in consequence, the suspension of that decision. It is a decision which, as Hogan J. observes in the course of his judgment, is akin to a legislative measure of general application. 94. In Pesca Valentia Ltd. v. Minister for Fisheries and Forestry [1985] IR 193 this court rejected the argument advanced by the defendants in that case that where an interlocutory injunction was sought restraining the enforcement of conditions attached to a fishing licence granted pursuant to a statutory provision that expressly allowed the imposition of such conditions, a special principle should be applied to reflect the fact that the effect of the injunction would be to suspend the exercise by the Minister of a 59 power expressly granted to him by law (see the judgment of Finlay CJ, with whom Walsh, Griffin, Hederman and McCarthy JJ. agreed, at p. 201). Insofar as that case suggests that the court should approach the making of orders suspending the operation of acts of this kind by simply applying the test previously understood as following from Campus Oil v. Minister for Industry (No.2) [1983] IR 88 (“Campus Oil”) (that is by inquiring into whether the plaintiff has established a fair question to be tried, whether damages would be an adequate remedy for the plaintiff if the injunction is not granted and they succeed in their claim, and whether the balance of convenience favours the grant or refusal of such relief) it should no longer be viewed as good law. Even on its own terms, the decision in Pesca Valentia sits in the teeth of a number of earlier decisions in which similar injunctive relief was emphatically refused, and in particular with the importance attached by the court in Campus Oil itself to the presumptive validity of a ministerial order made pursuant to statute (see the judgment of O’Higgins CJ in Campus Oil at p. 107 and James P. Casey ‘Constitutional Law – Enjoining the Enforcement of Statutes’

(1985)7 DULJ 123). In point of fact, not long after Pesca Valentia was decided, in Cooke v. Minister for Communications (Irish Times Law Report, 20 February 1989) the court refused an application for an interlocutory injunction restraining the enforcement of provisions of the Radio and Television Act 1988 pending a challenge to the constitutional validity of certain provisions of that legislation: an injunction, it was said, could not be granted if it had the effect of permitting illegal activity (although similar orders suspending the enforcement of the Wireless Telegraphy Acts against the plaintiffs were made by the High Court in Carrigaline Community Television v. Minister for Transport [1994] 2 IR 359, being subsequently upheld in this court). The actual decision in Pesca Valentia, it might also be observed, was unusual : the court seemed to suggest that if the challenge ultimately 60 failed, the plaintiffs could be prosecuted for breach of the licence conditions during the pendency of the stay – a conclusion that might be thought inconsistent with the grant of the injunctive relief sought.

1. More fundamentally, the court in Merck Sharp & Dohme Corporation v. Clonmel Healthcare Ltd [2019] IESC 65, [2020] 2 IR 1 (“Merck”), has reframed the decision in Campus Oil. The court has thereby made it clear that Campus Oil should not be understood as positing a single test for the grant of an interlocutory injunction in all cases. Instead, it will on occasion require substantial qualification and exception. Thus, it was that the test derived from that case was explained as resolving many applications for interlocutory injunctions and as a valuable guide to the analysis of any application, but not as prescribing ‘strict mechanical rules for the control of future cases’ (O’Donnell J. (as he then was) in Merck at para. 34). Reflecting the rationale of Okunade, O’Donnell J. stated that the underlying theme of the decision in American Cyanamid was in its assertion of the flexibility of the remedy and the essential function of an interlocutory injunction in ‘finding a just solution pending the hearing of the action’ (para. 34).
2. When applied to the suspension of legal provisions or administrative decisions of the kind in issue in this case, that analysis demands the consideration of three particular but related factors. First, in cases of this kind, the availability of damages or compensation simply cannot discharge the decisive function it does in private law proceedings. Usually, in domestic law absent proof of a reckless or knowing excess of power, damages will not be available for losses caused by an invalid administrative decision. As I have explained, Francovich damages, where they arise, are also subject to quite 61 particular restrictions which will often function to prevent the award of damages for losses caused by bona fide decisions made by statutory bodies when exercising discretionary powers. Conversely, the interests sought to be protected by a respondent in such proceedings may not be reducible to damages capable of recovery on foot of an undertaking and, if they are, any financial loss arising from the failure to implement such a decision will often have been suffered not by the public body defending the proceedings, but by third parties. Therefore, in the vast majority of applications for stays or injunctions to arrest the operation of legislation or decisions of administrative agencies in the exercise of their statutory powers, any debate about whether loss or damage is or is not capable of calculation is futile. At the very least, in this regard, the focus of such applications must be quite different from that in a private law action.
3. Second, decisions of the kind in issue here attract in law a presumption of legal validity, to which a court must insofar as possible, give effect. There is, it has been frequently emphasised, a corresponding public interest in the law – including administrative decisions made pursuant to law – being enforced. Moreover, and unlike most cases in which an injunction is sought in a purely private law context, the suspension of a legislative measure or administrative decision will often affect the rights of third parties who are not before the court. These are factors to which the court must attach ‘significant weight’ when determining whether to grant relief suspending the operation of such a measure, not least of all because such measures when presumed valid, represent the status quo ante (Okunade at para. 92; Merck at para. 62; Krikke and ors. v. Barranafaddock Sustainability Electricity Ltd. [2020] IESC 42 (“Krikke”) (at para. 10)). 62
4. Third, the trial judge in this case (at para. 184 of his judgment) recorded the parties as agreeing ‘that the court should not ordinarily consider the merits of the underlying proceedings’. In fact, the more recent case law has quite clearly veered away from the absolutist position reflected in some of the decisions applying American Cyanamid and Campus Oil that the merits of a case are relevant to the grant or refusal of interlocutory relief only to the extent that the court must be satisfied that the claimant has established an arguable case or a ‘fair issue to be tried’. The law has now moved to a point at which the merits are always relevant, and in which there will be cases in which the strength of the claimant’s underlying action may be dispositive. This was explained most emphatically by O’Donnell J. in Merck, where he said (at para. 62): ‘In cases where the balance of convenience may be finely balanced, it may be appropriate to have regard, even on a preliminary basis, to the strength of the rival arguments as they may appear to the court. Certainly, if it was apparent that Clonmel’s case for invalidity was strong … then that might weigh against the grant of an injunction … Courts are correctly reluctant to express views on cases which are to come to trial. However, it would be absurd if this rule of abstention were to result in a court conducting an agonised and necessarily imperfect assessment of a number of variable factors in a field with which it has little familiarity and where the evidence is indirect, written and untested, all the while averting its attention from the area (perhaps of pure law) in which it can justifiably claim expertise’.
5. This echoes comments of Laddie J. in Series 5 Software Ltd. v. Clarke and ors. [1996] 1 All ER 853, 865: 63 ‘…the court should not attempt to resolve difficult issues of fact or law on an application for interlocutory relief. If, on the other hand, the court is able to come to a view as to the strength of the parties’ case on the credible evidence, then it can do so … To suggest otherwise would be to exclude from consideration an important factor and such exclusion would fly in the face of the flexibility advocated earlier in American Cyanamid.’
6. The limitation envisaged here is important: the court must strike a balance between affording due weight to the strength of a legal claim that can be clearly identified and confidently addressed in an interlocutory application, and enmeshing a court at an interlocutory hearing in either an undergrowth of untested and incomplete evidence, or in legal issues of novelty or complexity that are ill-suited to summary disposition. Thus, in Okunade, Clarke J, concluded that the court can, in determining whether to make such orders ‘have regard to the strength of the case at least where, as will frequently be the case, the challenge does not involve issues of fact as such or the sort of complex questions of law which … “call for detailed argument and mature considerations”’ (at para. 98, citing Lord Diplock in American Cyanamid). Most recently, in HA O’Neil Ltd v. Unite the Union and ors. [2024] IESC 8, O’Donnell CJ (at para. 73) put the position as follows in the context of an application for an injunction to restrain certain actions undertaken in the course of a trade dispute: ‘That conclusion is if anything reinforced by any assessment of the relative strengths of the parties' cases. This is a particularly appropriate course where the balance is otherwise equal and where indeed the possibility of 64 uncompensatable loss is difficult to assess and where, as here, the issue is one of solely legal analysis which is not dependent on any issue of fact, which may require the assessment of oral evidence. Courts should always be wary about over-confident predictions of the likely outcome of cases which have yet to be argued fully, and there are many cases which were assessed as weak or even unstateable, and which later triumphed. However, faced with the choice between attempting on the one hand, an assessment of the likely course of events in fact, and assessment of damage that is largely speculative if an injunction is or is not granted in a field of activity in which a court may not have any particular expertise, and on the other hand, an assessment of the strength of the respective legal arguments by an experienced judge, it may be preferable to allow the matter to be decided on an assessment of something in which the court is an expert rather than an amateur.’ The relevance of the merits of the case to the grant of a stay
7. The very nature of public law challenges is that there will often be greater scope for the identification of clear issues of law that can be thus factored into the balance than in many applications for injunctions in private law actions (Okunade at para. 95). Moreover, the consequence of the presumption of validity is that the case for requiring more than merely an arguable case before the due operation of legal measures is suspended will often be overwhelming: ‘[a]n individual ought not be permitted to obtain from a court an order disapplying the law … merely by asserting a stateable, though perhaps weak, case and a fear of substantial damage’ (per O’Donnell J. in Krikke at para. 11). 65
8. It is therefore not surprising that in the United Kingdom there are cases in which the criteria for the grant of a stay in at least certain judicial review proceedings have been framed by reference to a requirement that a claimant establish ‘a strong prima facie case’ on the merits (R(H) v. Ashworth Hospital Authority [2002] EWCA Civ. 923, [2003] 1 WLR 127 at para. 93 (per Mummery LJ)). More recently, the Court of Appeal of England and Wales has noted that there is support at first instance for the proposition that in a public law claim the court will generally be reluctant to grant interim relief in the absence of a ‘strong prima facie case’ to justify the granting of an interim injunction (see, for example, the judgment of Warby J. in R. (on the application of Easybus Ltd.) v. Stansted Airport Ltd. [2015] EWHC 3833 (Admin), at paragraph 95; and the judgment of Farbey J. in R. (on the application of Remus White Ltd., t/a Heathside Preparatory School) v. Ofsted [2018] EWHC 3324 (Admin), at paragraph 21). However, it was observed by Lindblom LJ in R(X) v. Office for Standards in Education, Children’s Services and Skills & Anor [2020] EWCA Civ 594 (at para. 66): ‘[t]his is not to say that the relevant case law at first instance supports the concept of a “strong prima facie case” being deployed as a “threshold” or “gateway” test in such cases, but rather that the underlying strength of the substantive challenge is likely to be a significant factor in the balance of considerations weighing for or against the granting of an injunction’.
9. Today, the position in that jurisdiction is that while a ‘strong prima facie case’ is not an absolutely essential element in all successful applications for interim relief of this kind, if a claim does not disclose a ‘strong prima facie case’ that will weigh against the 66 grant of