About this case:

• Citation:
  [2025] IEHC 619
• Judgment:
  External link
• Court:
  High Court
• Judge:
  Mr Justice Rory Mulcahy

Delivering an judgment for the High Court, Mr Justice Rory Mulcahy observed: “Here, the evidence of loss is robust. The possibility of harm to fundamental rights is far from certain. Accordingly, the serious and irremediable harm which TikTok will suffer if the Decision is ultimately found to be invalid, outweighs the limited risk to EU interests if there is a short delay in implementation of the Suspension Order, on the basis of the conditions proposed.”

Background

On 30 April 2025, the Data Protection Commission (DPC) issued a decision finding inter alia that TikTok Technology Limited had infringed Article 46(1) of the General Data Protection Regulation 2016/679 (GDPR) by failing to ensure that personal data of users within the European Economic Area (EEA), which was transferred outside the EEA by being made available by remote access to personnel based in China, was afforded protection equivalent to that provided within the EU.

The DPC imposed administrative fines totalling €530 million and ordered that TikTok suspend the data transfers and bring its processing into compliance with the GDPR, those orders to take effect six months after the date of the decision.

TikTok appealed the decisions, with the appeal operating as an automatic stay on its requirement to pay the fines pursuant to s.142 of the Data Protection Act 2018. However, the appeal did not operate to stay the suspension or corrective orders.

TikTok applied to the High Court to stay those orders pending the determination of its appeal, claiming that the steps necessary to comply with the orders would cause it to incur billions of euros expenditure, would disrupt its business and workforce, and would diminish its stakeholders’ experience, and that most of those losses could not be made good if it were to succeed on appeal.

The DPC opposed the stay, contending that the fundamental rights of TikTok’s 159 million monthly EEA users would be at risk it the data transfers were to continue.

The High Court

Mr Justice Mulcahy considered that much of the debate between the parties concerned the test to be applied to an application for a stay on a decision of the DPC.

The judge outlined that two issues were relevant to that question, the first being the nature of a decision by a supervising authority, and the second being whether the GDPR provides any indication of the threshold to be applied by a court when considering a stay application or interim measures in respect of such a decision.

As to the applicable threshold, Mr Justice Mulcahy observed that while the DPC contended that a decision of a supervising authority made in accordance with Article 60 of the GDPR could not simply be characterised as a national law measure, it appeared to accept that such a decision could not be characterised as an EU law measure or as a decision of an EU body having regard to the GDPR.

The judge considered inter alia that where the State has jurisdiction to regulate the activities of a data controller whose main establishment is in the State, the fact that a decision binds that data controller within the EU does not appear to be a sufficient point of distinction from any other decision by a national regulator made pursuant to EU law to warrant the disapplication of national procedural autonomy in proceedings before a national court.

The court explained that what is novel about the GDPR regime is that a decision of the supervising authority binds other supervising authorities concerned, emphasising that this must be a manifestation of the “one-stop shop” regime enabling data subjects and data controllers to deal with a single supervising authority in respect of any given issue, rather than an attempt to elevate decisions of lead supervising authorities to quasi-EU law measures.

Further noting that the GDPR did not harmonise or require the harmonisation of national procedural rules and that this could only be understood as “a deliberate legislative choice”, Mr Justice Mulcahy was satisfied that the interpretation of the GDPR strongly suggested that national procedural autonomy should apply to applications for a stay on decisions of supervisory authorities, and was unconvinced that there was anything in the case law of the Court of Justice of the European Union or the national courts which suggested the contrary.

Deciding that the application fell to be considered by reference to the threshold in Okunade v. Minister for Justice [2003] 3 I.R. 153, [2002] IESC 49, rather than by reference to that in joined Cases C-143/88 and C-92/89 “Zuckerfabrik”, Mr Justice Mulcahy pointed out that there was no dispute that there was a serious issue to be tried, where TikTok’s appeal identified serious doubts as to the validity of the DPC’s decision.

As to the adequacy of damages as a remedy, the High Court was convinced that TikTok had established a probability that it would incur very significant costs if required to implement the steps necessary to give effect to the DPC’s orders.

The court further considered whether damages would be recoverable at all if TikTok were to incur loss and succeed on appeal in light of the DPC’s immunity from suit pursuant to s.154 of the 2018 Act. Mr Justice Mulcahy was not satisfied that Francovich damages, alleged by the DPC to be recoverable, would be available to TikTok as its appeal was not confined to EU law issues.

Finding that a hypothetical remedy in damages would not be adequate for TikTok given the scale of its potential losses, the judge turned to evaluate which course would attract the least risk of injustice, noting that the potential injustice of TikTok being required to comply with a decision which is subsequently proven invalid was required to be weighed against the injustice which could result if TikTok avoided or delayed complying with a valid decision.

The court observed that the emphasis in Okunade on the importance of giving appropriate weight to presumptively valid decisions was of particular significance in the case before it, where what was at issue was a risk to fundamental rights.

In this regard, Mr Justice Mulcahy expressed the view that any concern about the limited short-term risk to TikTok users’ fundamental rights would be ameliorated if their continued engagement with the platform was on an informed basis about the issues identified by the DPC.

In those circumstances, the High Court concluded that the grant of a stay on the DPC’s suspension and corrective orders, subject to certain conditions, would give rise to the least risk of injustice. The court was further satisfied that had the Zuckerfabrik threshold applied, the same result would have been achieved.

Conclusion

Accordingly, the High Court granted a stay pending the determination of TikTok’s appeal subject to conditions including that it would ensure, insofar as it was within TikTok’s power to do so, that its appeal is heard no later than March 2026, and that it would notify its users of the DPC’s decision in clear and easily understood language.

TikTok Technology Limited & Anor v Data Protection Commission [2025] IEHC 619