Article 83 GDPR Fines: Parent-Group Turnover, Defence Rights and Aggregation—Irish High Court Refers Key Questions to the CJEU

1) Introduction

In TikTok Technology Ltd and Anor v Data Protection Commissioner [Administrative Fines] (Approved) [2026] IEHC 419, Mr Justice Rory Mulcahy delivered a supplemental judgment confined to the calculation and legal framework governing administrative fines imposed by the Data Protection Commission (“DPC”) under Article 83 GDPR. It must be read with the court’s main judgment [2026] IEHC 347, which upheld the DPC’s findings of infringement of Articles 46(1) (third-country transfers) and 13(1)(f) (transparency on transfers), and upheld the DPC’s finding of negligence as a basis for fining.

The applicants (TikTok group entities, referred to in the judgment as “TikTok”) challenged the DPC’s fining approach on three broad themes: (i) whether the DPC could use ByteDance group turnover (and on what procedural conditions); (ii) whether the DPC gave adequate reasons for the amounts chosen; and (iii) whether the DPC misapplied Article 83, including Article 83(3) on multiple infringements arising from the same/linked processing.

2) Summary of the Judgment

• The court did not set aside the fines at this stage, but identified that several issues are not acte clair and should be determined by the Court of Justice of the European Union (“CJEU”) via Article 267 TFEU.
• The court held (subject to the CJEU’s answers on procedural/structural points) that:
  • 2024 was properly used as the “preceding financial year” for turnover purposes; no culpable delay was established.
  • The DPC was entitled to treat TikTok and ByteDance as part of the same undertaking via a rebuttable presumption of decisive influence arising from 100% ownership through “interposed” companies; TikTok did not rebut it.
  • Most criticisms of the DPC’s Article 83(2) assessment failed; however, the DPC arguably erred in treating “no previous infringements” as neutral and in giving weight to compliance-costs of corrective orders as mitigating—errors said to have operated overall in TikTok’s favour.
  • The reasons challenge (Ground 8) did not justify interference in an appeal on the record where the merits could be assessed by the court.
• The court proposed four questions to the CJEU concerning: (i) whether parent/group liability or defence rights are prerequisites to using group turnover, (ii) whether the parent must be put on notice to rebut decisive influence, (iii) when group turnover enters the fine-setting methodology, and (iv) whether Article 83(3) allows cumulative fines for multiple infringements arising from the same/linked processing.

3) Analysis

3.1 Precedents Cited and Their Role

A. CJEU: fault requirement and the fining framework

The judgment situates itself after the CJEU’s clarification that GDPR fines require fault: Case C-683/21, NVSC and Case C-807/21, Deutsche Wohnen (cited as establishing that Article 83(2) precludes a fine absent intention or negligence). This mattered because TikTok’s remaining challenges largely assumed fines were permissible, and turned instead on how fines are calculated and explained.

B. CJEU: “undertaking” and economic capacity

The pivotal anchor is Deutsche Wohnen, in which the CJEU held that “undertaking” in Article 83(4)–(6) GDPR corresponds to the competition-law concept under Articles 101 and 102 TFEU and is relevant to amount, not to whether a fine may be imposed. The High Court treated this as undermining TikTok’s earlier inquiry-stage position that competition-law notions do not travel into GDPR fining.

The court then relied heavily on Case C-383/23, ILVA, which (i) distinguishes between the maximum fine (cap) and the actual fine, but (ii) requires that the concept of undertaking be taken into account to assess the “actual or material economic capacity” so that the fine is effective, proportionate, and dissuasive under Article 83(1). ILVA is also used to reject TikTok’s attempt to confine turnover analysis to EEA-only profits/turnover.

C. EDPB: WhatsApp Decision and pending EU litigation

The court engaged with the EDPB’s binding Decision 01/2021 (the “WhatsApp Decision”) on three topics:

• Group turnover: the EDPB endorsed taking the relevant undertaking turnover and suggested it can matter beyond the cap.
• “Preceding financial year”: it linked the “event” to the final decision date (Article 65(6) context).
• Article 83(3): it rejected an interpretation that would discard additional infringements when the same/linked processing is involved.

The High Court treated the pending annulment action Case T-709/21 (the “WhatsApp proceedings”) and its admissibility ruling Case C-97/23 as an important backdrop—one reason why referral is practically valuable, though the court did not accept it was legally compelled to stay or defer.

D. Competition-law “undertaking” case-law used by analogy

TikTok invoked classic competition-law liability cases—especially Case C-97/08P, Akzo Nobel and Case C-521/09P, Elf Aquitaine— to argue that if group turnover is used, then parent liability and parent defence rights must follow. The DPC countered with cases stressing the distinct objectives of (a) imputing liability and (b) using group turnover as a proxy for capacity: Case C-58/12P, Groupe Gascogne.

The court’s own merits findings on decisive influence drew on Case C-508/11P, Eni (presumption applies through “interposed” companies). The court also referenced Case C-611/16, Xellia Pharmaceuticals and Case C-637/13P, Laufen Austria AG v. European Commission to address flexibility and default meaning of “preceding financial year”.

E. Irish appellate management of EU-law uncertainty

On case management and the desirability of a reference, the court relied on Meta Platforms Ltd v DPC [2025] IECA 60 (endorsing the pragmatic use of Article 267 references where overlapping EU-law issues are pending). It discussed Case C-344/98, Masterfoods Ltd v HB Ice Cream Ltd but distinguished it because the WhatsApp annulment action involves different parties.

Finally, the court reaffirmed—via LinkedIn v DPC [2026] IEHC 235—that a section 142 appeal is an appeal on the record with “full jurisdiction” on the merits, which shapes how “reasons” complaints operate: inadequate reasoning does not automatically yield annulment if the court can resolve the merits.

3.2 Legal Reasoning

A. Can the DPC use parent/group turnover without imputing liability to the parent?

TikTok’s central submission was structural: once “undertaking” is imported from competition law, the competition-law mechanism (imputation of subsidiary conduct to parent, joint and several liability, and parent rights of defence) must also be imported before group turnover can be used.

The court was inclined to reject that submission on the basis of a statutory-text distinction:

• Competition law (e.g., Regulation 1/2003, Article 23(2)) imposes fines on undertakings.
• GDPR imposes fines on controllers/processors, even though caps (and economic capacity) may reference the “undertaking” concept (per Deutsche Wohnen and ILVA).

However, the court held the matter is not acte clair—not least because the WhatsApp Decision’s reasoning uses competition-law language of imputation (Akzo Nobel), and because the point affects many Irish appeals involving very large fine exposure. It therefore proposed CJEU Questions (1) and (2).

B. “Preceding financial year” and alleged delay

TikTok argued that fairness required using an earlier year (2022) given the inquiry’s duration and ByteDance’s increased 2024 turnover. The court rejected this, holding:

• Text and purpose indicate “preceding financial year” means the year preceding imposition/decision; 2024 was therefore correct on the facts.
• Flexibility in cases like Xellia Pharmaceuticals exists where the preceding year is not representative, not as a fairness-based adjustment for alleged regulator delay.
• No culpable delay was established, and TikTok had itself relied on extensive later-submitted material in other parts of the appeal.

No reference was made on this issue.

C. Decisive influence through “interposed” companies

The court held the DPC was entitled to apply a rebuttable presumption of decisive influence where 100% ownership exists, including through “interposed” entities, relying on Eni. TikTok had not adduced evidence capable of rebutting independence on the market.

D. When does turnover enter the calculation of the “actual” fine?

A key methodological dispute emerged post-ILVA:

• TikTok contended the fine must first be derived solely from Article 83(2) factors, and only thereafter adjusted by turnover to meet Article 83(1).
• The DPC contended turnover is relevant from the outset as part of an integrated assessment (consistent with the EDPB’s Guidelines 04/2022 step methodology).

The court observed the Decision’s language suggested turnover informed the “quantum” directly and that, in practical terms, the scale of the fine “can only really be understood” by reference to ByteDance turnover. Yet it also recognised that the Advocate General in ILVA articulated an “adjustment mechanism” approach, while the CJEU’s own reasoning could be read as more holistic. This uncertainty was referred to the CJEU in Question (3).

E. Article 83(3): cumulation/aggregation of fines

The DPC adopted the WhatsApp Decision approach: multiple infringements from the same/linked processing may attract separate fines, provided the combined amount does not exceed the maximum applicable to the gravest infringement. TikTok argued Article 83(3) bars “aggregation” so that only one fine (for the gravest infringement) may be imposed.

The court held this conflict is not acte clair, noting tension between the WhatsApp Decision and the Advocate General’s characterisation in NVSC of Article 83(3) as a “rule against aggregation”. It proposed Question (4).

3.3 Impact

• Irish GDPR fining appeals are likely to be paused or shaped by the CJEU’s answers to the four questions, particularly given the DPC’s evidence of numerous pending appeals involving multi-billion-euro aggregate fines.
• Group-turnover reliance may trigger procedural redesign in DPC inquiries (and potentially across the EU) if the CJEU requires parent notification, parent participation, or imputation of liability as a condition of using group turnover.
• Methodology of “actual fine” calculation (Article 83(2) first vs integrated turnover-informed assessment) may materially affect fine levels for subsidiaries within large groups.
• Article 83(3) guidance will affect charging/penalty structuring: whether regulators can impose separate fines for multiple infringements arising from the same processing, or must collapse penalties into a single maximum-bounded sanction.
• Domestically, the judgment reinforces that section 142 appeals are appeals on the record (per LinkedIn v DPC [2026] IEHC 235), meaning “reasons” challenges will often be analysed through whether any alleged deficiency affects the merits outcome rather than producing automatic annulment.

4) Complex Concepts Simplified

• “Undertaking” (GDPR fines): A competition-law concept (Articles 101–102 TFEU) used in GDPR Article 83(4)–(6) to set fine caps by reference to total worldwide annual turnover. After Deutsche Wohnen and ILVA, it also matters to assess “economic capacity” for Article 83(1).
• Single economic unit / decisive influence: A parent and subsidiary may be treated as one economic unit where the parent exercises decisive influence. 100% ownership gives rise to a rebuttable presumption of decisive influence, including through “interposed” companies (see Eni).
• Fine cap vs actual fine:
  • Cap: the legal maximum (e.g., 4% of total worldwide annual turnover for Article 83(5) infringements).
  • Actual fine: the amount chosen within the cap, which must be effective, proportionate and dissuasive (Article 83(1)) and reflect Article 83(2) factors.
• Article 83(3) (multiple infringements): Limits the “total amount” where several GDPR provisions are infringed by the same or linked processing. The dispute is whether that rule (a) forbids cumulating separate fines, or (b) permits separate fines but requires the combined total not to exceed the maximum for the gravest infringement.
• Article 267 TFEU reference: A national court asks the CJEU to interpret EU law where the answer is not clear (not “acte clair”).
• Appeal on the record: The High Court has jurisdiction to examine the merits based on the DPC record (and permitted additional material); therefore a failure to give reasons does not automatically lead to annulment if the court can resolve the substantive issue.

5) Conclusion

[2026] IEHC 419 is significant less for final outcomes on the fine amounts (which were not disturbed at this stage) and more for the structured identification of unresolved EU-law questions at the heart of modern GDPR fining: whether and how supervisory authorities can use group-wide turnover, what procedural safeguards that use triggers, what the methodological sequence of Article 83(1) and 83(2) requires, and whether Article 83(3) allows cumulative fines for multiple infringements arising from the same processing.

The court’s proposed CJEU questions, if accepted and answered, are poised to influence not only this appeal but a broader cohort of Irish (and potentially EU-wide) enforcement cases where fine calibration, group structure, and deterrence are central.