Split-Track GDPR Enforcement Appeals: Section 142 Is Fine-Only, With “Appeal on the Record” Review and Discretionary Fresh Evidence Under Sections 142 and 150

3.1 The new procedural precedent: a split-track appeal scheme

The central doctrinal contribution is the Court’s clarification that the 2018 Act establishes a split-track appellate regime:

• Section 142 is a bespoke appeal route triggered only by a decision “to impose an administrative fine”.
• Section 150(5) is the default appeal route for persons affected by a “legally binding decision” of the DPC under the relevant Chapters.

This matters because modern DPC decisions are frequently composite documents combining infringement findings, corrective measures, and fines. The judgment confirms that document form does not control: multiple “decisions” (in the statutory sense) may exist within one composite instrument, and the applicable appeal route depends on the type of decision, not whether it is contained in the same PDF.

3.2 Legal reasoning on Issue 1: why section 142 is fine-only

3.2.1 Statutory text and structure: “in addition, make a decision”

Applying the interpretive approach in Heather Hill Management Company CLG v An Bord Pleanala [2022] IESC 43 (the “words first” principle), the Court treated the language of sections 111, 112 and 113 as decisive: each requires (1) a decision on infringement and then, where infringement is found, (2) the DPC must “in addition, make a decision” on whether and which corrective powers to exercise.

3.2.2 Section 115: fines are singled out and made “subject to Chapter 6”

Section 115(1) separates (a) deciding to impose an administrative fine (subject to Chapter 6) from (b) exercising any other corrective power under Article 58(2) GDPR. This differentiation supported: (i) a need for an identifiable fining decision and (ii) a bespoke appellate mechanism for that fining decision.

3.2.3 Section 150(12)(c): fines can be appealed under section 150, too

A notable feature of the reasoning is the Court’s acceptance that, because section 150(12)(c) captures decisions “to exercise a corrective power”, and administrative fines are a corrective power under Article 58(2)(i) GDPR, a fining decision can fall within section 150. This made sense of section 142’s opening words “Without prejudice to section 150”: the appellant may choose section 150 as the route, but section 142 remains a specialised route for the fine.

3.2.4 Section 142’s internal cues: Article 83 is baked in

The Court treated section 142(4) (“act in accordance with Article 83”) as confirming that section 142 is fine-centric. The Court accepted that Article 83 necessarily requires engagement with the nature and seriousness of the infringement, but held that this does not convert the section 142 appeal into an appeal against infringement findings.

3.2.5 “Absurdity” arguments rejected

The appellant argued that infringement and fine are inextricably interwoven, making bifurcated appeal routes unworkable. The Court rejected that submission: courts can assess Article 83 factors for sanction purposes without reopening the antecedent question of whether an infringement occurred (which can be addressed, if appealed, under section 150).

3.3 Issues 2 and 3: the appeal is “on the record” (not Orange), for both sections 142 and 150

3.3.1 The “taxonomy” problem and the Court’s approach

The judgment acknowledges the wider Irish problem: legislative appeal provisions often fail to specify the form of appeal, spawning costly preliminary litigation—an observation traced through Nowak v. Data Protection Commissioner [2016] 2 I.R. 585 and Kelly v. Information Commissioner [2017] IESC 64. While the parties argued in the language of the categories described in FitzGibbon v. Law Society [2015] 1 I.R. 516, the Court warned against treating those labels as determinative; the ultimate task is interpretation of the particular statute in context.

3.3.2 Why Orange was rejected

The DPC pressed for an “appeal against error” applying Orange Ltd. v. Director of Telecoms (No. 2)[2000] 4 I.R. 159 (serious and significant error, with deference). The Court refused to treat Orange as a default presumption and emphasised:

• The 2018 Act confers an unusually strong remedial power: section 142(3)(b) allows the Court to replace the fining decision with “such other decision as the court considers just and appropriate” (including a different or no fine).
• The same “substitution” logic exists in section 150(6)(b) (substitute the Court’s own determination). This breadth is difficult to reconcile with a tightly constrained Orange-style error threshold.
• The Court considered Xerico Ltd. v Residential Tenancies Board [2025] IECA 202 highly persuasive: where the statute authorises substitution/replacement and permits additional evidence, the appeal was construed as “on the record” rather than an Orange appeal against error.

3.3.3 EU law compatibility: “full judicial review” and procedural autonomy

The Court reviewed CJEU authorities invoked by both sides, including: Case C 386-10 Chalkor AE Epexergasias Metallon v. European Commission, Case C-132/21 BE v Nemzeti Adatvedelmi es Informachiszabadsag Hatosag, and Case C-26/22 and C-64/22 UF, AB v. Land Hessen and SCHUFA Holding AG. It extracted two key propositions:

• Article 78 GDPR requires full judicial review of supervisory authority decisions, with jurisdiction to examine all questions of fact and law relevant to the dispute.
• The GDPR leaves Member States significant procedural autonomy (subject to effectiveness/equivalence), so these cases do not dictate a single national “standard of review” formula.

Importantly, the Court rejected the argument that SCHUFA demanded a narrow deference model; it read SCHUFA’s discussion of supervisory authority discretion as confined to the choice of remedies under Article 58(2), not as a general restriction on national appellate jurisdiction.

3.4 Curial deference: preserved, but narrowed and fact-sensitive

Although rejecting Orange as the governing standard, the Court preserved a role for deference: it may be appropriate on issues within the DPC’s technical expertise, assessed issue-by-issue by the trial judge. The Court drew on: Henry Denny & Sons (Ireland) Limited v. Minister for Social Welfare [1998] 1 I.R. 34, Millar v Financial Services Ombudsman [2015] IECA 127, Stanberry Investments Limited v. Commissioner of Valuation [2020] IECA 33, and Xerico.

The judgment also rejects the idea that GDPR’s Article 60 cooperation mechanism requires a more deferential court standard. Consistent with TikTok Technology Limited v. Data Protection Commissioner [2025] IEHC 619, the Court treated national procedural rules and judicial oversight as independent of the supervisory authority consensus-building mechanism.

3.5 Issue 4: fresh evidence and argument—discretion under section 150

Section 142(2) explicitly permits the court to consider evidence/argument whether or not presented to the DPC. The contested question was whether section 150 impliedly prohibits fresh material because it lacks an equivalent clause. The Court held it does not: there is no blanket exclusion, and admission is a matter of judicial discretion.

In reaching this conclusion, the Court relied on the logic of judicial control of fair procedures in FitzGibbon, the discretionary approach noted in Ulster Bank v. FSO, and considered ECHR authorities (including Produkcija Plus storitveno podjetje d.o.o. v. Slovenia and Ramos Nunes de Carvalho e Sá v Portugal) as cautioning against rigid exclusions where factual contest is material.

A practical nuance is recognised: the burden may be lighter under section 142 because the statute expressly contemplates fresh evidence/argument, while section 150 applications may face a more demanding justification.

3.6 Precedents cited: how they shaped the outcome

Heather Hill Management Company CLG v An Bord Pleanala [2022] IESC 43

Provided the interpretive methodology: plain statutory language is the “first port of call”, and the onus is on the party alleging a different effect from the text. This underpinned the Court’s rejection of “absurdity” arguments seeking to expand section 142 beyond its fining focus.

Orange Ltd. v. Director of Telecoms (No. 2)[2000] 4 I.R. 159 and Carrickdale Hotel Limited v Controller of Patents [2004] 3 I.R. 41

These framed the DPC’s preferred model (“serious and significant error” plus deference). The Court treated Orange as a relevant strand of Irish administrative appeals, but not as a presumptive template, especially given the 2018 Act’s distinctive substitution powers.

FitzGibbon v. Law Society [2015] 1 I.R. 516 and Nowak v. Data Protection Commissioner [2016] 2 I.R. 585

FitzGibbon supplied a vocabulary (de novo / on the record / against error / point of law) and highlighted the court’s capacity to craft procedure to secure fairness. Nowak’s broader critique of legislative vagueness contextualised the need for careful interpretation rather than presumptive “consistency”.

Xerico Ltd. v Residential Tenancies Board [2025] IECA 202

This was the closest domestic analogue: a sanctions appeal mechanism with (i) substitution/replacement remedies and (ii) express allowance for additional evidence. Xerico was central to construing sections 142 and 150 as “appeal on the record”.

CJEU authorities (Chalkor; BE; SCHUFA)

Treated as setting minimum requirements (full judicial review; effective judicial protection), while reaffirming procedural autonomy. SCHUFA was particularly important to repel a narrow conception of judicial review in GDPR complaints.

3.7 Impact

3.7.1 Litigation strategy in Ireland

• Parties must now plead with precision: fine challenges belong under section 142, while infringement and non-fine measures must be channelled under section 150.
• The decision reduces uncertainty about whether a “composite” DPC decision can be appealed as a unit under section 142: it cannot, merely because it includes a fine.
• The “appeal on the record” holding signals more intensive merits scrutiny than an Orange “serious and significant error” threshold, while still allowing calibrated deference on technical questions.

3.7.2 Evidential consequences

• Section 142 appellants can expect a comparatively more permissive statutory gateway for new evidence/argument.
• Under section 150, fresh evidence remains possible, but only by persuading the trial judge that admission is justified.

3.7.3 System effects for GDPR enforcement

The judgment reinforces that Irish courts are expected to provide “full judicial review” in GDPR enforcement, consistent with Article 78 GDPR and the Charter, without being structurally constrained by the Article 60 cooperation mechanism. It also suggests future statutory drafting lessons: where the Oireachtas intends Orange-style review, it can legislate expressly.