Anonymized Summary of Judgment

Factual and Procedural Background

This judgment concerns an appeal by Company A (the primary applicant) and Company B (joined as an applicant on the basis that it would ultimately be liable for any fines) against a decision of Company C, the national supervisory authority, under the Data Protection Act 2018 and the GDPR. Company C commenced an inquiry into Company A on 14 September 2021 regarding transfers of personal data of users in the European Economic Area ("EEA Users") to China. After investigation and consultation with other supervisory authorities under Article 60 GDPR, Company C issued a Decision on 30 April 2025. The Decision defined the temporal scope of the Inquiry as transfers taking place from 29 July 2020 until 17 May 2023 and found, inter alia, that Company A infringed Article 46(1) GDPR by failing to ensure an essentially equivalent level of protection for data transferred (accessed remotely by personnel in China). Company C also found a breach of Article 13(1)(f) GDPR for a specified earlier period, imposed administrative fines (total €530m) and issued two orders: a Suspension Order (to suspend the data transfers) and a Corrective Order (to bring processing into compliance).

Company A appealed the Decision pursuant to sections of the national Act. By operation of statute the appeal automatically stayed the administrative fines, but not the Suspension Order or the Corrective Order. Company A applied for a stay of those orders pending the appeal, arguing that compliance steps required by the Suspension Order would be extremely costly, disruptive and largely irreversible, rendering damages an inadequate remedy. Company C opposed the stay principally on the basis that the fundamental rights of Company A's 159 million monthly EEA users would be endangered if transfers continued.

The interlocutory hearing was held in the Commercial List over four days in October 2025. The court previously granted a temporary stay pending determination of this stay application. The hearing addressed (among other matters) (1) the appropriate legal test for a stay of a decision of a supervisory authority under the GDPR (whether national procedural law or the stricter EU interim-measures test applies) and (2) whether Company A had met the applicable test so as to justify a stay pending appeal.

Legal Issues Presented

1. Which test applies to an application for a stay (interim relief) of a decision of a national supervisory authority made under the GDPR: the national-law test applied in Okunade (serious issue to be tried; least risk of injustice; adequacy of damages) or the EU Court's Zuckerfabrik criteria (uniform interim-measures standard used where EU measures or the validity of EU measures are implicated)?
2. Whether Company A established the requisite threshold for a stay pending appeal (i.e., an arguable/serious issue to be tried and the balance of interests satisfying the applicable test).
3. Admissibility and relevance of certain affidavit evidence and expert reports filed in support of and in opposition to the stay application (including evidence about: Chinese law, technical measures implemented by Company A — "Project Clover" — and an operational disclosure concerning Company A's internal support platform).
4. If a stay is appropriate, on what terms and conditions should it be granted (duration, undertakings, notifications to users, liberty to apply, listing for consequential orders)?

Arguments of the Parties

Applicant's (Company A and Company B) Arguments

• The Decision is a national-law measure of Company C and the default rule of national procedural autonomy governs the test for interim relief; accordingly the Okunade test applies.
• Company A has identified serious issues to be tried on grounds of law and fact (including alleged fair procedure failures by Company C, alleged errors in interpretation of Chinese law, and errors in assessment of technical and organisational safeguards such as Project Clover).
• Implementation of the Suspension Order would force Company A to implement the "Suspension Solution" (technical anonymisation and removal of access by China-based personnel), incurring very large costs (estimates of billions of US dollars), causing business disruption, loss of institutional knowledge, delayed roll-out of services and harm to stakeholders (users, creators, advertisers, sellers). Many of these harms would be hard or impossible to quantify and to repair; damages would therefore be an inadequate remedy.
• Company A submitted detailed witness and expert evidence (technical, operational, financial and legal) to demonstrate the impact of the Suspension Order and to show that Project Clover and other measures reduce the practical risk to user data.
• If a stay is granted it should be for the shortest practical period with conditions (e.g., undertakings to prosecute the appeal diligently, an agreed timetable for hearing, and notification to users about the Decision and appeal/stay).

Respondent's (Company C) Arguments

• Company C accepted that national procedural autonomy is the default but argued that the special nature and effect of an Article 60 co-decision (and the consistency mechanism) means decisions by supervisory authorities following that process have an EU-wide binding effect; therefore the stricter Zuckerfabrik (EU interim-measures) test should apply.
• The Decision raises EU fundamental-rights interests (protection of personal data for millions of EEA users) which weigh heavily against a stay. The DPC contended suspension of transfers was required by GDPR jurisprudence (e.g., Schrems II) where standard contractual clauses cannot ensure an equivalent level of protection.
• Company C disputed the adequacy of Company A's evidence on likely harm: most of the alleged injuries are pecuniary, do not threaten the group's viability, and in principle are compensable by damages. Company C relied on expert evidence disputing Company A's technical assertions and parts of the legal analysis (Chinese-law territoriality).
• Company C objected to certain affidavit evidence (from foreign experts and the chair of Company D (EDPB)) as being inadmissible or of limited evidential weight in a stay application because it either sought to re-open the merits or comprised legal submissions rather than admissible factual evidence.

Table of Precedents Cited

Court's Reasoning and Analysis

The court (Judge Mulcahy) proceeded through a structured analysis addressing: (A) the applicable legal test for a stay on a supervisory-authority decision under the GDPR; (B) the admissibility and weight of affidavit and expert evidence; and (C) the application of the chosen test to the facts, concluding with the appropriate relief and conditions.

A. Applicable legal test

• The central question was whether national procedural autonomy (Okunade test) or the Zuckerfabrik (CJEU) interim-measures standard applies to an application for a stay of a supervisory authority's decision made after the Article 60 co-decision/consistency process.
• The court examined the GDPR's text and recitals (notably Recitals 101, 124–126, 143), Article 60 procedure, Article 66 (urgency procedure), and Article 78 (judicial remedies) to determine whether the GDPR harmonises the standard for interim relief. The court emphasised that Recital 143 expressly provides that proceedings against a supervisory authority should be conducted in accordance with the Member State's procedural law.
• Although Company C argued that the binding effect of decisions resulting from the Article 60 process and the consistency mechanism justified application of the Zuckerfabrik criteria (to secure uniformity across Member States), the court found that the GDPR does not harmonise procedural rules for interim relief and that national procedural autonomy remains the default. The court reasoned that the Article 60/consistency process ensures coordinated decision-making but does not convert a national supervisory authority decision into an EU act or displace national courts' procedural autonomy.
• The court acknowledged, however, that Zuckerfabrik-style criteria would be applicable where the validity of an EDPB decision (an EU body established by the GDPR) was in issue and required referral to the Court of Justice; in such cases, harmonised criteria are appropriate because the CJEU has exclusive competence on validity. That distinction is reflected in Recital 143 and in the jurisprudence.
• Accordingly, the court concluded that Okunade is the appropriate test to apply to this stay application (while noting it would, for completeness, also consider Zuckerfabrik criteria in the balancing exercise).

B. Admissibility and weight of evidence

• The court addressed objections to various affidavits. It held that evidence which effectively sought to re-open the merits of the Decision where there were disputed issues of fact and complex issues of law was not appropriate for decisive reliance in an interlocutory application.
• Nevertheless, the court accepted that (i) Company A could adduce evidence about matters outside the Decision or about the real-world level of risk (e.g., evidence about Project Clover and the operational risk profile) and (ii) Company C could adduce evidence addressing level of risk and related factual points. Affidavits that only contained legal argument (for example, an affidavit by the chairperson of Company D that largely advanced legal submissions) had limited evidential weight.
• Specific expert affidavits (on Chinese law, technical security, and financial impact) were considered: the court admitted the Chinese-law affidavits by Attorney Zang (Company C's expert) and permitted replies by Company A's Chinese-law experts; it excluded certain evidence (e.g., Dr Hunton's affidavit) when it advanced reasons not relied upon by Company C in making the Decision (the DPC could not defend the Decision on entirely different grounds at the interlocutory stage).
• On evidential approach generally, the court followed established interlocutory practice: it would assess affidavits on their face and without routine cross-examination, doing the best possible evaluation at the interlocutory stage.

C. Application of Okunade criteria (and cross-reference to Zuckerfabrik)

• Serious issue to be tried: Company C conceded for present purposes that Company A had identified "serious doubts" or a serious issue to be tried. The court accepted that threshold was met.
• Adequacy of damages / urgency: Company A produced detailed financial and operational evidence (expert reports and witness affidavits) demonstrating substantial, quantifiable and unquantifiable losses that would flow from implementing the Suspension Solution, including business disruption, lost profits over a multi-year suspension period and loss of institutional knowledge. The court found that (a) the evidence was robust and supported a probability of very significant losses and (b) many of the harms would be difficult or impossible to quantify and recover even using Francovich claims (given practical barriers and possible statutory immunities). On that basis the court concluded that damages would not be an adequate remedy and that the urgency/irreparable-harm limb was satisfied.
• Least risk of injustice / public and EU interests: The court placed high weight on the public interest in protecting fundamental rights (data-protection rights of EEA users). However, it identified important countervailing factors: (a) the Decision's finding was largely negative (Company A failed to demonstrate equivalence during the Inquiry period ending May 2023) rather than an express factual finding that an equivalent level of protection does not exist now; (b) Company A had implemented additional measures after the Inquiry period (Project Clover) that the DPC had considered but still found insufficient in the Decision; (c) the Decision afforded a six-month implementation period before the orders would take effect (indicating that Company C did not treat the situation as instantly exigent); and (d) the stay requested would be time-limited and subject to conditions designed to minimise risk to data subjects.
• Balancing: On the particular facts the court concluded that a short conditional stay would better secure the least risk of injustice — avoiding irreparable harm to Company A if it ultimately prevailed — while imposing conditions that limited risk to data subjects and preserved the effective vindication of GDPR rights (including requiring timely prosecution of the appeal and prompt notification to users about the Decision and the stay).
• Even applying the Zuckerfabrik criteria (more demanding), the court reasoned that the same result would follow: Company A had demonstrated serious and irreparable harm; the relevant EU interests (protection of data subjects) weighed heavily but did not outweigh the particular risk of irreversible corporate harm, given the limited scope/timing and the proposed protective conditions.

Holding and Implications

Holding: The court granted a stay of the Suspension Order and the Corrective Order pending determination of the appeal, subject to conditions.

Key terms and conditions imposed:

• Company A undertook to prosecute the appeal with all reasonable diligence and to use its best efforts to secure a hearing of the appeal not later than March 2026 (the court proposed ensuring the appeal is heard by that time).
• Company A was required to notify, insofar as it had not already done so, all its EEA users of Company C's Decision in clear and easily understood language; such notification could also state that Company A has appealed and that a stay has been granted.
• Both parties were given liberty to apply in relation to the continuation or variation of the stay; the court listed a further procedural call to address consequential orders.

Implications:

• Direct effect: Company A and Company B are not required to implement the Suspension Order or the Corrective Order while the stay remains in force and subject to compliance with the conditions (most notably timely prosecution and user notification). The automatic statutory stay on the administrative fines (by operation of appeal rules) remains unaffected.
• Precedential implications: The court emphasised that national procedural autonomy governs interim relief applications against supervisory-authority decisions under the GDPR unless the case engages the validity of an EU-level act (e.g., an EDPB decision requiring CJEU resolution), in which case EU interim-measures criteria may apply. The judgment clarifies that the consistency/Article 60 process, even when producing a decision binding on other supervisory authorities, does not displace national procedural autonomy for interim relief requests in the forum of the lead authority's national courts.
• Limitations: The court did not decide any substantive issue of GDPR interpretation or the merits of Company A's appeal; it made no finding on whether Company A's technical or legal arguments on Chinese law would succeed. The stay is conditional and time-limited and may be varied if circumstances change or if the parties seek further orders.

Miscellaneous Observations

- The court made a targeted confidentiality order under the national Act to protect commercially sensitive material in the stay hearing (limited protection, less than an in camera hearing), consistent with statutory protections when Company C publishes decisions.
- The court took a pragmatic evidential approach at interlocutory stage: admissible factual and expert evidence that does not improperly invite the court to substitute its view for the Decision's findings was admissible and could be considered in the balancing exercise; purely legal argument in affidavit form was given limited weight.
- The judgment underlines the centrality of proportionality and the balancing of rights and interests where fundamental rights (data protection of millions of users) are engaged alongside serious irreversible commercial risks.

Disposition

STAY GRANTED PENDING APPEAL, subject to the conditions set out above (undertaking to prosecute appeal diligently, target hearing before March 2026, user notification, liberty to apply for variation).

Proceedings were listed for a further procedural hearing on 14 November 2025 to address consequential orders. Both parties retain liberty to apply.

Note on anonymization: All personal and corporate names in this summary have been replaced with consistent placeholders: "Company A" (primary applicant), "Company B" (joined applicant), "Company C" (national supervisory authority respondent), "Company D" (European Data Protection Board / EU body), "Company E" (ultimate parent of Company A), and personal names replaced by "Judge [Last Name]" or "Attorney [Last Name]" as appropriate, in accordance with instructions governing anonymization. No factual content has been invented or inferred beyond what is contained in the provided opinion.