- Bookmark
- Share
- CaseIQ
Meta Platforms Ireland Ltd v Data Protection Commission (Approved)
Factual and Procedural Background
This judgment, delivered by Judge Phelan on 21 May 2026, concerns Company A (Applicant) challenging a draft Preliminary Draft Decision (PDD) issued by Company B (Respondent) on 10 October 2025 in Inquiry IN-18-7-1. The Inquiry began in July 2018 following a single-user complaint by the Complainant asserting infringements of Articles 12, 15 and 20 GDPR arising from Company A's practices in relation to its internal "Hive" data warehouse. The Complainant sought raw access and portability to personal data; Company A refused and the Complainant lodged the complaint with Company B, which opened a statutory inquiry by Notice of Commencement dated 27 July 2018.
Company B conducted an investigative phase (requests for information, Draft Inquiry Report issued January 2022, Final Inquiry Report August 2023) which identified provisional infringements limited to the Complainant's request (Article 15(1)(a), (d), (g); Article 20(1); Articles 12(3) and 12(4)). The decision-making stage followed; Company B issued a draft PDD in October 2025 proposing findings of infringement and provisional corrective measures directed at Company A's general data access practices and proposing an administrative fine (estimated €360–€430 million calculated by reference to EEA user numbers). Company A contended the draft PDD unlawfully expanded the complaint-based Inquiry into systemic matters and commenced judicial review in December 2025. Leave to proceed was granted and an interim stay entered. Proceedings were heard and judgment issued dismissing the challenge.
Legal Issues Presented
- Whether Company B lawfully may, in a complaint-based GDPR inquiry, propose systemic corrective measures and administrative fines based on infringements identified through a single complainant's request, or whether doing so exceeds Company B's vires by effectively converting the inquiry into an own-volition inquiry.
- Whether Company A was denied fair procedures (including adequate notice and opportunity to defend) by the alleged late expansion of the Inquiry's scope to systemic matters.
- Whether Company A acquired a legitimate expectation—by virtue of notices, draft/final inquiry reports, guidance or prior practice—that corrective measures would be confined to remedies for the individual complainant and not extended to systemic measures.
Arguments of the Parties
Applicant's Arguments
- The Inquiry was complaint-based and limited to the Complainant's Article 15 and 20 request; Company B unlawfully expanded scope after the investigative phase into systemic, EEA‑wide assessment (an "own‑volition inquiry") and so acted ultra vires.
- The alleged expansion breached fair procedures and Company A's legitimate expectations arising from the Notice of Commencement, Draft Inquiry Report, Final Inquiry Report, Company B publications and prior practice.
- The draft PDD proposed corrective orders of general application and a substantial fine calculated by reference to the undertaking's turnover and EEA user base, which Company A says was not within scope of a complaint‑based inquiry.
Respondent's Arguments
- The proceedings are premature in form but Company B expressly waived prematurity insofar as the vires issue was to be decided; Company B contends no conversion occurred.
- Company B has the power—and in the event of a finding of infringement is obliged—to consider systemic effects and to impose effective, proportionate and dissuasive corrective measures and fines under Articles 58 and 83 GDPR, even where an inquiry began with a single complaint.
- Company A had notice throughout of Company B's statutory powers (Articles 58/83 GDPR and relevant provisions of the 2018 Act); fair procedures were observed and opportunities to make submissions remain (Article 60 cooperation, appeal routes, confirmation of fines by court).
Table of Precedents Cited
| Precedent | Rule or Principle Cited For | Application by the Court |
|---|---|---|
| Facebook Ireland Ltd v. Data Protection Commission [2021] IEHC 336 | That a preliminary draft decision is amenable to judicial review; courts may intervene mid‑process in exceptional circumstances. | Referred to for the proposition that judicial review can be entertained before final decision where process may be irremediably wrong; used to justify hearing vires issue mid‑process. |
| Rowland v. An Post [2017] 1 IR 355 | Judicial review mid‑process permissible where process has "gone irremediably wrong". | Applied as part of prematurity analysis to consider whether intervention was appropriate. |
| SCHUFA Holding (Case C-26/22 and C-64/22) | Emphasises supervisory authorities' responsibility to monitor GDPR compliance and to adopt appropriate, necessary and proportionate measures under Article 58. | Used to support conclusion that supervisory authorities have broad corrective powers and duties to ensure compliance, relevant to whether corrective measures can be systemic. |
| TR v. Land Hessen (Case C-768/21) | Confirms that Article 58 confers extensive investigative and corrective powers on supervisory authorities and that measures must be appropriate, necessary and proportionate. | Relied on to demonstrate that Article 58(2) corrective powers include systemic measures and are not confined to individual remedies. |
| Meta Platforms Ireland Ltd v. Data Protection Commission [2024] IEHC 75 | Discusses joinder and concurrent inquiries; acknowledges that complaint‑based and own‑volition inquiries can run in tandem. | Cited to show prior practice where dual procedures were used; court held such dual processes possible without implying a required separation of powers for corrective measures. |
| Facebook Ireland Limited v. The Data Protection Commissioner & Ors. (decision cited) | Confirms the Commission's wide discretion under s.110 to "cause such inquiry as it thinks fit" and to regulate its own procedures, subject to fair procedures. | Adopted to support view that Commission has broad investigatory discretion and may gather information in various ways, but must observe fair procedures. |
| NVSC (Case C-683/21) — Opinion of Advocate General Emiliou | Interprets Article 83 as a two‑tier sanction system and sets out approach to deciding whether to impose fines and their amount per Article 83(2). | Used to support proposition that Article 83 requires case‑by‑case consideration of factors (including number of data subjects affected) and that fines are not limited to individual remedies. |
| ZF v. European Commission (Case T-605/18) | Referenced regarding administrative practice and review (contextual reference). | Referenced but not elaborated upon; relied on ancillary points about administrative review in EU context. |
| Myland Ireland Ltd v. European Commission (Case T-1181/23) | Referenced regarding administrative practice (contextual reference). | Referenced in submissions; not central to the Court's dispositive reasoning in this judgment. |
| Grande Stevens v. Italy (ECtHR, Application No. 18640/10) | Addresses degree of procedural protection required where penalties are severe; penal/procedural fairness principles. | Referred to when considering the applicable level of fair procedures required given potential severity of administrative sanctions. |
| Glencar Exploration plc v. Mayo County Council (No. 2) [2002] 1 IR 84 | Principles on legitimate expectation and the need for clear, unambiguous assurances by public authorities. | Applied to assess whether Company A had a legitimate expectation based on Company B's publications or conduct; held not to have been established. |
| Murphy v. Revenue Commissioners & DPP [2023] IECA 110 | Objective interpretation of formal correspondence for legitimate expectation claims. | Used to assess correspondence between the parties objectively; Court found correspondence aligned with statutory framework and did not give the assurance alleged. |
| Ryan v. Data Protection Commission [2024] IECA 152 | Addressed related procedural and jurisdictional aspects involving the Commission. | Referenced in submissions on practice and legitimate expectation; did not alter the Court's core statutory interpretation. |
| Cromane Seafoods Ltd v. Minister for Agriculture [2017] 1 I.R. 119 | Administrative law principles on change of practice and expectations. | Referred to in assessing whether past practices could ground a legitimate expectation; Court emphasised statutory powers and fair procedures rather than immutable practice. |
Court's Reasoning and Analysis
The Court analysed four interconnected issues: prematurity, statutory vires, fair procedures and legitimate expectation. On prematurity, although Company B had initially pleaded prematurity, it did not press prematurity in relation to the vires issue and the Court concluded it was appropriate to decide the vires question at this stage because Company B had taken a clear, settled position in correspondence that would likely carry through to final decision and because cross‑border cooperation (Article 60/65) could make remedial correction later more difficult.
On statutory vires, the Court undertook a textual and purposive analysis of the GDPR and the Data Protection Act 2018. It noted Articles 57, 58 and 83 GDPR and ss.109–115, 141–143 of the 2018 Act. The Court found that the statutory language confers broad investigatory powers and identical corrective powers irrespective of whether an inquiry is complaint‑based or own‑volition; s.110(1) and s.115, and Article 58(2) do not distinguish or confine corrective powers by inquiry origin. Article 83 explicitly requires consideration of factors such as number of data subjects affected when imposing fines. The Court concluded that a complaint‑based inquiry may lawfully lead to systemic corrective measures and fines where the facts show systemic implications; there is no legal requirement that systemic measures be confined to own‑volition inquiries.
On fair procedures, the Court held Company A had adequate notice throughout: the Notice of Commencement, the Draft and Final Inquiry Reports, subsequent correspondence and the statutory framework expressly warned that, if infringement were found, corrective powers (including fines) would be considered. Company A had multiple opportunities to make submissions (investigative phase, PDD consultation, Article 60 process, and judicial appeal routes). The Court found no procedural unfairness warranting intervention.
On legitimate expectation, the Court applied the cumulative tests from EU and domestic law (precise, unconditional assurances by authorised source; reasonable expectation; compatibility with law). The Court found no clear, unambiguous assurance that Company B would confine remedies to the individual complainant; published guidance and prior practice did not create a binding representation to that effect. Even if a practice existed, the statutory powers could not be fettered in the asserted manner. The legitimate expectation claim therefore failed.
Holding and Implications
DISMISSED
Holding: The judicial review proceedings were dismissed. The Court held that Company B lawfully may, in a complaint‑based inquiry, consider and propose systemic corrective measures and administrative fines where the investigation establishes infringements with systemic implications. The procedures followed afforded Company A fair process and no legitimate expectation limited Company B's corrective powers.
Implications: The direct effect is that the draft PDD need not be withdrawn on the grounds advanced and Company B may proceed with the Article 60 process and decision‑making consistent with the GDPR and the 2018 Act. The Court emphasised that supervisory authorities' powers to impose corrective measures (including fines assessed by Article 83 criteria) apply irrespective of whether an inquiry began with an individual complaint or by own‑volition; no new precedent narrowing those powers was established by the judgment. The Court ordered dismissal and invited parties to address consequential orders if required.
Alert