Summary of Judgment — [2026] IEHC 347

Court: The High Court (Commercial) — judgment delivered by Judge Mulcahy on 3 June 2026.

Factual and Procedural Background

This appeal concerns an inquiry commenced by the national supervisory authority (the Respondent, hereinafter "Company C") under domestic legislation implementing the GDPR into national law. Company A (the principal appellant) and Company B (joined because of potential financial responsibility) challenge Company C's Decision dated 30 April 2025. Company C found that Company A had infringed Article 46(1) GDPR in relation to transfers of personal data to personnel located in a third country (China) during a defined temporal scope (29 July 2020 to 17 May 2023), and had infringed Article 13(1)(f) GDPR in respect of an earlier privacy policy (29 July 2020 to 1 December 2022). Company C imposed corrective orders (including suspension of the transfers) and administrative fines totaling €530 million. Company A appealed under the relevant provisions of the national Data Protection Act. The judge granted a stay of the corrective orders pending appeal; the Supreme Court continued that stay pending determination of the High Court appeal. The proceedings were heard in March 2026 and this judgment addresses liability and certain procedural and substantive grounds; a further judgment on fine calculation is reserved.

Legal Issues Presented

1. Whether Article 46 GDPR requires a controller to be able to verify and demonstrate that transfers to a third country afford a level of protection essentially equivalent to EU standards, and the legal consequences if it cannot;
2. Whether Company C misapplied EU case-law (notably the CJEU's pronouncements in the Schrems line of cases) in its approach to Article 46 and to the power/duty to suspend transfers;
3. Whether procedural fairness (rights of the defence / fair procedures) was observed throughout the Inquiry, including (a) whether Company A was put on notice of the adverse legal basis relied upon, (b) whether Company C properly considered information supplied by Company A (including subsequent technical and legal materials), and (c) whether Company A was denied adequate access to the Inquiry file;
4. Whether Company C erred in assessing Company A's evidence regarding relevant third-country law (Chinese law) and the adequacy of supplementary technical, contractual and organisational measures (Project Clover);
5. Whether Company A's October 2021 privacy policy contravened Article 13(1)(f) GDPR; and
6. Whether Company C lawfully imposed administrative fines (including whether negligence or intent was established, and questions regarding the fining base).

Arguments of the Parties

Appellant's Arguments (Company A / Company B)

• The DPC (Company C) misinterpreted Article 46 GDPR and required Company A to demonstrate rather than merely verify adequacy; Company C therefore acted beyond its remit.
• The DPC impermissibly reversed the burden of proof; given the punitive character of fines, criminal-standards protections apply.
• Company A complied with Article 46 by preparing detailed Data Transfer Assessments (DTAs) and employing supplementary measures (Project Clover / remote-access approach); Company C ignored or mischaracterised that evidence.
• Company C breached fair procedures by introducing new adverse findings (the emphasis on data processed in-country), by fixing a temporal scope that excluded post-cutoff implementation measures, by refusing an in-person technical engagement, and by withholding parts of its internal file.
• The October 2021 privacy policy complied with Article 13(1)(f) and Company C misapplied transparency obligations.
• The imposition of administrative fines required a finding of negligence or intent which Company C did not establish; Company C also erred in basing fines on the ultimate parent group's turnover.

Respondent's Arguments (Company C)

• Article 46 and the GDPR accountability obligations (Articles 5(2), 24) require controllers to be able to demonstrate that transfers are adequately protected; Company C was entitled to assess the adequacy of Company A's DTAs and to find them deficient.
• Schrems II and the related CJEU/Advocate-General analyses support supervisory authorities' duties to suspend or end transfers where adequate protection cannot be shown; Company C properly exercised its powers and considered proportionality.
• No impermissible reversal of burden occurred; Company C bore the legal/evidential burden of establishing insufficiency of Company A's assessments, which it did.
• Company A was given adequate procedural opportunities; late submissions (notably a Chinese-law opinion provided shortly before circulation of the draft decision) did not justify withdrawal or significant re-opening of the Article 60 process, though Company C considered post-cutoff factual updates when assessing corrective measures.
• Company C properly concluded that Company A's 2021 privacy policy lacked requisite transparency about the countries and nature of transfers.
• Company C lawfully concluded the infringements were negligent (a low threshold) and thus lawfully imposed fines; questions on calculation remain for separate determination.

Table of Precedents Cited

Court's Reasoning and Analysis

The court conducted a structured analysis dealing first with overarching legal questions (standard of review, nature of inquiry and remedies) and then with each pleaded ground. Key legal findings and steps in the court's reasoning (limited to material in the opinion):

• Scope of appeal and standard of review: The Court followed the recent national authority (LinkedIn v DPC) that statutory appeals under the Act are appeals on the record with capacity to admit new evidence; some deference is appropriate on matters within the supervisory authority's technical expertise; remittal is available in appropriate cases.
• Interpretation of Article 46/GDPR duties (Ground 3): The Court held that controllers must verify, and be able to demonstrate, that transfers to third countries afford protection essentially equivalent to EU law; Articles 5(2) and 24(1) (accountability/demonstration) are relevant to Article 46; Schrems II supports these propositions but does not require that a supervisory authority always carry out an independent adequacy assessment before finding an infringement — it may review and test the controller's assessment. The Court rejected the appellant's argument that the supervisory authority was obliged to perform the full assessment itself prior to any finding.
• Burden of proof and criminal-procedure protections: Given the severity of GDPR fines, the Court accepted that Charter/ECHR protections are engaged; nevertheless the Court found no impermissible reversal of the burden of proof — Company C retained the legal and evidential burden to show that Company A's verification was inadequate.
• Fair procedures (Ground 1): The Court accepted that Company A had adequate procedural opportunities overall. It rejected most fair-procedure complaints (including change in temporal scope and alleged introduction of new issues) because the central issue — adequacy of protection for data processed in-country — was squarely within the Inquiry's scope and had been sufficiently signalled. However, the Court found Company C erred by not adequately engaging with one late-supplied Chinese-law opinion (the "third Xu opinion") and by failing to give sufficient reasons for rejecting certain aspects of Company A's technical/pseudonymisation evidence (Project Clover), given Company C had accepted it would consider post-cutoff material in assessing corrective measures.
• Assessment of Chinese-law evidence and DTAs (Grounds 2 & 10): The Court examined the DTAs and expert opinions supplied by Company A. It concluded Company C was entitled to find the earlier DTAs insufficient up to the temporal cut-off (17 May 2023). The third Chinese-law opinion, provided late, on its face addressed the local-processing issue but the Court found its reasoning not sufficiently persuasive to compel acceptance without further interrogation. On Project Clover (technical) material, the Court considered the supervisory authority had reviewed the material but failed to explain adequately why pseudonymisation/differential-privacy measures were rejected for the purposes of determining whether a suspension order remained necessary.
• Article 13(1)(f) transparency finding (Ground 5): The Court agreed with Company C that the October 2021 privacy policy failed to identify the third countries to which data was transferred and to provide a basic factual description of the nature of transfers (remote access to data by personnel in a third country). The Court held such disclosure is required to ensure fairness and transparency and to allow data subjects and supervisory authorities to assess protection.
• Negligence and fines (Ground 6): The Court applied the relevant CJEU and Advocate-General authority establishing that administrative fines under Article 83 require a finding of negligence or intent. The Court concluded (on the low negligence threshold set by the jurisprudence) that Company A was negligent: it had failed to address an obvious and central verification requirement (the protection of data processed in-country) prior to transfers and offered no satisfactory explanation. Accordingly Company C was entitled to impose fines; detailed issues of fine quantum were reserved.
• Remedies and corrective orders: Although Company C lawfully exercised its power to order suspension and other corrective measures, the Court found procedural/assessment failures (non-consideration of the late Chinese-law opinion and inadequate reasoning regarding Project Clover) made it impossible for the Court to defer fully to Company C's technical conclusions on corrective measures. The Court therefore proposed vacating the corrective orders and remitting the issue of what corrective measures should be imposed (if any) to Company C for reconsideration, with directions to address the identified evidential points and to give reasoned explanations.

Holding and Implications

Holding: The court dismissed the appellants' challenges to the findings of infringement of Article 46(1) and Article 13(1)(f) GDPR and dismissed the appeal against the imposition of administrative fines (liability and negligence sustained). However, the court found procedural and assessment deficiencies in Company C's handling of late legal evidence and in its explanation for rejecting Company A's technical/pseudonymisation measures; accordingly the court proposed to vacate the corrective orders (suspension and related processing order) and remit the question of appropriate corrective measures to Company C for further reasoned reconsideration.

Implications:

• Direct effect: The infringement findings and the liability to fines were upheld; questions of fine quantum remain to be determined in a further judgment.
• Remittal: Company C must re-consider corrective measures in light of (i) the late Chinese-law opinion and (ii) the technical evidence about pseudonymisation/differential privacy, and must explain its reasoning transparently before re-imposing, varying or withdrawing corrective orders.
• Precedential / wider impact: The judgment clarifies that controllers must verify and be able to demonstrate adequacy for transfers (Article 46 read with Articles 5(2) and 24), supervisory authorities may test controllers' assessments, and courts should afford deference on technical matters but may remit where a supervisory authority fails to explain rejection of technical evidence. No new EU legal rule was established beyond application of existing CJEU jurisprudence (Schrems II) and national case law on the scope of appeals and remittal.

Next steps (procedural): The court proposed to vacate the corrective orders and remit the corrective-order issue to Company C for further consideration; parties were listed for a short further hearing to make final orders and were encouraged to agree the form of orders in advance.