TikTok Technology Ltd and Anor v Data Protection Commissioner [Administrative Fines] (Approved)

Factual and Procedural Background

Judge Mulcahy delivered a further judgment on 30 June 2026 in proceedings brought by Company A and Company B (the Applicants) against the Regulatory Authority (the Respondent) under the Data Protection Act 2018, concerning the imposition of administrative fines under the GDPR. An earlier "main judgment" ([2026] IEHC 347) resolved most grounds of appeal but left issues concerning the calculation and reasoning for administrative fines for further determination. The Regulatory Authority had issued a Preliminary Draft Decision (PDD), a Draft Decision and a final Decision concluding that Company A had infringed Article 46(1) and Article 13(1)(f) GDPR, characterising the breaches as negligent, and proposing/setting administrative fines (PDD/Draft Decision ranges and final fines: Article 46(1) proposed ~€440–€500m, final €485m; Article 13(1)(f) proposed ~€30–€50m, final €45m). Company A/B appealed Grounds 7–9 challenging (inter alia) the Regulatory Authority's regard to the turnover of Company C (the parent), adequacy of reasons, and interpretation/application of Article 83. The court considered subsequent CJEU and EDPB authorities and the parties' submissions and proposed certain questions for reference to the CJEU.

Legal Issues Presented

1. Whether the Regulatory Authority was entitled to have regard to the turnover of the controller's parent (Company C) for the purposes of (a) determining the statutory fining cap under Article 83(4)–(6) GDPR and (b) calculating the amount of the administrative fine (Ground 7).
2. Whether, before having regard to a parent's turnover, the Regulatory Authority was required to impute the controller's conduct to the parent, impute liability to the parent, or notify and afford the parent rights of defence (Ground 7 / referral question).
3. What is the correct "preceding financial year" for the Article 83(4)–(6) turnover calculation (Ground 7).
4. Whether Article 83(3) precludes aggregation/cumulation of fines for the same or linked processing operations, or permits aggregation subject to the overall maximum (Ground 9).
5. Whether the Regulatory Authority gave adequate reasons for the fining decision and adequately applied the Article 83(1) and (2) criteria when fixing the fines (Grounds 8 and 9).

Arguments of the Parties

Applicants' Arguments (Company A / Company B)

• The Regulatory Authority could not rely on the parent's (Company C's) turnover unless it first imputed liability to that parent and afforded it rights of defence; reliance on a rebuttable presumption of decisive influence required putting the parent on notice.
• The parent's turnover is relevant only to the fining cap, not to the calculation of the actual fine; the proper process is a two-step calculation (Article 83(2) factors first; then, if necessary, adjust by reference to undertaking turnover).
• The Regulatory Authority erred in selecting the "preceding financial year" (it should have used an earlier year or otherwise accounted for delay) and in treating certain Article 83(2) factors as aggravating rather than mitigating.
• Article 83(3) prohibits aggregation of fines for the same or linked processing operations; only the gravest infringement may be fined.
• The Decision failed to give adequate reasons (no basic figure and no transparent explanation of adjustments; inadequate explanation of how Company C's turnover was applied).

Respondent's Arguments (The Regulatory Authority)

• The concept of "undertaking" and the mechanism for calculating caps is informed by competition law cases; the Regulatory Authority was entitled to have regard to Company C's turnover without imputing liability or making the parent a party, and invitation to the controller to bring the matter to the parent sufficed.
• Turnover of the undertaking is relevant to both the fining cap and the quantum of the fine (holistic approach), consistent with CJEU and EDPB authorities and the GDPR Fining Guidelines.
• The "preceding financial year" is the year preceding the final decision (the year before imposition) and the Regulatory Authority was entitled to use Company C's 2024 turnover; no culpable delay was shown.
• Article 83(3) permits aggregation of fines subject to the overall maximum; EDPB's WhatsApp Decision supports aggregating multiple infringements arising from the same or linked processing operations.
• The Decision contained adequate reasons for an appeal on the record; no mechanical "basic figure and arithmetic adjustments" were required.

Table of Precedents Cited

Court's Reasoning and Analysis

The court proceeded by reference to the GDPR (Articles 58 and 83 and Recital 150), the PDD/Draft Decision/Decision materials, and relevant CJEU and EDPB authorities. Key steps in the analysis were:

1. The court reaffirmed earlier conclusions from the main judgment that the Regulatory Authority was entitled to find infringements of Article 46 and Article 13(1)(f) and that those infringements were negligent.
2. On the treatment of undertaking turnover, the court accepted the CJEU authorities (notably Deutsche Wohnen and ILVA) establish that the concept of "undertaking" for Article 83(4)–(6) is to be understood in competition-law terms and that turnover is the proper basis for calculating maximum fines and assessing the economic capacity relevant to Article 83(1). The court concluded that the Regulatory Authority was entitled to have regard to Company C's turnover.
3. On whether the Regulatory Authority had to impute liability or afford Company C procedural rights before having regard to its turnover, the court concluded that attribution of liability and use of consolidated turnover are distinct; the GDPR does not require that using turnover as a basis for caps/assessment entails imputing liability or imposing the fine on the parent. Nonetheless the point was not acte clair and, because of uncertainty and overlap with pending matters (including the WhatsApp proceedings), the court referred focused questions to the CJEU concerning whether the supervisory authority must impute conduct or notify the parent before relying on its turnover.
4. On the "preceding financial year", the court held that a purposive and literal reading supports using the year preceding the decision (the year before imposition) and that the Regulatory Authority's reliance on 2024 turnover was permissible; flexibility exists where the preceding year is unrepresentative, but no such issue was shown here.
5. On whether the turnover of the undertaking may be used in calculating the quantum (actual amount) of the fine rather than only the cap, the court observed competing authorities (Advocate General in ILVA v EDPB) and EDPB guidance; the CJEU's case-law suggested the provisions operate together so turnover may be relevant to quantum. The court considered this not acte clair and referred a question to the CJEU on whether turnover is relevant from the outset or only as an adjustment after Article 83(2) assessment.
6. On aggregation under Article 83(3), the court acknowledged conflicting views (Advocate General in NVSC v EDPB vs EDPB WhatsApp Decision) and concluded the issue was not acte clair; it referred a further question to the CJEU on whether aggregation is permitted subject to the overall maximum.
7. On the adequacy of reasons and application of Article 83(2) criteria, the court found the Regulatory Authority had lawfully considered the listed criteria, that most characterisations (aggravating/mitigating) were open on the evidence, and that only two modest errors were identifiable (failure to treat absence of prior infringements as mitigating; inappropriate weight to compliance burden from corrective orders). Those errors operated to the Applicants' benefit and did not warrant revisiting the fines.
8. Overall, the court declined to interfere with the Decision in relation to the fining amounts on the record, but identified discrete legal issues requiring preliminary rulings from the CJEU and proposed four referral questions. The court directed parties to prepare a draft Order for Reference and listed a further mention date.

Holding and Implications

CORE RULING: The court upheld the Regulatory Authority's approach in the Decision in substance and declined, on the material before it, to interfere with the administrative fines imposed; however, it referred specified legal questions to the CJEU for preliminary ruling.

Implications:

• The Regulatory Authority's fines (as fixed in the Decision) remain not set aside by this judgment; the court identified limited errors in the Article 83(2) assessment but concluded they did not justify modifying the fines in an appeal on the record.
• The court concluded the Regulatory Authority was entitled to treat Company C as the relevant undertaking for Article 83 purposes (presumption of decisive influence on the facts), and to use the 2024 (preceding) turnover figure; the question whether a supervisory authority must first impute liability or notify/afford rights to a parent before relying on its turnover is unsettled and is referred to the CJEU.
• The court proposed and will refer four focused questions to the CJEU (relating to imputation/notice/rights of defence, use and timing of undertaking turnover in calculating fines, and aggregation under Article 83(3)). Parties are to prepare a draft Order for Reference; the matter was listed for further mention on 10 July 2026.
• No new domestic precedent altering the fines was established by this judgment; it preserves the Regulatory Authority's Decision subject to the outcome of the CJEU references.