APPROVED [2025] IEHC 619
THE HIGH COURT
COMMERCIAL
Record No.: 2025/248 MCA
IN THE MATTER OF SECTION 142 AND SECTION 150
OF THE DATA PROTECTION ACT 2018
Between:
TIKTOK TECHNOLOGY LIMITED and TIKTOK INFORMATION
TECHNOLOGIES UK LIMITED
Applicants
And
DATA PROTECTION COMMISSION
Respondent
JUDGMENT of Mr Justice Rory Mulcahy delivered on 13 November 2025
Introduction
1. On 14 September 2021, the respondent (“the DPC”) commenced an inquiry (“the
Inquiry”) into the first applicant (“TikTok”) in accordance with section 110 of the Data
Protection Act 2018 (“the Act”) regarding the transfer by TikTok of its users’ personal data
to China. The DPC is the State’s supervisory authority for the purpose of the General Data
Protection Regulation, Regulation 2016/679 (“the GDPR”).
2. Following a detailed investigation, and having consulted with other supervisory
authorities in accordance with Article 60 of the GDPR, the DPC issued its decision on 30
April 2025 (“the Decision”). The Decision defined the temporal scope of the Inquiry as
relating to data transfers taking place from 29 July 2020 until 17 May 2023. In the Decision,
NO REDACTION REQUIRED
the DPC found that TikTok had infringed Article 46(1) the GDPR by failing to ensure that
personal data of its users within the European Economic Area (“EEA Users”) which was
transferred outside the EEA, in this case by being made available by remote access to
personnel based in China (“the data transfers”), was afforded a level of protection
essentially equivalent to that provided within the European Union (“EU”) during the
Inquiry’s temporal scope. The Decision also found a breach of Article 13(1)(f) of the GDPR,
that TikTok had failed to provide required information on the data transfers to data subjects
from 29 July 2020 to 1 December 2022.
3. As part of the Decision, the respondent imposed administrative fines totalling €530
million. The second applicant (“TikTok UK”) has been joined to these proceedings on the
basis that it is the entity which will ultimately be responsible for paying any such
administrative fines. The DPC disputes its standing as a party in these proceedings, but that
issue does not require to be resolved at this time.
4. In addition to the administrative fines, the DPC made an order pursuant to Article
58(2)(j) of the GDPR requiring TikTok to suspend the data transfers (“the Suspension
Order”) and an order pursuant to Article 58(2)(d) requiring TikTok to bring its processing
into compliance with the GDPR (“the Corrective Order”). These orders were to take effect
six months after the date of the Decision.
5. By originating notice of motion issued on 27 May 2025, TikTok appealed the Decision
pursuant to sections 142 and 150 of the Act. TikTok pleads errors of law and fact on the part
of the DPC. It contends that the data transfers, by virtue of its standard contractual clauses
(SCCs) and, inter alia, additional measures put in place by TikTok pursuant to what it calls
“Project Clover”, are afforded an equivalent level of protection to that provided within the
EU. In addition, TikTok contends that the Decision was reached in breach of fair procedures.
TikTok also claims that the DPC has erred in its interpretation of relevant Chinese laws.
6. By operation of section 142 of the Act, the appeal operates as a stay on the requirement
to pay the administrative fines. However, there is no automatic stay on the Suspension Order
2
or Corrective Order (for convenience, any further reference to the Suspension Order can be
read as referring to both orders). This judgment concerns TikTok’s application to stay those
orders. In short, TikTok claims that the steps it will be necessary to take in order to comply
with the Suspension Order will require it to incur billions of euros expenditure, will be
disruptive of its business and of its workforce, and will diminish its stakeholders’
experience. It contends that most of this loss cannot be made good if it ultimately succeeds
in its appeal. In order to provide it with an effective remedy, TikTok argues, the Suspension
Order must be stayed pending the determination of its appeal.
7. The DPC opposes the stay. It contends that the fundamental rights of TikTok’s 159
million monthly EEA users are at risk if the data transfers continue.
8. The proceedings were entered in the Commercial List of the High Court on 5 June 2025.
TikTok applied for a stay on the Decision at that time, on the basis of the affidavits grounding
the entry application. The stay application was opposed by the DPC. The court granted a
temporary stay up to the hearing of this application, which was listed for 7 October 2025.
The stay application was heard over four days from 7 to 10 October 2025. When the hearing
commenced, the DPC did not oppose a continuation of the stay pending the determination
of this application.
9. As will be seen, much of the debate between the parties concerned the test which should
be applied to an application for a stay on a decision of the DPC. The DPC argues that, having
regard to particular features of the decision challenged, a decision made in accordance with
the GDPR, in consultation with other EU supervisory authorities, and with their consent or
agreement, the appropriate threshold is that applied by the CJEU in an application for
interim measures, referred to below as the Zuckerfabrik test. TikTok contends that the
Decision should be treated in the same way as any other national law measure made in
purported compliance with EU law, and that the relevant threshold is the well-established
test applied to such national law measures, the Okunade test.
3
10. Section 149(5) of the Data Protection Act 2018 (“the 2018 Act”) provides that the DPC,
when publishing its decision following an investigation “shall ensure” that the decision is
published in a manner which doesn’t disclose a person’s commercially sensitive
information. Section 156 of the 2018 Act confers an express power on the court to hear some
or all of proceedings under the Act otherwise than in public. At the outset of the hearing,
TikTok applied for an order that its commercially sensitive information referred to in the
affidavits and exhibits grounding the stay application be treated as not having been referred
to in open court, and not published or disclosed to any third party, in order to protect its
confidential nature.
11. It is clear from the decision in Gilchrist and Rogers v Sunday Newspapers [2017] IESC
18, [2017] 2 IR 284, that even where an express power to hear proceedings otherwise than
in public exists, the court is obliged to consider whether the interests of justice requires a
restriction on the public’s access to the hearing, and, if so, whether there are any less
restrictive measures than a hearing in camera which would ensures that justice is done.
12. In circumstances where the statute expressly confers protection on commercially
sensitive information by section 149(5) of the 2018 Act when the DPC publishes a decision,
it would wholly undermine that protection, or the effectiveness of any remedy provided by
the GDPR and the 2018 Act, if a person was required to forego that protection in order to
challenge that decision in accordance with the 2018 Act. In those circumstances, I was
satisfied that the order sought – which fell well short of an in camera hearing – was the least
restrictive means of preserving the interests protected by the statute. Accordingly, I agreed
to make an order pursuant to section 156 of the 2018 Act.
13. Of course, the only information which should be protected by an order made pursuant
to section 156 is the information which the DPC was under a duty to protect when publishing
a decision pursuant to section 149(5), unless TikTok wish to advance some additional
ground justifying its protection. For the purposes of the stay hearing, there was no real
debate about the extent of the information which TikTok claimed should fall within the
scope of the section 156 order, though the DPC reserved its entitlement to contest whether
4
particular information fell to be protected in the future. For the purpose of the stay hearing
only, therefore, all the information which was highlighted by TikTok as being commercially
sensitive was treated as falling within the scope of the order made pursuant to section 156
of the Act.
The General Data Protection Regulation
14. The GDPR is the centrepiece of the reform of the EU regulatory framework for
protection of personal data (see, generally, Kuner, Bygrave and Docksey, The EU General
Data Protection Regulation (Oxford University Press, 2020)). It is a Regulation of some
complexity and its interpretation will, no doubt, play a significant role in the resolution of
TikTok’s appeal. However, for the purposes of resolving this stay application, two related
issues are relevant. First, what is the nature of the decision by a supervising authority such
as the one the subject of this appeal. And second, does the GDPR provide any indication of
the threshold which should be applied by a court when considering an application for a stay,
or interim measures, in respect of such a decision.
15. Briefly, TikTok’s position is that that the GDPR makes clear that a decision of a
supervising authority is a decision of that supervising authority alone, and is therefore a
national law measure, subject to challenge on the basis of a member state’s procedural law
in accordance with the principle of procedural autonomy. It argues that national procedural
autonomy is the default in the absence of express harmonisation, and that the GDPR makes
clear that the default position applies where a challenge is, as here, to a decision of a
supervising authority. It argues, therefore, that this application should be decided by
reference to national procedural law.
16. The DPC accepts that procedural autonomy is the default position and that the threshold
for the grant of a stay on a measure giving effect to EU law would ordinarily be subject to
national procedural rules. However, it contends that the decision of a supervising authority
is, because of the mandatory co-operation procedures in Article 60 of the GDPR, in effect a
5
joint decision of all supervising authorities which is binding across the EU (in fact, the entire
EEA on account of its incorporation into the EEA Agreement). This effect of a supervising
authority’s decision means, argues the DPC, that the procedural autonomy afforded to the
member states in relation to legal proceedings challenging a decision of a supervisory
authority must be subject to a requirement that the same standard is applied as applies to the
assessment of applications for interim measures when an EU measure is challenged. It
contends that this is consistent with an interpretation of the GDPR as a whole and the case
law of the CJEU.
17. Recital 1 of the GDPR recognises that the protection of natural persons in relation to
the processing of personal data is a fundamental right and references Article 8(1) of the
Charter of Fundamental Rights of the European Union (the Charter) and Article 16(1) of the
Treaty on the Functioning of the European Union (TFEU), each of which provides that
everyone has the right to the protection of personal data concerning him or her.
18. Recital 4 provides that:
The processing of personal data should be designed to serve mankind. The right to the
protection of personal data is not an absolute right; it must be considered in relation to
its function in society and be balanced against other fundamental rights, in accordance
with the principle of proportionality. This Regulation respects all fundamental rights
and observes the freedoms and principles recognised in the Charter as enshrined in the
Treaties, in particular the respect for private and family life, home and communications,
the protection of personal data, freedom of thought, conscience and religion, freedom
of expression and information, freedom to conduct a business, the right to an effective
remedy and to a fair trial, and cultural, religious and linguistic diversity.
19. Recital 11 relates to harmonisation:
Effective protection of personal data throughout the Union requires the strengthening
and setting out in detail of the rights of data subjects and the obligations of those who
6
process and determine the processing of personal data, as well as equivalent powers
for monitoring and ensuring compliance with the rules for the protection of personal
data and equivalent sanctions for infringements in the Member States.
20. Recital 101 concerns the transfer of data outside EU:
Flows of personal data to and from countries outside the Union and international
organisations are necessary for the expansion of international trade and international
cooperation. The increase in such flows has raised new challenges and concerns with
regard to the protection of personal data. However, when personal data are transferred
from the Union to controllers, processors or other recipients in third countries or to
international organisations, the level of protection of natural persons ensured in the
Union by this Regulation should not be undermined, including in cases of onward
transfers of personal data from the third country or international organisation to
controllers, processors in the same or another third country or international
organisation. In any event, transfers to third countries and international organisations
may only be carried out in full compliance with this Regulation. 5A transfer could take
place only if, subject to the other provisions of this Regulation, the conditions laid down
in the provisions of this Regulation relating to the transfer of personal data to third
countries or international organisations are complied with by the controller or
processor.
21. Recitals 124 to 126 discuss the role of supervising authorities and the competence of
lead supervising authorities. Recital 126 refers to decision-making by supervisory
authorities:
The decision should be agreed jointly by the lead supervisory authority and the
supervisory authorities concerned and should be directed towards the main or single
establishment of the controller or processor and be binding on the controller and
processor. The controller or processor should take the necessary measures to ensure
7
compliance with this Regulation and the implementation of the decision notified by the
lead supervisory authority to the main establishment of the controller or processor as
regards the processing activities in the Union.
22. Recital 143 refers to the entitlement to a judicial remedy. It distinguishes between the
remedy available where a challenge is to a decision of a supervising authority, and where
the challenge is to a decision of the European Data Protection Board (EDPB).
Any natural or legal person has the right to bring an action for annulment of decisions
of the Board before the Court of Justice under the conditions provided for in Article
263 TFEU. As addressees of such decisions, the supervisory authorities concerned
which wish to challenge them have to bring action within two months of being notified
of them, in accordance with Article 263 TFEU. Where decisions of the Board are of
direct and individual concern to a controller, processor or complainant, the latter may
bring an action for annulment against those decisions within two months of their
publication on the website of the Board, in accordance with Article 263 TFEU. Without
prejudice to this right under Article 263 TFEU, each natural or legal person should
have an effective judicial remedy before the competent national court against a decision
of a supervisory authority which produces legal effects concerning that person. Such a
decision concerns in particular the exercise of investigative, corrective and
authorisation powers by the supervisory authority or the dismissal or rejection of
complaints. However, the right to an effective judicial remedy does not encompass
measures taken by supervisory authorities which are not legally binding, such as
opinions issued by or advice provided by the supervisory authority. Proceedings
against a supervisory authority should be brought before the courts of the Member
State where the supervisory authority is established and should be conducted in
accordance with that Member State’s procedural law. Those courts should exercise full
jurisdiction, which should include jurisdiction to examine all questions of fact and law
relevant to the dispute before them.
8
Where a complaint has been rejected or dismissed by a supervisory authority, the
complainant may bring proceedings before the courts in the same Member State. In the
context of judicial remedies relating to the application of this Regulation, national
courts which consider a decision on the question necessary to enable them to give
judgment, may, or in the case provided for in Article 267 TFEU, must, request the Court
of Justice to give a preliminary ruling on the interpretation of Union law, including this
Regulation. Furthermore, where a decision of a supervisory authority implementing a
decision of the Board is challenged before a national court and the validity of the
decision of the Board is at issue, that national court does not have the power to declare
the Board’s decision invalid but must refer the question of validity to the Court of
Justice in accordance with Article 267 TFEU as interpreted by the Court of Justice,
where it considers the decision invalid. However, a national court may not refer a
question on the validity of the decision of the Board at the request of a natural or legal
person which had the opportunity to bring an action for annulment of that decision, in
particular if it was directly and individually concerned by that decision, but had not
done so within the period laid down in Article 263 TFEU.
23. Article 4(21) and 4(22) of the Regulation define “supervising authority” and
“supervising authority concerned”.
(21) ‘supervisory authority’ means an independent public authority which is
established by a Member State pursuant to Article 51;
(22) ‘supervisory authority concerned’ means a supervisory authority which is
concerned by the processing of personal data because:
a. the controller or processor is established on the territory of the Member State
of that supervisory authority;
9
b. data subjects residing in the Member State of that supervisory authority are
substantially affected or likely to be substantially affected by the processing;
or
c. a complaint has been lodged with that supervisory authority…
24. Chapter V relates to the cross border transfer of data, that is transfers outside the
EU/EEA. The overriding requirement is that the rights guaranteed by the GDPR are not
compromised by any such transfer of personal data, that data is afforded an equivalent level
of protection in a third country as it would be within the EU. Article 44 provides:
Any transfer of personal data which are undergoing processing or are intended for
processing after transfer to a third country or to an international organisation shall
take place only if, subject to the other provisions of this Regulation, the conditions laid
down in this Chapter are complied with by the controller and processor, including for
onward transfers of personal data from the third country or an international
organisation to another third country or to another international organisation. All
provisions in this Chapter shall be applied in order to ensure that the level of protection
of natural persons guaranteed by this Regulation is not undermined
25. Articles 45 and 46 provide alternative mechanisms for ensuring equivalent protection.
Article 45 provides for the making of adequacy decisions by the European Commission.
Where the Commission has determined that adequate protection is provided in a third
country, it can issue a decision to that effect. Any transfers to that country consistent with
the adequacy decision do not require further authorisation. Adequacy decisions were the
subject of the leading cases, Case C-362/14, Schrems v Data Protection Commissioner
(“Schrems I”) and Case C-311/18, Data Protection Commissioner v Facebook Ireland Ltd
and Schrems (“Schrems II”).
10
26. Where, as here, there is no adequacy decision, transfers are still permitted without
specific authorisation where the data processor satisfies the requirements of Article 46:
1. In the absence of a decision pursuant to Article 45(3), a controller or processor may
transfer personal data to a third country or an international organisation only if the
controller or processor has provided appropriate safeguards, and on condition that
enforceable data subject rights and effective legal remedies for data subjects are
available.
2. The appropriate safeguards referred to in paragraph 1 may be provided for, without
requiring any specific authorisation from a supervisory authority, by:
a) a legally binding and enforceable instrument between public authorities or
bodies;
b) binding corporate rules in accordance with Article 47;
c) standard data protection clauses adopted by the Commission in accordance
with the examination procedure referred to in Article 93(2);
d) standard data protection clauses adopted by a supervisory authority and
approved by the Commission pursuant to the examination procedure referred to
in Article 93(2);
e) an approved code of conduct pursuant to Article 40 together with binding and
enforceable commitments of the controller or processor in the third country to
apply the appropriate safeguards, including as regards data subjects’ rights; or
f) an approved certification mechanism pursuant to Article 42 together with
binding and enforceable commitments of the controller or processor in the third
country to apply the appropriate safeguards, including as regards data subjects’
rights.
27. The decision in these proceedings was that TikTok had failed to satisfy the DPC that
the transfer by it of personal data to China was in accordance with Article 46(1).
11
28. Article 49 provides for derogations from the requirements of Articles 45 and 46. These
are available, inter alia, where:
(a) the data subject has explicitly consented to the proposed transfer, after having
been informed of the possible risks of such transfers for the data subject due to the
absence of an adequacy decision and appropriate safeguards…
29. Chapter VI of the GDPR deals, inter alia, with the decision-making functions of
supervisory authorities. Pursuant to Article 51, each member state is required to designate
at least one supervisory authority responsible for monitoring the application of the GDPR.
Article 56 sets out the competencies of a supervisory authority. During the course of the
hearing, I was informed that there are a total of 47 supervisory authorities within the EEA,
as some states, notably Germany, have more than one supervisory authority.
30. Article 56(1) provides:
Without prejudice to Article 55, the supervisory authority of the main establishment or
of the single establishment of the controller or processor shall be competent to act as
lead supervisory authority for the cross-border processing carried out by that controller
or processor in accordance with the procedure provided in Article 60.
31. Article 58(1) of the GDPR sets out the investigative powers a supervisory authority
shall have, Article 58(2) its corrective powers.
32. Article 60 sets out the co-operation procedure between supervising authorities when,
inter alia, investigating a complaint. Sub-articles 1 to 3 concern obligations in relation to
the sharing of information. These include, at sub-article 3, an obligation on a lead
supervising authority (“LSA”) to provide draft decisions to other supervisory authorities
concerned (“SACs”) for their opinion and to “take account of their views”. Other SACs may
provide reasoned objections to the draft decision. If agreement cannot be reached on those
12
objections, a consistency mechanism is provided, whereby any disagreement can be referred
to the EDPB for resolution. A decision of the EDPB pursuant to Article 65 of the GDPR is
binding upon the supervisory authorities. The EDPB is established by Article 68(1) of the
GDPR as a union body with legal personality. It is comprised of the heads of at least one
supervisory authority from each member state.
33. Two further articles merit attention. Article 66(1) provides for an accelerated procedure
in cases of urgency:
In exceptional circumstances, where a supervisory authority concerned considers that
there is an urgent need to act in order to protect the rights and freedoms of data subjects,
it may, by way of derogation from the consistency mechanism referred to in Articles
63, 64 and 65 or the procedure referred to in Article 60, immediately adopt provisional
measures intended to produce legal effects on its own territory with a specified period
of validity which shall not exceed three months. The supervisory authority shall, without
delay, communicate those measures and the reasons for adopting them to the other
supervisory authorities concerned, to the Board and to the Commission.
34. Finally, Article 78 of the GDPR requires that member states provide effective remedies
regarding decisions of supervisory authorities:
1. Without prejudice to any other administrative or non-judicial remedy, each natural
or legal person shall have the right to an effective judicial remedy against a legally
binding decision of a supervisory authority concerning them.
2. Without prejudice to any other administrative or non-judicial remedy, each data
subject shall have the right to an effective judicial remedy where the supervisory
authority which is competent pursuant to Articles 55 and 56 does not handle a
complaint or does not inform the data subject within three months on the progress
or outcome of the complaint lodged pursuant to Article 77.
3. Proceedings against a supervisory authority shall be brought before the courts of
the Member State where the supervisory authority is established.
13
4. Where proceedings are brought against a decision of a supervisory authority which
was preceded by an opinion or a decision of the Board in the consistency
mechanism, the supervisory authority shall forward that opinion or decision to the
court.
35. The decision-making process and consistency mechanism have been analysed by the
CJEU in a number of cases. The DPC referred, in particular, to the Opinion of the Advocate
General, in Case C-645/19, Facebook Ireland Inc and Ors v
Gegevensbeschermingsautoriteit (“Facebook”), in which the question referred was whether
a supervisory authority in one member state could bring proceedings before the court of that
state with regard to cross-border processing, where it was not the LSA for that processing.
36. In concluding that it was permissible to do so only in the particular circumstances
provided in the GDPR (in Article 58(5)), the Advocate General considered the legislative
history of the GDPR and described the approach ultimately adopted in the GDPR as a “one-
stop shop” mechanism, language repeated in the court’s judgment. He considered the
respective roles of LSAs and other supervisory authorities:
85. Second, the Council intended to mitigate the role and competence of the LSA, by
making the procedure more inclusive. The text of the Commission’s Proposal was
considered to be somewhat ambiguous on the point, and possibly giving rise to an
exclusive competence of the LSA over cross-border data processing. A number of
corrections were made to the text in order to enhance the ‘proximity’ between data
subjects and the supervisory authorities. Inter alia, the involvement of other
supervisory authorities in the decision-making process was significantly increased.
86. For its part, the European Parliament also supported the creation of the one-
stop-shop mechanism, with an enhanced role for the LSA, but proposed to strengthen
the system of cooperation among the supervisory authorities. Both the Explanatory
14
Statement to the Draft Report of the Parliament and the European Parliament
legislative resolution of 12 March 2014 are rather clear in that regard.
87. In essence, with the Council’s and the Parliament’s intervention, the one-stop-
shop mechanism, previously heavily leaning towards the LSA, was turned into a more
balanced two-pillar mechanism: the leading role of the LSA with regard to cross-border
processing is preserved, but it is now accompanied by an enhanced role for the other
supervisory authorities which actively participate in the process through the
cooperation and consistency mechanisms, with the Board given the role of referee and
guide in the event of disagreement.
37. At [111] the Advocate General described the LSA as a “primus inter partes…. Only
able to act with the consent of the SACs”.
38. The CJEU in agreeing with the Advocate General’s conclusions used similar language
regarding co-operation and consensus.
39. Both parties also referenced Case C-97/23P, WhatsApp Ireland Ltd v EDPB. In those
proceedings, WhatsApp challenged a decision of the EDPB made pursuant to the
consistency mechanism. The application was dismissed by the General Court as
inadmissible. An appeal to the CJEU is pending, but the Advocate General’s opinion,
delivered on 27 March 2025, is that the proceedings are admissible, and that a decision of
the EDPB under the consistency mechanism is a “challengeable act” for the purpose of
Article 263 TFEU. The Advocate General provides a helpful summary of the consistency
mechanism:
“10. The task of monitoring and enforcing the rules of the GDPR is entrusted to the
various supervising authorities of the Member States within their respective territories.
15
11. To tackle the possible fragmentation in the implementation of data protection
rules across the European Union that may result from such a ‘decentralised’ system,
the GDPR provides for cooperation between national supervisory authorities.
12. When a data processing operation has a cross-border dimension, the authority
in charge of the processor or controller at issue – the lead supervisory authority (LSA)
– must circulate its draft decision enforcing the rules of the GDPR against the processor
or controller under its competence to the concerned supervisory authorities of other
Member States.
13. If those other authorities agree with the interpretation of the GDPR and with the
enforcement measures proposed by the LSA, the latter may adopt its final decision,
which is binding on the controller or processor at issue.
14. However, if those other supervisory authorities express relevant and reasoned
objections with which the LSA disagrees or considers them not to be relevant or
reasoned, the LSA must submit the matter to the EDPB for the latter to take a decision.
15. The EDPB adjudicates the dispute between the national supervisory authorities
involved and resolves that individual case by means of a binding decision.
16. According to Article 65(2) of the GDPR, that decision is addressed to and binds
the LSA and all the other supervisory authorities concerned. The decision is also
published on the EDPB’s website.
17. Within prescribed deadlines and on the basis of that binding EDPB decision, the
LSA must adopt its final decision, which is then notified to the controller or processor
at issue.”
Data Protection Act 2018
40. Part 6 of the 2018 Act concerns enforcement of the GDPR. Sections 108 and 109 of the
Act give the DPC power to investigate complaints made to it. Section 110 entitles the
Commission to carry out an Inquiry of its own volition:
16
110. (1) The Commission, whether for the purpose of section 109(5)(e), section 113(2),
or of its own volition, may, in order to ascertain whether an infringement has occurred
or is occurring, cause such inquiry as it thinks fit to be conducted for that purpose.
41. Where an Inquiry pursuant to section 110 has taken place, section 111 provides that the
DPC shall do one of the following:
(1) Where an inquiry has been conducted of the Commission’s own volition, the
Commission, having considered the information obtained in the inquiry, shall—
(a) if satisfied that an infringement by the controller or processor to which the inquiry
relates has occurred or is occurring, make a decision to that effect, and
(b) if not so satisfied, make a decision to that effect.
42. If the DPC makes a decision that there has been a breach, then section 111(2) requires
that it also consider whether to exercise any corrective power and, if so, what corrective
power to exercise.
43. Section 154 of the Act provides the DPC with immunity from suit:
Civil or criminal proceedings shall not lie in any court against the Commission, a
Commissioner, an authorised officer or a member of the staff of the Commission in
respect of anything said or done in good faith by the Commission, Commissioner,
authorised officer or member of staff in the course of the performance or purported
performance of a function of the Commission, Commissioner, authorised officer or
member of staff.
The Inquiry
44. As appears from the Decision, during the course of its supervision interactions with
TikTok, the DPC was informed by TikTok that certain personnel located in China accessed
17
personal data of TikTok’s EEA users in order to provide support services in connection with
the operation of its platform, including functions related to software engineering,
maintenance and development. On 26 March 2021, TikTok provided the DPC with its data
transfer assessment (“DTA”) for China, an assessment of the level of protection afforded to
data transferred to China, together with supporting documentation.
45. In the Decision, the DPC describes the TikTok platform as follows:
“36. The TikTok platform is a social media service allowing users to create and share
short-form videos of up to 10 minutes in length. It is available as an app for Android
and iOS, and via the website www.tiktok.com. TikTok accounts can be created by users
aged 13 years and over using a phone number and email address. A TikTok profile
typically contains a profile photo or video and username. The app shows a personalised
‘For You’ feed of videos for each user, recommended based on factors such as the user’s
selected interest categories, device and account settings, and interaction with the app.
Users can create, watch, ‘like’ and comment on videos, ‘follow’ other users’ profiles,
and send direct messages to other users.
…
38. TikTok Ireland has stated that the TikTok service is not offered or available in
China, where the ByteDance group of companies separately operates “a similar but
entirely distinct” video-sharing platform called Douyin…”
46. ByteDance Limited is TikTok’s ultimate parent. Though it is registered in the Cayman
Islands, many of the ByteDance group of companies and its employees are based in China.
47. On 7 April 2021, the DPC received a submission from Stichting Onderzoek
Marktinformatie, a Dutch non-governmental organisation, raising concerns about the
18
processing of personal data by TikTok, due to risks for young users and the non-EEA transfer
of personal data.
48. On 28 May 2021 and 5 July 2021, the DPC received requests for mutual assistance
from the French supervisory authority, Commission Nationale de l’Informatique et des
Libertés, requesting that the DPC investigate matters pertaining to TikTok’s transfer of
personal data to China.
49. On 14 September 2021, the DPC notified TikTok of the commencement of two inquiries
pursuant to section 110 of the Data Protection Act 2018 (so-called “own volition” inquiries),
including the inquiry which led to the decision the subject of these proceedings (“the
Inquiry”).
50. TikTok responded to the commencement notice on 12 October 2021. The response
included an updated DTA. A further updated DTA was provided on 28 January 2022.
51. On 11 May 2022, the DPC requested further information from TikTok. Having sought
an extension of time to provide a response, TikTok responded on 20 June 2022.
52. On 7 July 2022, the DPC provided TikTok with a detailed Statement of Issues and
invited submissions on same. The issues for determination were summarised as follows:
“(1) The DPC will consider and determine, within the scope of the Inquiry, the relevant
facts as to TikTok Ireland’s reliance on the 2010 SCCs in connection with the transfers
the subject of the Inquiry involving remote access to personal data of EEA users by the
China Group Entities.
(2) The DPC will consider and determine, within the scope of the Inquiry, the relevant
facts as to the scope of TikTok Ireland’s reliance, if any, on the derogations set out in
Article 49 GDPR, and in particular Article 49(1)(b) GDPR, and, if necessary, review
and determine the lawfulness of same in the context of the transfers the subject of the
Inquiry.
19
(3) The DPC will consider and determine within the scope of the Inquiry whether TikTok
Ireland can demonstrate that it has complied with its responsibility to assess the level
of protection of personal data of EEA users the subject of transfers to the China Group
Entities using SCCs under Article 46(2)(c) GDPR for the purpose of Articles 44 and
46(1) GDPR, having regard in particular to TikTok Ireland’s responsibility as a
controller in light of Article 5(2) and 24 GDPR. This will include consideration as to
whether TikTok Ireland has adequately assessed whether, and the extent to which, there
is a risk that the personal data of EEA users remotely accessed by the China Group
Entities may be subject to potentially problematic laws and practices in effect in China,
and whether, and extent to which, there is a risk that the 2010 SCCs are not being
complied with, or cannot be complied with, by the China Group Entities in the context
of the transfers the subject of the Inquiry.
(4) The DPC will consider and determine, within the scope of in the Inquiry, whether
TikTok Ireland can demonstrate that the supplementary measures implemented by
TikTok Ireland and the China Group Entities in respect of the remote access by the
China Group Entities to personal data of EEA users are effective, together with the
2010 SCCs, to ensure that EEA users are provided with the appropriate safeguards,
enforceable rights and effective legal remedies required by Articles 44, 46(1) and
46(2)(c) GDPR, so that the personal data of EEA users is afforded a level of protection
essentially equivalent to that guaranteed within EU by the GDPR.
(5) The DPC will consider and determine whether TikTok Ireland has complied with its
obligations under Article 13(1)(f) GDPR with reference to the information it provides
to EEA users of the TikTok platform concerning the transfers the subject of the Inquiry.”
53. When furnishing the Statement of Issues, the DPC indicated that in respect of the
second issue, it intended having regard to information on government access to personal
data in China set out in the “Final Report EDPS/2019/02-13, Legal study on Government
20
access to data in third countries for the EDPB (November 2021)” (“the Milieu Report”).
TikTok raised certain queries on the Statement of Issues and responded in substance on 15
September 2022. TikTok notified the DPC of its intention to submit expert evidence in
relation to the Milieu Report. It also informed DPC that it was in the process of updating its
DTA for China and expected to complete this by 13 October 2022, that it was in the process
of updating its EEA privacy policy, and that it would shortly be amending its Intra-Group
Agreement for the purpose of transitioning from the 2010 SCCs to the new ones (“the 2021
SCCs”), and that this would be done by 27 December 2022. TikTok also queried the
temporal scope of the Inquiry and were advised it was “ongoing”.
54. On 13 October 2022, TikTok provided the DPC with an expert report on Chinese law,
addressing the Milieu Report, from Professor Ke Xu, Professor of Law of the Law School,
University of International Business and Economics, Beijing. It also provided an update to
the DTA (“the October 2022 DTA”). It provided its privacy policy on 22 October 2022,
and information on the 2021 SCCs in December 2022.
55. The DPC sent a request for further information on 21 February 2023, raising queries
regarding the 2021 SCCs.
56. When responding to this request on 28 March 2023, TikTok provided information on
further measures it was putting in place, referred to as Project Clover, to ensure the
protection of EEA user data. It advised that implementation had commenced.
57. The DPC raised queries about the turnover of TikTok’s parent company, ByteDance in
April 2023. On 17 May 2023, it issued a Preliminary Draft Decision (“the PDD”). The PDD
defined the temporal scope of the Inquiry as commencing on 29 July 2020 and ongoing. The
provisional findings are summarised in TikTok’s affidavit grounding the appeal as follows:
a) In respect of Issue 1, the DPC set out a summary of the facts it considered to be
relevant and necessary to the determination of the issues set out in the PDD in
§165.
21
b) In respect of Issue 2, the DPC provisionally found that, by failing to clarify
precisely how the territoriality principle applies in the context of the laws and
practices outlined in Section 2.2 of the DTA and the Data Transfers (the regulation
of public authority access to personal data in China), TikTok Ireland had failed to
comply with its responsibility to adequately assess the level of protection of EEA
Users under the Chinese legal framework for the purposes of Articles 44 and 46
GDPR and, further, had failed to demonstrate compliance with Articles 44 and 46
with regard to the processing the subject of the transfers (PDD, §299).
c) In respect of Issue 3, the DPC provisionally found that TikTok Ireland had failed to
verify, guarantee and demonstrate that the supplementary measures and the SCCs
are effective to ensure that EEA User Data is afforded a level of protection
essentially equivalent to that guaranteed in the EU (PDD, §§365 - 371).
Specifically, the DPC expressed the provisional view that TikTok had failed to
certify, guarantee and demonstrate that the supplemental measures or the SCCs
address the risks associated with the Data Transfers falling subject to the National
Intelligence Law, the Counter-Espionage Law, Article 18 of the Anti-Terrorism
Law, and the PRC Cybersecurity Law (the Relevant Chinese Laws, described by
the DPC as the "Problematic Laws" in the PDD).
d) In respect of issue 4, the DPC expressed the provisional view that TikTok Ireland
could not rely on derogations under Article 49 GDPR in respect of the Data
Transfers, which are systemic, repetitive and continuous (PDD, §397).
e) In light of its provisional findings in respect of Issues 1 - 4, the DPC made a
provisional finding that TikTok Ireland had infringed Article 46(1) GDPR
regarding the Data Transfers by failing to verify, guarantee and demonstrate that
the supplementary measures and the SCCs are effective to ensure that EEA User
22
Data is afforded a level of protection essentially equivalent to that guaranteed in
the EU (PDD, §398).
f) respect of issue 5, the DPC made a provisional finding TikTok Ireland had infringed
Article 13(1)(f) GDPR from 29 July 2020 to December 2022 by failing to provide
data subjects with information on its transfers of personal data to China and
information as to how the Data Transfers concerned remote access to personal
data stored in Singapore and the United States by CGE Personnel based in China
(PDD, §432).
g) The DPC provisionally decided (i) to make an order pursuant to Article 58(2)(j)
requiring TikTok Ireland to suspend the Data Transfers, (ii) to make an order
pursuant to Article 58(2)(d) GDPR requiring TikTok Ireland to bring the processing
into compliance in the manner specified in the PDD, and (iii) to impose two
administrative fines pursuant to Article 58(2)(i) GDPR in the ranges of €450 - €500
million and €30 - €50 million respectively.
58. TikTok made submissions on the PDD on 9 September 2023. It provided a second
opinion from Professor Xu, reports from two law firms, Fangda and Clifford Chance, a
technical report on Project Clover (“the Project Clover Technical Report”) and a report
from NCC Group. It subsequently provided a report from Dr Prateek Mittal concerning
TikTok’s privacy solution. It provided an updated DTA on 6 October 2023 (“the October
2023 DTA”).
59. On 8 February 2024, the DPC wrote to TikTok seeking clarification on matters arising
from TikTok’s response to the PDD, including whether remote access by personnel in China
involved storage of EEA user data in China, including temporary storage.
60. Between March and June 2024, TikTok responded to this request and sought
confirmation that the DPC would have regard to the materially new information provided
23
by it since the PDD. It requested that the DPC withdraw the PDD and issue a revised PDD
in light of the new measures which TikTok had put in place. Although the DPC confirmed
that it would have regard to all information provided, it declined to withdraw the PDD,
considering it to be unnecessary.
61. On 31 July 2024, TikTok provided the DPC with a further revision to its DTA (“the
July 2024 DTA”). This is the most up-to-date DTA so far provided by TikTok.
62. On 6 December 2024, TikTok advised the DPC that it had updated its Intra-Group
Agreement to reflect changes in the processing of data in China. On 14 February 2025, it
indicated that it intended to provide updates on the further implementation of Project Clover
by 10 March 2025.
63. On 21 February 2025, the DPC informed TikTok that it had finalised a draft decision
(“the Draft Decision”) and circulated it to the concerned supervisory authorities pursuant
to Article 60 of the GDPR. As stated in the Draft Decision at [95]:
“Given that the matters under examination in the inquiry entail cross-border processing
across Europe, all other supervisory authorities were engaged as SACs for the purpose
of the co-decision-making process outlined in Article 60 of the GDPR.”
64. The DPC provided TikTok with a copy of the Draft Decision. The temporal scope of
the Inquiry pursuant to the Draft Decision was stated to be from 29 July 2020 to 17 May
2023.
65. The Draft Decision contained findings on each of the five issues identified in the
Statement of Issues. In relation to Issue 2 in the Statement of Issues, it found:
“392. … the DPC finds that TikTok Ireland failed to adequately assess the level of
protection of personal data of EEA users the subject of transfers to the China Group
Entities using SCCs. While TikTok Ireland acknowledged relevant divergences between
the level of protection afforded by the law and practices of China compared with
24
European Union law, its assessment of the territoriality principle resulted in it
concluding that the Data Transfers fell outside the territorial scope of the problematic
laws. However, the DPC finds that TikTok Ireland’s assessment of the territoriality
principle failed to clarify whether, and the extent to which, such laws may apply in the
context of the Data Transfers, and failed to set out in a clear way the deficiencies it
acknowledged to exist in the Chinese legal framework. By failing to adequately assess
the law and practices in China in the context of the Data Transfers, TikTok Ireland
failed to comply with its responsibility to assess the level of protection of personal data
of EEA users the subject of transfers to the China Group Entities using SCCs.
393. The DPC also finds that TikTok Ireland’s failure to adequately assess the level
of protection provided by Chinese law and practices resulted in it failing to verify,
guarantee and demonstrate that that the personal data of EEA Users subject to the Data
Transfers was afforded a level of protection essentially equivalent to that guaranteed
within the European Union…
399. … [T[his has prevented TikTok Ireland from verifying and guaranteeing that
data subjects have enforceable rights and effective legal remedies. Having failed to
verify and guarantee that the Data Transfers were afforded a level of protection
essentially equivalent to that guaranteed within the European Union, it is clear that
TikTok Ireland was also not in a position to demonstrate an essential equivalent level
of protection.”
66. In relation to Issue 3, the Draft Decision concluded:
“475. The supplementary measures were not sufficient to prevent the risk of potential
application of problematic access by Chinese authorities supported by problematic
laws, and, thus, were not sufficient to ensure that the personal data of EEA users was
afforded a level of protection essentially equivalent to that guaranteed within the EU.
TikTok Ireland’s assessment of law and practices in China and the supplementary
25
measures implemented based on that assessment have failed to appropriately account
for the risk of access supported by problematic laws to EEA User Data that is processed
in China. For the reasons set out above, the DPC finds that the supplementary measures
implemented by TikTok Ireland were inadequate to compensate in respect of this risk.
Therefore, the DPC finds that TikTok Ireland failed to verify that EEA User Data subject
to the Data Transfers would be afforded a level of protection essentially equivalent to
that guaranteed within the European Union in circumstances where TikTok Ireland
failed to verify that problematic laws could not be applied to EEA User Data processed
in China. The DPC also finds that TikTok Ireland failed to implement appropriate
safeguards and supplemental measures to guarantee that EEA User Data subject to the
Data Transfers would be afforded a level of protection essentially equivalent to that
guaranteed within the European Union.
476. Accordingly, the DPC finds that TikTok Ireland failed to verify, guarantee and
demonstrate that the supplementary measures implemented by TikTok Ireland and the
China Group Entities in respect of the Data Transfers were effective, together with the
2010 SCCs and the 2021 SCCs, to ensure that EEA users were provided with the
appropriate safeguards, enforceable rights and effective legal remedies required by
Articles 44, 46(1) and 46(2)(c) GDPR, so that the personal data of EEA users was
afforded a level of protection essentially equivalent to that guaranteed within EU by the
GDPR.”
67. The DPC made the following finding of infringement:
“544. In light of the foregoing, as set out in Issues 1 – 4, the DPC finds that TikTok
Ireland infringed Article 46(1) GDPR regarding the Data Transfers. As set out above,
TikTok Ireland failed to adequately assess the level of protection provided by Chinese
law and practices to the personal data of EEA Users the subject of transfers to the
China Group Entities using SCCs. It failed to verify, guarantee and demonstrate that
the supplementary measures and the SCCs were effective to ensure that the personal
26
data of EEA Users is afforded a level of protection essentially equivalent to that
guaranteed within the EU. TikTok Ireland did not, and could not, rely on the derogations
under Article 49 GDPR in respect of the Data Transfers made during the temporal
scope. Consequently, TikTok Ireland transferred EEA User Data to China without
complying with the conditions laid down by Chapter V of the GDPR and did not identify
a valid lawful basis for the Data Transfers.
545. Accordingly, during the temporal scope of the Inquiry, from 29 July 2020 to 17
May 2023, TikTok Ireland infringed Article 46(1) GDPR by carrying out the Data
Transfers while failing to verify, guarantee and demonstrate that that the personal data
of EEA Users subject to the Data Transfers was afforded a level of protection essentially
equivalent to that guaranteed within the European Union.”
68. Having regard to the fact that the temporal scope of the Inquiry ended on the date the
PDD was provided to TikTok, the DPC separately considered the changes made by TikTok
since that date when considering whether to make any suspension or correction order. The
Draft Decision records that:
“665. The DPC has carefully considered all of the additional supplementary measures
implemented by TikTok Ireland after the temporal scope of the Inquiry. The additional
supplementary measures do not address the risk of Chinese authorities accessing the
personal data that is accessed by employees of the China Group Entities in plain text.
The DPC finds that TikTok Ireland has not demonstrated that EEA User Data subject
to the Data Transfers cannot be subject to problematic access by Chinese public
authorities. TikTok Ireland’s ongoing failure to adequately assess the level of protection
provided by Chinese law and practices to the personal data of EEA users the subject of
transfers interferes with its ability on an ongoing basis to select appropriate safeguards
and supplementary measures, and prevents it from demonstrating an essentially
equivalent level of protection. Therefore, the DPC’s concerns regarding the Data
Transfers, as set out at Issues 2 and 3 of this Draft Decision, remain in respect of the
27
ongoing Data Transfers. For that reason, the DPC finds that TikTok Ireland has failed
on a continuing basis to demonstrate that the supplementary measures that it has
implemented and the SCCs are effective to ensure that the personal data of EEA users
is afforded a level of protection essentially equivalent to that guaranteed within the EU.
…
667. In light of the foregoing, the DPC orders TikTok Ireland pursuant to Article
58(2)(j) GDPR to suspend the Data Transfers in accordance with the timeline outlined
below.”
69. On 14 March 2025, TikTok requested that the DPC withdraw the Draft Decision,
alleging fundamental errors of fact and breaches of fair procedures. On 18 March 2025, it
provided a third report from Professor Xu to address a purported gap in TikTok’s assessment
of Chinese law identified in the Draft Decision. By letter dated 25 March 2025, the DPC
refused the request to withdraw the Draft Decision.
70. Although the DPC received comments on the Draft Decision from three SACs (those
of France, Holland and Berlin), it received no reasoned objections. Accordingly, the DPC
adopted the Decision with “non-material” amendments from the Draft Decision on 30 April
2025.
Disclosure of issue concerning TikTok’s ‘OnCall’ platform
71. On 21 March 2025, TikTok disclosed to the DPC that, contrary to statements made
during the course of the Inquiry that no EEA user personal data was stored in China, it had
discovered that some personal data had, in fact, been stored in China. TikTok has an internal
helpdesk called ‘OnCall’, which is hosted in China. The platform included a free text field
in which the technical issue giving rise to the help request can be described. It emerged that
in a limited number of cases, TikTok’s support agents had included personal data in that
field rather than simply summarising the technical issue. A small number of those instances
28
related to EEA user data. Upon discovering the issue, TikTok moved the data out of China
and further access from China was restricted.
Grounds of appeal
72. TikTok has appealed the Decision on a variety of grounds. For the purpose of this
application, the DPC has accepted that TikTok has identified “serious doubts as to the
validity of the measure”, the threshold in Zuckerfabrik, or “a fair or bona fide or serious
issue to be tried”, the Okunade criteria.
73. TikTok advances various grounds in respect of the fines imposed, including that the
DPC incorrectly calculated the fines by reference to the turnover of its parent company,
ByteDance Limited.
74. Regarding the findings of a failure to comply with Article 46 of the GDPR, TikTok
claims various breaches of fair procedure by the DPC including that it relied on matters
raised for the first time in the Draft Decision circulated pursuant to Article 60 of the GDPR
and therefore deprived TikTok of an opportunity to address those issues. It claims that the
DPC made manifest errors in its assessment of the relevant Chinese laws.
75. As regards the Suspension Order the subject of this application, TikTok argues that the
DPC failed to carry out the assessments required by Article 46, as interpreted in Schrems II,
and contends that accordingly, the DPC could not properly have made such an order in
circumstances where the temporal scope of its inquiry ended on 17 May 2023.
The stay application
76. TikTok applied to enter the proceedings in the Commercial list of the High Court on 5
June 2025. As part of that application, TikTok sought a stay on the operation of the
29
Suspension Order. The DPC did not oppose the application for entry, but did oppose the
stay. The court (Sanfey J) granted an interim stay pending the hearing of a full stay
application.
77. TikTok filed a comprehensive suite of affidavits in support of its application for a stay.
It initially filed twelve affidavits grounding the application. The DPC filed five affidavits in
reply. TikTok filed a further ten affidavits in response. The DPC filed a single further
affidavit in reply, and TikTok then filed two more replying affidavits. Fortunately for the
court, the contents of TikTok’s first two rounds of affidavits are summarised in affidavits
sworn by Elaine Fox, Head of Privacy, Europe and Head of Ireland at TikTok. For the
purpose of this judgment, a brief summary of the evidence adduced will suffice at this
juncture. Particular details will be discussed as necessary when assessing the application for
a stay.
78. TikTok does not dispute that certain data which meets the definition of personal data
under the GDPR can be accessed by personnel of certain China Group Entities (CGEs),
being a list of identified companies. It calls this allowable data. It explains that the allowable
data is stored in data centres outside China, but can be remotely accessed by certain CGE
personnel in China. It describes the data which can be remotely accessed as (i) inter-operable
data, data needed for the TikTok platform to operate globally; (ii) public data, a type of inter-
operable data which is publicly available and accessible by anyone on the TikTok platform,
and (iii) aggregated data, allowable data which is compiled and expressed in a summary
way. It describes the data as the “less confidential data” collected by TikTok about EEA
users and Ms Fox avers that all of this data is, in any event, pseudonymised in a manner
which prevents the re-identification of EEA users.
79. TikTok’s position is that it will have to put in place the following additional measures
to give effect to the Suspension Order. It will have to apply technical measures to anonymise
any aggregated data, and it will have to remove access to the remaining EEA user data to
CGE personnel. It calls these two steps the Suspension Solution.
30
80. Eoghan Kerins, TikTok’s Global Head of Digital Rights avers that he is responsible for
all data disclosures to authorities for the TikTok website outside of the US. He explains how
this process is managed within TikTok. He also avers that there has never been a request for
EEA user data by any authority in China from TikTok and he is not aware of any of the CGE
or any ByteDance entity in China having received such a request. This is reflected in
transparency reports published by TikTok bi-annually.
81. Thomas Wlazik, Head of Europe and Israel and Global Business Solutions and
Managing Director of TikTok Germany GmbH provided an affidavit in which he explained
the TikTok platform and identified its stakeholders. These include users, advertisers, sellers,
businesses, and public organisations and non-profits.
82. Yuquiao Huang, Project Management Office Team Member at TikTok Inc, has sworn
an affidavit in which she avers to the effect implementing the Suspension Solution will have.
It identifies a number of critical business processes which will be severely impacted if access
to the data is removed from CGE personnel. In support of Ms Huang’s analysis, Professor
Peter Pietzuch, Professor of Distributed System, Department of Computing at Imperial
College London, prepared an expert report, which he exhibits on affidavit. He considers that
the analytical framework applied by Ms Huang is appropriate and agrees with her
assessment regarding the significant impact on TikTok’s critical business processes.
83. Ms Huang also explains that if the Suspension Solution is implemented, a very
significant number of CGE personnel, numbering in the thousands, will have to be
transferred and relocated outside China so that TikTok can, in time, return to the same level
of operations in its critical business processes. On TikTok’s analysis, full capacity will not
be restored until 2029. Ms Huang avers that these measures will be very difficult to reverse,
and explains why.
84. He also explains that Suspension Solution will delay the launch of a TikTok service,
TikTok Shop, in new countries in the EEA for a short period.
31
85. Vilma Todri, Associate Professor of Information Systems and Operations Management
at Emory University’s Golzueta Business School, Atlanta also prepared a report, verified on
affidavit, about the adverse impact the Suspension Solution will have on key stakeholders:
users, creators, advertisers and sellers. This will, Professor Todri says, ultimately drive
stakeholders to competitor platforms.
86. She also expresses the opinion that the degradation in the stakeholder experience will
likely inflict harm on TikTok’s brand perception.
87. Paul Jacobs of Grant Thornton prepared a report on the financial impact of the
suspension solution. His report is based on financial analysis provided by Weishu Xu,
Investor Relations Team Member at ByteDance Inc who has also sworn an affidavit. Mr
Jacob opines that a reasonable estimate of lost profit contribution for TikTok in the EEA is
US$1.716 billion in the suspension period, being three years from the date the Suspension
Order comes into effect, to include the period before it takes effect.
88. In addition, he estimates that other TikTok group entities, outside the EEA, will incur
additional personnel costs of US$3.105 billion. He describes these lost revenues and costs
as extremely significant. He also describes the estimates as conservative insofar as they do
not take account of other likely losses such as impacts on company/market valuation, and
impacts on goodwill/brand.
89. Jianye Ye, Head of Privacy and Security Engineering Department, TikTok Inc swore an
affidavit explaining the data controls and protections operated by TikTok, including a
detailed description of the measures put in place under Project Clover. He refers to the fact
that NCC Group has been appointed as a third-party cybersecurity and privacy engineering
provider to review, validate and monitor the protections and assure their continued efficacy.
TikTok’s position is that the measures which it has put in place provide equivalent protection
to that available within the EEA and that the DPC misunderstood, made errors, or
inadequately assessed the measures TikTok has put in place when making the Suspension
Order. This, of course, is disputed by the DPC.
32
90. An affidavit, exhibiting his report, was also filed by Stephen Bailey, Global Director of
Privacy at NCC Group, which has been appointed to provide oversight of TikTok’s data
controls and protections, which explains the Project Clover controls and NCC’s oversight
role. In particular, he describes how the process of pseudonymisation works to prevent
attribution of data to an EEA user.
91. In addition, Professor Stefan Schiffner, Professor of IT Security and Computer
Networks at Berufliche Hochschule Hamburg, prepared a report, also verified in an
affidavit, in which he concludes that the method for testing of the effectiveness of the
pseudonymisation by NCC was appropriate and in line with industry good practice.
92. The DPC’s principal replying affidavit was sworn by Cian O’Brien, Deputy
Commissioner in the DPC. His affidavit commenced with some preliminary observations,
including that the DPC disputed the second applicant’s standing in these proceedings, a point
which does not need to be addressed for the purpose of this application. He also observed
that TikTok had not set out the jurisdictional basis for this application, an objection not
pursued at the hearing during which the DPC expressly accepted that the court has
jurisdiction to grant a stay, a proposition which could hardly be doubted in light of the
relevant case law.
93. The affidavit then helpfully sets out the DPC’s position in opposing the stay: that the
application should be determined by the test in Zuckerfabrik, that the very large number of
TikTok users whose data was potentially affected was relevant in considering the stay, and
that the fundamental rights of those users in relation to their personal data required a high
level of protection.
94. It noted the duty on a data controller when transferring personal data to a third country.
It noted various acknowledgements by TikTok, including that personal data was being
transferred to and being processed in China, its acceptance that Chinese law did not offer an
equivalent level of protection to that in the EU, and that an equivalent level of protection
33
could not be achieved by use of standard contractual clauses (SCCs) alone, since they are
not binding on the Chinese authorities.
95. The affidavit explained that a critical aspect of TikTok’s case related to its interpretation
of Chinese law and, in particular, the territoriality principle which TikTok claimed meant
that Chinese authorities could not compel access to data stored outside China, but
temporarily accessible within China. Mr O’Brien referred to affidavits of Professor
Dongsheng Zang, Professor of Law at the University of Washington School of Law, Seattle,
and of Dr Paul Hunton, an independent consultant specialising in digital and cyber security,
which disputed TikTok’s interpretation of how the territoriality principle would apply in this
instance.
96. It should be noted that TikTok objected to the admissibility of these affidavits in
circumstances where the DPC had not relied on any evidence from Professor Zang or Dr
Hunton during the course of the inquiry and had, in fact, expressly taken TikTok’s evidence
on Chinese law “at its height”.
97. Mr O’Brien noted that TikTok had not submitted any updated DTA since the one
submitted during the course of the inquiry in July 2024.
98. He noted that it was the DPC’s position that it was required to suspend the transfer of
data in light of its finding that an equivalent level of protection was not assured. He
described the Suspension Order here as “carefully formulated and nuanced”, allowing for
re-consideration in light of new measures and noted that TikTok had had two years to
prepare for it, since the publication of the PDD.
99. Finally, Mr O’Brien highlighted the recent disclosure by TikTok that some personal
data had, in error, been stored on TikTok’s servers in China, in the circumstances described
above.
100. The affidavit highlights the duties on a data controller and the connection between those
duties and the protection of fundamental rights, while acknowledging that these are
34
principally matters for submission. Mr O’Brien describes the history of the inquiry, rejecting
any apparent suggestion by TikTok that the DPC had delayed or been dilatory in the progress
of the inquiry.
101. Mr O’Brien addresses TikTok’s reliance on Project Clover. He says that Project Clover
was “carefully considered” in the Decision.
102. Mr O’Brien then makes some observation on TikTok’s appeal, contesting the merits of
the appeal, before considering the application for a stay. In relation to the stay, the affidavit
asserts that the damage alleged to be suffered by TikTok is purely pecuniary which cannot
constitute serious and irreparable harm save in exceptional circumstances. In relation to the
financial harm which may potentially be suffered by TikTok, he refers to the affidavit of
Kieran Wallace, Managing Partner of Interpath (Ireland) Limited and its Global Head of
Restructuring, which contends that even on the applicant’s case the damage suffered could
not be regarded as serious and irreparable. Mr Wallace also challenges the nature of the
exercise conducted by Paul Jacobs in calculating potential losses.
103. Mr O’Brien then sets out the DPC’s position that, even if serious and irreparable harm
had been established, a stay would be inconsistent with EU law. He notes that the precise
nature and scale of the risks to EEA users is unknown, referring to various aspects of the
Decision.
104. Anu Talus, Chairperson of the EDPB, also swore an affidavit in support of the DPC’s
position opposing the stay. She does not state on whose behalf she has sworn the affidavit:
she does not, in particular, state that she makes the affidavit on the EDPB’s behalf. She
describes the consistency mechanism at Article 60 of the GDPR. Much of her affidavit is a
statement of the legal position, or legal submission, and not, therefore, admissible evidence.
105. She refers to the receipt by the SACs of the draft decision. She says that “all of the
[SACs] accepted, without objection, the infringement findings made by the DPC…. They
also endorsed the corrective measures proposed by the DPC.” During the hearing, counsel
35
clarified that Ms Talus meant that the SACs had “endorsed” the corrective measures by not
submitting reasoned objections to them.
106. She then sets out her views as to why the stay should be refused. These mirror, to a
large extent, what is said in Mr O’Brien’s affidavit.
107. The additional affidavits filed by the DPC have been referred to above.
108. Dr Paul Hunton swore an affidavit, exhibiting his report,, within which he addresses
specific questions posed of him by the DPC. In effect, he was asked by the DPC whether, in
light of the DTA and Jiang Ye’s affidavit evidence, data transferred to China temporarily –
by being remotely accessed there – could be accessed and processed in China. TikTok object
to the admissibility of this affidavit (and that of Professor Dongsheng Zang) on the basis
that it was not evidence before the DPC when it made its decision.
109. Dr Hunton contends in his report that TikTok have not provided enough detailed
information to enable him to assess the risks. He highlights the risks of persons gaining
malicious or unauthorised access to a device connected to TikTok’s operation network in
China, although this had not formed any part of the DPC’s consideration in arriving at the
Decision. He notes that he cannot rule out the risks from Chinese state-actors, which are the
risks with which the DPC was concerned.
110. Professor Zang concluded in his report, which was exhibited to his affidavit, that he
disagrees with the TikTok’s position in relation to Chinese law and the territoriality principle
and that “[n]either the territoriality principle, nor the concept of “overseas data” as
contended for by TikTok Ireland, prevents the exercise by public authorities of their statutory
powers to procure (or compel) access to the data in the way that it is claimed.”
111. Kieran Wallace’s affidavit and report review the evidence contained in the Jacobs
Report. Mr Wallace raises various issues regarding the robustness of the analysis, including
the fact that there has been no benchmarking of the data against others in the industry. He
36
also notes that even on TikTok’s figures, the extent of losses predicted, while “material” are
unlikely to pose a threat to the Group’s financial stability or disrupt its ongoing operations.
112. TikTok filed further affidavits in reply.
113. In summary, Ms Huang provided a further affidavit in which she contested the DPC’s
position that TikTok’s loss would be purely pecuniary. She contends that the changes to
TikTok’s workforce if the Suspension Solution is implemented would result in the loss of
valuable skill and knowledge, which will have a negative impact on its employees and their
families, including those who may be made redundant. She again describes the difficulty
“or impossibility” of reversing changes made. She also rejects an apparent suggestion in the
DPC’s affidavits that the Suspension Solution may not be the least costly means by which
TikTok can implement the Suspension Order. As counsel put it, TikTok is motivated to find
the least expensive and least disruptive means of meeting the requirements of the
Suspension Order.
114. Jianye Ye and Stephen Bailey both swore further affidavits in response to Dr Hunton,
disputing the validity of his conclusions. Mr Bailey’s affidavit (in fact, the further report he
exhibits) also addresses some of the hypothetical scenarios postulated by Professor Zang in
his report and concludes that identification of users would not be possible in the scenarios
identified by Professor Zang.
115. Professor Pietzuch also swore a further affidavit exhibiting a second report in which he
disputes Dr Hunton’s criticisms of the level of detail contained in the documentation
supplied by TikTok, confirming that in his view the information provided is in line with
industry best practice. He also addresses Mr Wallace’s criticism that Mr Jacobs’ financial
assessment had not been bench-marked. He says that he is not aware of any instance where
the restriction on access to data required by the Decision has occurred and, in those
circumstances, expressed the view that benchmarking data is unlikely to exist. Mr Jacobs
and Mr Xu also prepared reports and affidavits in response to Mr Wallace and Mr O’Brien
in which they stand over their initial assessments.
37
116. TikTok also rely on two affidavits from Chinese law experts Professor Ke Xu, and Yi
Zhang, Partner of Fangda Partners, Shanghai, both of whom had provided advice relied on
by TikTok during the Inquiry. Both dispute Professor Zang’s interpretation of Chinese law
as it applies to the data the subject of the Decision.
117. The only further reply filed by the DPC was an affidavit from Professor Zang exhibiting
a second report in which he concludes that the reports of Professor Xu and Mr Zhang did
not cause him to change his opinion.
118. The final volley of affidavits from TikTok consisted of two further affidavits exhibiting
further reports from Professor Xu and Mr Zhang. Unsurprisingly, they continue to dispute
Professor Zang’s interpretation of Chinese law insofar as it applies to these proceedings.
119. The foregoing sets out the factual and legislative background against which to consider
TikTok’s application for a stay. It will be necessary to consider the admissibility of various
of the affidavits, and the relevance of the recent disclosure regarding personal data being
stored in China, before applying the relevant test. Before doing any of that, it is necessary
to determine what the relevant test is.
Case law on threshold applicable
i. Union law
120. There was some suggestion in the DPC’s affidavits and legal submissions that the court
may have no jurisdiction to grant interim measures in cases concerning cross-border transfer
of data in breach of the GDPR. In particular, it was suggested, by reference to the following
conclusion in Schrems II, that the transfer of data must be suspended:
112. Although the supervisory authority must determine which action is appropriate
and necessary and take into consideration all the circumstances of the transfer of
38
personal data in question in that determination, the supervisory authority is
nevertheless required to execute its responsibility for ensuring that the GDPR is fully
enforced with all due diligence.
113. In that regard, as the Advocate General also stated in point 148 of his Opinion,
the supervisory authority is required, under Article 58(2)(f) and (j) of that regulation,
to suspend or prohibit a transfer of personal data to a third country if, in its view, in the
light of all the circumstances of that transfer, the standard data protection clauses are
not or cannot be complied with in that third country and the protection of the data
transferred that is required by EU law cannot be ensured by other means, where the
controller or a processor has not itself suspended or put an end to the transfer.
121. These observations are, of course, addressed to a supervisory authority which has
carried out an investigation and reached conclusions that data transferred to a third country
is not subject to an equivalent level of protection, rather than to a court dealing with an
application for interim measures. At the hearing, the DPC made clear that it accepted that
there was a jurisdiction to grant interim measures, in this case a stay, but it argued that the
relevant threshold was that applied in joined Cases C-143/88 and C-92/89, Zuckerfabrik
Suderdithmarschen v Hauptzollamt Itzehoe and Zuckerfabrik Soest GmbH v Hauptzollamt
Paderborn (“Zuckerfabrik”) and not that set out in Okunade v Minister for Justice [2003] 3
IR 153, [2002] IESC 49, the latter being the relevant ‘national procedural law’ in this
context.
122. The Zuckerfabrik proceedings concerned a preliminary reference in proceedings
challenging the imposition of a levy by the Italian authorities on the basis of a special
elimination levy on sugar introduced by a European Community (EC) Regulation. In the
proceedings, Zuckerfabrik challenged the national authorities’ decision to impose the levy
on the basis that the EC Regulation was invalid. There was thus a direct challenge to an EC
measure, which could only be determined by the Court of Justice.
39
123. The Italian court referred questions on the validity of the Regulation – as it was required
to do – but also referred questions on the jurisdiction to suspend the implementation of the
national measure, and the conditions under which the national court may so suspend.
124. The court made clear that the national courts must have a jurisdiction to suspend:
16. It should first be emphasized that the provisions of the second paragraph of
Article 189 of the Treaty cannot constitute an obstacle to the legal protection which
Community law confers on individuals. In cases where national authorities are
responsible for the administrative implementation of Community regulations, the legal
protection guaranteed by Community law includes the right of individuals to challenge,
as a preliminary issue, the legality of such regulations before national courts and to
induce those courts to refer questions to the Court of Justice for a preliminary ruling.
17. That right would be compromised if, pending delivery of a judgment of the
Court, which alone has jurisdiction to declare that a Community regulation is invalid
(see judgment in Case 314/85 Foto-Frost v Hauptzollamt Luebeck-Ost [1987] ECR
4199, at paragraph 20), individuals were not in a position, where certain conditions
are satisfied, to obtain a decision granting suspension of enforcement which would
make it possible for the effects of the disputed regulation to be rendered for the time
being inoperative as regards them.
18. As the Court pointed out in its judgment in Foto-Frost, cited above, (at
paragraph 16), requests for preliminary rulings which seek to ascertain the validity of
a measure, like actions for annulment, constitute means for reviewing the legality of
acts of the Community institutions. In the context of actions for annulment, Article 185
of the EEC Treaty enables applicants to request suspension of the enforcement of the
contested act and empowers the Court to order such suspension. The coherence of the
system of interim legal protection therefore requires that national courts should also be
able to order suspension of enforcement of a national administrative measure based on
a Community regulation, the legality of which is contested.
40
…
20. The interim legal protection which Community law ensures for individuals
before national courts must remain the same, irrespective of whether they contest the
compatibility of national legal provisions with Community law or the validity of
secondary Community law, in view of the fact that the dispute in both cases is based on
Community law itself.”
125. The Court then considered that conditions which should apply to such a grant. Having
concluded that a suspension could only be granted where there was “serious doubt as to the
validity of the Community regulation” and any suspension must retain its interim character,
the court observed:
25. As regards the other conditions concerning the suspension of enforcement of
administrative measures, it must be observed that the rules of procedure of the courts
are determined by national law and that those conditions differ according to the
national law governing them, which may jeopardize the uniform application of
Community law.
26. Such uniform application is a fundamental requirement of the Community legal
order. It therefore follows that the suspension of enforcement of administrative
measures based on a Community regulation, whilst it is governed by national
procedural law, in particular as regards the making and examination of the application,
must in all the Member States be subject, at the very least, to conditions which are
uniform so far as the granting of such relief is concerned.
27. Since the power of national courts to grant such a suspension corresponds to
the jurisdiction reserved to the Court of Justice by Article 185 in the context of actions
brought under Article 173, those courts may grant such relief only on the conditions
41
which must be satisfied for the Court of Justice to allow an application to it for interim
measures.
28. In this regard, the Court has consistently held that measures suspending the
operation of a contested act may be granted only in the event of urgency, in other words,
if it is necessary for them to be adopted and to take effect before the decision on the
substance of a case, in order to avoid serious and irreparable damage to the party
seeking them.
29. With regard to the question of urgency, it should be pointed out that damage
invoked by the applicant must be liable to materialize before the Court of Justice has
been able to rule on the validity of the contested Community measure. With regard to
the nature of the damage, purely financial damage cannot, as the Court has held on
numerous occasions, be regarded in principle as irreparable. However, it is for the
national court hearing the application for interim relief to examine the circumstances
particular to the case before it. It must in this connection consider whether immediate
enforcement of the measure which is the subject of the application for interim relief
would be likely to result in irreversible damage to the applicant which could not be
made good if the Community act were to be declared invalid.
126. There is considerable case law of the CJEU regarding the application of this test to
which I will refer, as necessary, below.
127. Zuckerfabrik involved a preliminary reference in which a national measure was
challenged on the basis that the underlying EU measure on which the national measure was
based was invalid. In Case C-432/05, Unibet (London) Ltd v Justitiekanslern, the
proceedings concerned whether a national measure was consistent with EU law, i.e. there
was no challenge to any EU measure. The question was whether the same conditions applied
to the grant of interim measures in such circumstances. The Advocate General and the Court
42
both concluded that they did not, and that any such application should be decided in
accordance with national procedural rules in accordance with the principle of procedural
autonomy.
128. In her opinion, the Advocate General observed:
“93. It is true that in Zuckerfabrik and Atlanta the Court laid down Community law
conditions for the grant of interim relief by national courts, including the suspension of
a national measure based on a Community measure. Those cases concerned the alleged
invalidity of the underlying Community legislation. In such cases, of course, only the
Court has jurisdiction to declare the Community measure invalid. In such a context
there is a clear Community interest in having uniform strict criteria. In contrast, the
present case is concerned with the validity of a national measure which by definition
applies in only one Member State. In such a case, I see no reason to depart from the
general rule of procedural autonomy. Indeed it would seem more logical for the
procedure governing interim suspension of a national law on grounds of alleged
incompatibility with Community law to be the same as that governing interim
suspension of a national law on other, purely domestic, grounds (in application of the
principle of equivalence), provided always that the principle of effectiveness is also
satisfied.
94. Moreover in Zuckerfabrik the Court observed that the power of the national
courts to grant the suspension of a Community measure corresponds to the jurisdiction
reserved to the Court of Justice by Article 242 EC. It accordingly ruled that the national
courts could grant such relief only on the same conditions as must be satisfied for the
Court of Justice to grant an application for interim measures. That approach ensures
consistency in the rules governing the grant of interim relief, irrespective of whether a
challenge is brought under Article 230 or by way of Article 234 EC. In the present case,
in contrast, there is no such analogy with the jurisdiction of the Court. As the United
Kingdom submits, the closest parallel lies in the power of the courts of the Member
43
States to determine substantive questions of incompatibility. There, procedure is
governed by national rules, subject to the principles of equivalence and effectiveness.
95. I do of course bear in mind that the Court stated in Zuckerfabrik that the
“interim legal protection which Community law ensures for individuals before national
courts must remain the same, irrespective of whether they contest the compatibility of
national legal provisions with Community law or the validity of secondary Community
law, in view of the fact that the dispute in both cases is based on Community law
itself”. That dictum does not, in my view, decide the issue raised by the third question
in the present case. In Zuckerfabrik, the issue before the Court was whether interim
relief – which, in accordance with Factortame I, a national court must be able to grant
pending a ruling by the Court on the question of compatibility – should be available
where the validity of a Community regulation underlying a national measure was being
challenged. The Court was not however asked to determine the criteria for the grant of
interim relief by a national court in proceedings concerning a national measure
allegedly incompatible with Community law.”
129. The Court agreed:
79. It is clear from established case-law that the suspension of enforcement of a
national provision based on a Community regulation in proceedings pending before a
national court, whilst it is governed by national procedural law, is in all Member States
subject to conditions which are uniform and analagous with the conditions for an
application for interim relief brought before the Community Court (Joined Cases C-
143/88 and C-92/89 Zuckerfabrik Süderdithmarschen and Zuckerfabrik Soest [1991]
ECR I-415, paragraphs 26 and 27; Case C-465/93 Atlanta
Fruchthandelsgesellschaft [1995] ECR I-3761, paragraph 39; and Joined Cases C-
453/03, C-11/04, C-12/04 and C-194/04 ABNA and Others [2005] ECR I-10423,
paragraph 104). However, the case in the main proceedings is different from those
giving rise to those judgments in that Unibet’s application for interim relief does not
44
seek to suspend the effects of a national provision adopted in accordance with a
Community regulation where the legality of that regulation is contested, but rather the
effects of national legislation where the compatibility of that legislation with
Community law is contested.
80. Therefore, in the absence of Community rules governing the matter, it is for the
domestic legal system of each Member State to determine the conditions under which
interim relief is to be granted for safeguarding an individual’s rights under Community
law.”
ii. National law
130. In Dowling v Minister for Finance [2013] 4 IR 576, the Supreme Court confirmed that
the domestic law test for the grant of an injunction (or stay), as set out in Okunade, satisfied
the requirements of equivalence and effectiveness. The Court observed as follows in relation
to Unibet (at p. 617):
“86. Equally, it is clear from Unibet (London) Ltd. and Unibet (International) Ltd.
v. Justitiekanslern (Case C-432/05)[2007] E.C.R. I-2271 that, where there is a
challenge to a national measure, national procedural rules are to apply subject to the
principles of equivalence and effectiveness. It follows that it is possible that different
results might arise in different member states, in the event of a challenge to similar
national measures, because of the applicability of different procedural regimes,
provided always that each such regime must provide an effective remedy.”
131. The test in Okunade has been applied consistently by the Irish courts to decisions giving
effect to EU law, including in recent decision in Aer Lingus Limited v Irish Aviation
Authority and Ors [2024] IEHC 625, a case in which there was also a debate about which
test applied. However, the decision in Eircom v Commission for Communications
45
Regulation [2022] IEHC 165 suggests that cases where the Zuckerfabrik test applies to the
grant of interim measures are not confined to challenges to EU measures. In that case, the
High Court (MacDonald J) concluded that the appropriate test for the grant of a stay in the
context of an appeal under the European Communities (Electronic Communications
Networks and Services) (Framework) Regulations 2011 (“the Framework Regulations”)
was that set out in Zuckerfabrik. He did so, having regard to the fact that the Framework
Regulations give effect to Directive 2001/02/EC (“the Framework Directive”) and he
interpreted the Directive as requiring harmonisation of the test for interim measures.
132. The Zuckerfabrik test was also applied in an application for a stay in an appeal under
the Framework Regulations in Three Ireland (Hutchison) Limited v Commission for
Communications Regulation [2022] IECA 300. In the High Court, the applicant accepted
that that was the appropriate test, but sought to argue otherwise in the Court of Appeal. The
Court concluded that it was impermissible to argue for a different test in the Court of Appeal
having accepted that Zuckerfabrik was the test in the High Court. The court (Collins J)
nonetheless made the following observations, which both parties in these proceedings
accepted were clearly obiter:
“95. If it had been open to Three to advance that argument, and in the event that it
appeared that the outcome of the appeal might turn on the issue of the
applicable test, the Court might have had to give consideration to making a
reference to the CJEU pursuant to Article 267 TFEU. So far as the researches
of the parties could ascertain, this aspect of Article 4(1) of the Framework
Directive (now Article 31(1) of the Recast Directive) has never been considered
by the Court of Justice. There can be little doubt that, as the Judge concluded
in Eircom and as Counsel for Three accepted in argument here, the language of
the relevant recitals appears clearly to point to the application of the
Zuckerfabrik test. But recitals are not operative legislative provisions. Recitals
may, of course, be relied on to resolve ambiguity in related legislative
provisions. However, a notable feature of the relevant legislative provision here
46
is that it expressly refers to the granting of interim measures “in accordance
with national law” (my emphasis). That language was introduced by the Better
Regulation Directive and has been retained in the Recast Directive. On their
face, the recitals and the operative legislative provision appear to be in tension
and there may be scope for argument that the recitals must yield to the terms of
Article 4(1) in those circumstances. There are, of course, other factors to be
considered also in this context, including the legal basis of the functions being
carried out by ComReg and in particular the legal and regulatory rules for the
spectrum allocation function being exercised here (the ultimate source of which
is, according to Three, the Framework Directive). The fact that Three’s right of
appeal, and its entitlement to seek a stay on ComReg’s Decision, ultimately
derive from EU legislation are also very relevant considerations in this context.
All these considerations might appear to indicate that the position here is closer
to Zuckerfabrik than to Okunade or Dowling (or Unibet).
96. With becoming frankness, Mr Kennelly argues that it should be easier to obtain
interim relief when one is challenging a domestic measure and not impugning
an EU measure. But that argument begs the question as to the appropriate
characterisation of the impugned measure here. It seems wholly implausible to
suggest that the Decision, made by the Irish NRA within a regulatory framework
governed by EU law, can properly be characterised as a purely domestic law
measure, such as was at issue in Dowling. Any such suggestion appears wholly
at odds with Three’s acknowledgment that the ultimate source of ComReg’s
decision-making competence here was the Framework Directive and that any
claim for damages that Three might seek to make against ComReg in connection
with the functions at issue is governed by Francovich principles. If the
availability of a restrictive claim for non-contractual damages against the EU
under the Treaties is, in general, an answer to an application for interim
measures against the EU, why as a matter of principle should not the
47
availability of a similar claim not be an answer to an application for interim
measures against a national body exercising EU law functions?
133. The reference to Francovich principles is of some significance. The CJEU has made
clear that wholly financial loss can rarely meet the threshold of irreparable harm because of
the availability of Francovich damages in the event that an EU measure is found to be
unlawful. In Dowling, the Supreme Court noted similarities between the Zuckerfabrik and
Okunade thresholds, regarding the adequacy of damages. As Collins J observed (at [87]) in
Three Ireland, the court did not, however, advert to the fact that, when applying
Zuckerfabrik, “financial loss might be regarded as reparable even though the prospect of
actually recovering monetary compensation was limited by reason of the restrictive rules
governing the non-contractual liability of the Union and its institutions…” since the
evidence in Dowling was that full reparation would be made.
134. The Court of Appeal made clear, in public procurement proceedings, that the difficulties
in recovering Francovich damages is relevant when considering the adequacy of damages
as a remedy. In Word Perfect Translation Services Limited v Minister for Public Expenditure
and Reform [2018] IECA 35, a public procurement case, Hogan J considered that, in those
proceedings, damages could not be regarded as an adequate remedy for the purpose of the
test in Okunade:
“58. It would have to be accepted, therefore, that a claimant such as Word Perfect
would not find recovery of damages straightforward, even if, following a full
hearing, a material breach of the procurement rules were actually to be
established.
59. What implications does this conclusion have insofar as the present case is
concerned? As the Supreme Court stressed in Okunade v. Minister for Justice
[2002] IESC 49, [2003] 3 I.R. 153, the task of the Court in the context of an
interlocutory application such as this is to assess the facts and apply legal
48
principles designed to ensure the minimum possible injustice to the parties
pending the outcome of the main action. If, however, the ability of Word Perfect
to recover damages is highly restrained this clearly impacts on the manner in
which these factors should be weighed and balanced.”
iii. Other jurisdictions
135. TikTok also relies on the decision of the Administrative Court of Luxembourg in
Amazon Europe Core SARL v Commission Nationale pour La Protection des Données, Case
46630, dated 17 December 2021. In that case, the supervising authority in Luxembourg, the
CNPD, had issued a decision which required Amazon to take corrective measures. Amazon
appealed the decision and sought a stay on the corrective order pending determination of
that appeal on grounds similar to those advanced by TikTok in this case, i.e. it would
irreversibly impact on the company and adversely affect the experience of its users. The
court granted the stay in that case. It is clear from the court’s ruling that in so doing, it
decided the question of a stay by reference to national procedural law – there was no
reference to Zuckerfabrik.
136. It must be noted, however, that there does not appear to have been any discussion
regarding the applicable threshold. A point not argued is a point not decided. Moreover, the
applicable national procedural law in that case had, in any event, some similarity to the
Zuckerfabrik test. In the absence of any evidence regarding Luxembourg law, this is merely
an observation, rather than a conclusion. The case is thus of interest, but hardly
determinative.
Arguments
137. In brief terms, TikTok argues that in the absence of harmonisation, the applicable
threshold for the grant of an interim remedy is a matter for the national courts, to be
49
determined in accordance with national law. It argues that this is the default position, and it
is only where the measure being impugned is an EU measure, that is, a decision of an EU
body, that the case law of the CJEU indicates that the same minimum standards must apply
across the EU.
138. It contends that the decision impugned here is a national law measure. It is a decision
of the DPC, a body established by Irish law. Its status as a national law measure is not
affected by the fact that before the Decision was made, the DPC was required to consult
with other SACs in accordance with Article 60, or by the fact that the DPC could not have
finalised the decision in the event of a reasoned objection by any SAC without reaching
agreement on that reasoned objection, or a referral of any dispute to the EDPB.
139. TikTok contends that its argument that the criteria for a stay on a decision of a
supervising authority is governed by national procedural law is supported by the wording of
the GDPR and by the case law discussed above.
140. The DPC argues that its decision cannot be regarded simply as a national law measure,
and characterise a decision of a supervising authority following the Article 60 co-operation
procedure as a decision adopted or agreed by all supervising authorities, a characterisation
it argues is supported by the wording of the GDPR, referring, in particular, to Recital 126,
which refers to decisions being “agreed jointly”, and by the case law. It places significant
emphasis on its contention that a decision made following the completion of the Article 60
procedure is a decision “with binding effect in all Member States”. It argues that the crucial
consideration in deciding whether an application to stay a decision made under the GDPR
is governed by national procedural law or whether it must be determined by reference to the
same standard as a challenge to an EU law measure is the effect of the decision. Given that
decisions of a supervising authority can have binding effect across the EU, similar to an EU
law measure, they should be subjected to the same standard.
141. It argues that a requirement that an application for a stay be determined by reference to
the criteria required when seeking a stay on an EU measure does not involve a disapplication
50
of national procedural law, or a departure from, what it accepts is, the default position that
in the absence of harmonisation, national procedural rules apply. In this regard, it draws a
comparison with the requirement for a uniform approach in relation to damages per Cases
C-6/90 and C-9/90, Francovich v Italian Republic.
142. The DPC points to the inconsistencies which might arise were such applications
governed by national procedural law in each jurisdiction. It refers to the decisions in Case
C-132/31, BE in which the court emphasised that member states must ensure that their
procedural rules ensure a consistent and homogenous application of the GDPR. It also refers
to Case C-645/19, Facebook Ireland Limited, in which the court suggested that ineffective
application of the GDPR by supervising authorities could result in “forum shopping”.
Discussion on applicable threshold
143. The DPC argues convincingly that a decision of a supervising authority made in
accordance with Article 60 of the GDPR cannot simply be characterised as a national law
rather than an EU law measure. This echoes the observation of Collins J in Three Ireland
that it was “wholly implausible” to describe a decision under the Framework Regulation as
a “purely domestic law measure”.
144. By the same token, the DPC appears to accept that such a decision cannot be
characterised as an EU law measure, or as a decision of an EU body. If this were not in any
event obvious, it is made abundantly clear by the GDPR itself, which expressly establishes
the EDPB as a Union body, but makes no such provision in relation to supervising
authorities.
145. The decision-making procedure created by the GDPR appears to be novel; neither of
the parties were able to identify an analogous process, or at least not one which had been
the subject of consideration by the courts in the context of an application for interim
measures. In those circumstances, the identification of whether this application is governed
51
by national procedural law or by the criteria governing an application to stay an EU measure
cannot solely be resolved by reference to the distinctions drawn in Zuckerfabrik or Unibet.
Rather, the answer must be found in the terms of the GDPR itself, and then a consideration
of how the principles identified in the case law can be applied to this novel process.
146. The DPC lay emphasis on the repeated references in the recitals to the GDPR to the
co-operative nature of the decision-making under the Article 60 procedure, to the
requirement for agreement before a decision can be reached, and the binding nature of the
decision. It refers to the decision in Case C-645/19, Facebook, and the emphasis by the
Advocate General on the “one stop shop” decision-making process and the necessity for
agreement and consensus.
147. It must first be observed that in describing the process in Facebook, the court was not
at all concerned with the question at issue here, the applicable test for interim measures, but
was rather considering the question of whether a supervising authority could bring
proceedings in relation to an infringement of the GDPR in relation to cross-border
processing if it was not the lead supervising authority in respect of that processing.
148. Second, the DPC may have somewhat overstated the binding effect of decisions of a
supervising authority. As appears from Article 60(6), a decision of a supervising authority
is only binding on the supervising authorities concerned, as defined in Article 4(22) of the
GDPR. However, it is clear that where, as here, the transfers in issue are occurring across
the EEA, the Decision will have binding effect on most, if not all, supervising authorities.
149. Of greater significance, perhaps, is what ‘binding’ means in this context. A national law
measure will be binding on the party to whom it is directed. Where the State has jurisdiction
to regulate the activities of a data controller whose main establishment is in the State, the
fact that a decision binds that data controller within the EU does not appear to me to be a
sufficient point of distinction from any other decision by a national regulator made pursuant
to EU law to warrant the disapplication of national procedural autonomy in proceedings
before a national court.
52
150. What is novel about the GDPR regime – other than the consistency mechanism itself –
is that the decision binds other supervising authorities concerned. But this must, I think, be
understood as a manifestation of the ‘one-stop shop’ regime, which was described as the
purpose of the consistency mechanism in the GDPR in Case C-645/19, Facebook. There is
no suggestion, for instance, and the DPC did not contend, that decisions of a lead supervising
authority are binding as to the interpretation of the GDPR. They plainly are not, and could
not be, that.
151. The binding nature of decisions do not, therefore, reflect an attempt to elevate decisions
of lead supervising authorities to quasi-EU law measures. Rather, the purpose is to ensure
the integrity of the one-stop shop mechanism and enable data subjects and data controllers
to deal with a single supervising authority in respect of any given issue (save in the
circumstances provided for in Article 58(5) of the GDPR).
152. It is true that the GDPR emphasises the necessity for co-operation and that decisions
cannot be finalised without consensus between lead supervising authorities and the
supervising authorities concerned (or a ruling from the EDPB) and that has some
significance in consideration of the threshold applicable. Of far greater significance, in my
view, are two factors.
153. Firstly, the GDPR clearly provides that a decision of a supervising authority is a
decision of that body, carrying with it the important legal consequence that a challenge to
that decision must be brought in the court’s of the member state in which that supervising
authority is established. There is no suggestion, for instance, that it should be regarded as
the decision of all supervising authorities, or even all supervising authorities concerned,
such that it becomes possible to challenge a decision in the courts where any other
supervising authority is established.
154. In fact, as the DPC highlighted during its submissions, Article 60(9) of the GDPR
provides for split decisions, where parts of a complaint are upheld and parts rejected. In
53
such cases, the lead supervising authority adopts the part of the decision upholding the
complaint, whereas the supervising authority in which the complaint was made adopts the
part of the decision rejecting the complaint. This procedure is reflected in section 114 of the
2018 Act, requiring the DPC to adopt decisions of lead supervising authorities dismissing
complaints where the DPC is the supervising authorities. This facilitates complainants in
bringing proceedings in their own member state. The implication of this provision is not that
decisions made pursuant to Article 60 should be regarded as joint decisions, but rather that
the GDPR attaches importance to identifying by who a decision is made, and the
consequences thereof.
155. Secondly, and perhaps decisively, the GDPR, unlike the Framework Directive (where
there were conflicting provisions) makes no provision for harmonisation of procedural rules
for challenges to decisions made under the Regulation, something the legislature could
clearly have done had it so wished. Recital 143 of the Regulation expressly provides that
“proceedings should be conducted in accordance with that Member State’s procedural law”.
This, as the DPC accepts, is the default position and there is nothing in the provisions of the
GDPR which suggest that the default position is displaced. Quite the contrary, the conferring
of jurisdictions on national courts and the express invocation of national procedural law
strongly indicate otherwise and must be regarded as a deliberate choice by the legislature.
It is true that the GDPR seeks to ensure consistency in decision making by supervisory
authorities, by requiring that they co-operate with each other. By contrast, however, it
confers jurisdiction on national courts to provide effective remedies in relation to such
decisions, with no reference to co-operation or harmonisation. If, as the DPC in effect
contends, the GDPR does require harmonisation, at least in relation to applications for
interim measures, this is a surprising omission.
156. If national procedural law applies, an apparent anomaly could be said to arise insofar
as some decisions of supervising authorities may be made without reference to the EDPB,
but others may require that the EDPB issue a ruling in the event of a dispute, which ruling
will be binding on the lead supervising authority. Although there was no intervention by the
EDPB in this case, it seemed to me, and the parties accepted, that the question of the
54
applicable threshold could not turn on whether or not the dispute resolution mechanism had,
in fact, been engaged (or on how many SACs there were). The fact that it was capable of
being engaged is what is relevant.
157. Since the EDPB is an EU body, established under the GDPR, it seems that the
Zuckerfabrik criteria would likely apply if there were a challenge to a decision of that body.
Although the question of whether it is permissible to challenge a decision of the EDPB under
the consistency mechanism at all is the subject of the pending WhatsApp proceedings, and
it may be that if the view of the General Court prevails, no anomaly arises, even if the
Advocate General’s view is adopted by the court, it seems to me that this complexity is one
recognised by the GDPR itself and does not affect the determination of whether the GDPR
requires harmonisation of procedural rules in relation to interim applications.
158. In fact, any anomaly is more apparent than real. If a lead supervising authority adopts
a decision on the basis of a EDPB ruling pursuant to the consistency mechanism, any
challenge to that decision must still be brought in the courts of the member state of that lead
supervising authority. However, those courts are obliged to refer any question as to the
lawfulness of the EDPB ruling to the CJEU, and will thus not decide on that application. If,
as appears to be the case, the national court is required to apply the Zuckerfabrik criteria
when considering an application for interim measures in such a case, this reflects the fact
that that the legal issues arising in the challenge are ones which must be determined by the
CJEU and not the national court. The application of different criteria in such a case to one
which can be decided by the national court is, therefore, unsurprising and reflects the
distinction drawn in Unibet.
159. This is expressly reflected in Recital 143, which acknowledges the consequence of
conferring jurisdiction on national courts to determine challenges to decisions of supervising
authorities. It provides that where the validity of a decision of the EDPB is at issue in such
a challenge, a national court must refer that question to the CJEU for determination. In
circumstances where the GDPR expressly recognised that the validity of decisions of
supervising authorities and of the EDPB must be determined in different fora, there is
55
nothing anomalous about different criteria applying in relation to decisions the validity of
which must be challenged before national courts, and those the validity of which must be
challenged before the CJEU. The DPC argue that it would be “perverse, or at least illogical”
if the more restrictive Zuckerfabrik criteria applied in the case of disagreement, but the more
permissive Okunade principles applied where there was none. That is, of course, to ignore
the fact that, in the former scenario, any dispute would have been resolved by an EU body,
the EDPB.
160. In response to the clear statement in Recital 143 regarding national procedural law, the
DPC inventively sought to argue that the application of the Zuckerfabrik criteria would not,
in fact, involve a disapplication of national procedural rules at all, but rather, would impose
a requirement that national procedural rules meet certain minimum thresholds. This is
difficult to accept. Of course, national procedural rules must respect the principles of
equivalence and effectiveness, as the Supreme Court has determined the Okunade test does
in Dowling, but it would be a curious form of autonomy which required that different criteria
apply even where the procedural rules satisfy those requirements. Moreover, all of the
relevant case law is based on the proposition that either national procedural rules apply or
the Zuckerfabrik criteria apply. This reflects the reality; if a national court were required to
apply the Zuckerfabrik criteria to a stay application, this would involve a departure from
procedural autonomy, insofar as those criteria differ from those applicable to stay
applications in that jurisdiction.
161. The DPC suggested that its interpretation of the Zuckerfabrik criteria, in effect, as a
graft on to national procedural rules such that procedural autonomy was respected, is what
occurred in Francovich. I do not think that this is correct. Francovich identified a
substantive obligation on member states to make good loss and damage caused by a breach
of EU law. However, it clearly provided that it was for the “internal legal order” of the
member states to lay down the procedural rules for safeguarding that right (see [42]).
56
162. The GDPR, therefore, has not harmonised, and does not require the harmonisation of,
national procedural rules. In light of Recital 143, and Article 78 of the Regulation, this can
only be understood as a deliberate legislative choice.
163. In circumstances where interpretation of the GDPR strongly suggests that national
procedural autonomy should apply to applications for a stay on decisions of supervisory
authorities, is there anything in the case law of the CJEU or the national courts which
suggests to the contrary? In my view, there is not.
164. The DPC place significant emphasis on the possibility of divergent or conflicting
decisions should each jurisdiction apply its national procedural rules when hearing
challenges to decisions under the GDPR. That, of course, is an argument which proves too
much. If procedural autonomy is to be permitted at all in challenges to decisions giving
effect to EU law – which the DPC accepts is the default position – then the possibility of
divergence always arises and is an accepted part of the EU regime, as noted by the Supreme
Court in Dowling.
165. Moreover, the risk of conflicting decisions is virtually eliminated by the one-stop shop
mechanism created under the GDPR. There is no real possibility of a conflicting decision
arising on the issues the subject matter of the decision in these proceedings, whether due to
divergence in procedural rules or otherwise, because the decision of the DPC is binding on
the supervising authorities concerned.
166. Furthermore, what is at issue in this application are the procedural rules applicable to a
preliminary application, an application for a stay, not the substance of the proceedings and
not, therefore, the interpretation of the GDPR (other than as it relates to the procedure which
applies to this application). Thus, the real concern where there is a lack of harmonisation,
the possibility of differing interpretations or applications of EU law, does not arise. The
possible concern about forum shopping which was raised in Case C-645/19, Facebook, was
in the context of supervising authorities and the risk that data controllers might favour
jurisdictions in which supervising authorities failed to discharge their obligations under the
57
GDPR. The DPC did not direct me to any authority for the proposition that procedural
autonomy should be disapplied for this reason, nor is there any evidence to support the
underlying assumption in that argument, that the State’s procedural rules are, in this
instance, more permissive than those of other EU member states. The Supreme Court has
concluded in Dowling that the national law procedure in relation to the granting of interim
measures respects the principles of equivalence and effectiveness. It is difficult to accept,
therefore, the proposition that those rules should be disapplied or varied lest data controllers
select the states in which they establish by reference to the procedural rules which might
apply in the event that at some future point they are required to seek a stay on a decision of
a supervising authority.
167. Turning to the relevant case law, Zuckerfabrik and Unibet remain the two cases which
identify the demarcation point for the purposes of determining this question. In
Zuckerfabrik, the challenge was to a national law measure but on the basis of the invalidity
of an EU measure. The ratio of the Court’s decision was that the EU measure could have
been challenged by an annulment action and, although it was permissible to challenge the
EU measure in a preliminary reference, the same criteria had to apply to both types of
challenge. Thus, the national court had to apply the EU standard when considering an
application for a stay in the context of a preliminary reference.
168. No such consideration arises here. Pursuant to the GDPR, TikTok could not have
challenged the DPC’s decision in an annulment action. No one suggested otherwise. No
question of aligning the criteria for a challenge with those applicable to annulment actions
arises.
169. In these proceedings, not only is there no challenge to an EU measure, but a significant
part of the challenge is advanced on what might be regarded as purely domestic law grounds.
In particular, TikTok’s claims of breach of fair procedures appear referable not to provisions
of the GDPR but to domestic law requirements of natural and constitutional justice. The
DPC certainly did not suggest that TikTok was confined to complaints based on EU law. It
58
is certainly conceivable that a decision of the DPC could be successfully challenged on
purely domestic law grounds.
170. Although decisions of the DPC are capable of having EU-wide effect, that effect is
confined to the decision concerned and, in substance, the affected parties. There is, in truth,
nothing surprising about a decision having such an effective scope, nor does that scope
require that the procedural autonomy of the courts of a member state conferred with
jurisdiction be displaced.
171. Accordingly, this application falls to be considered in accordance with the principles
set out in Okunade. However, I will, for completeness, reference the Zuckerfabrik criteria
when carrying out my assessment.
Arguments
172. Rather than detail exhaustively the arguments of the parties, I propose to provide a
headline summary here and then address them in more detail in assessing the application of
the Okunade test.
173. In circumstances where the DPC submissions were directed in the main to the
Zuckerfabrik criteria, as were much of TikTok’s, it is worth comparing the two tests to see
how the Okunade principles “map” on to those in Zuckerfabrik.
174. Okunade involved judicial review proceedings, and a very different type of decision
than that at issue here, a deportation order. However, the DPC did not suggest that the
principles identified in Okunade would not apply with equal force in the context of a
statutory appeal: indeed, the decision the subject of these proceedings has also been
challenged in judicial review proceedings, and, as the DPC accepted, the stay could just as
easily have been sought in those proceedings.
59
175. In Okunade, the Court carried out a very detailed review of the principles which apply
to an application to stay an administrative decision or measure, including a consideration of
the analogous principles which apply in the case of an application for an interlocutory
injunction. Ultimately, the Court concluded (at p. 193):
“[104] As to the overall test I am of the view, therefore, that in considering whether to
grant a stay or an interlocutory injunction in the context of judicial review proceedings
the court should apply the following considerations:-
(a) the court should first determine whether the applicant has established an
arguable case; if not the application must be refused, but if so then;
(b) the court should consider where the greatest risk of injustice would lie. But
in doing so the court should:-
(i) give all appropriate weight to the orderly implementation of measures
which are prima facie valid;
(ii) give such weight as may be appropriate (if any) to any public interest
in the orderly operation of the particular scheme in which the measure
under challenge was made; and,
(iii) give appropriate weight (if any) to any additional factors arising on
the facts of the individual case which would heighten the risk to the
public interest of the specific measure under challenge not being
implemented pending resolution of the proceedings;
but also,
(iv) give all due weight to the consequences for the applicant of being
required to comply with the measure under challenge in circumstances
where that measure may be found to be unlawful.
(c) in addition the court should, in those limited cases where it may be relevant,
have regard to whether damages are available and would be an adequate
remedy and also whether damages could be an adequate remedy arising from
an undertaking as to damages; and,
60
(d) in addition, and subject to the issues arising on the judicial review not
involving detailed investigation of fact or complex questions of law, the court
can place all due weight on the strength or weakness of the applicant's case.”
176. The overriding consideration, once a serious issue to be tried has been established, is
how to ensure the least risk of injustice.
177. The Zuckerfabrik test is summarised by the DPC in its submissions (at [159]) in the
following way:
“An applicant must therefore:
(a) Establish “serious doubts” as to the validity of the EU measure (the “merits
test”);
(b) Establish urgency by demonstrating, as a matter of probability, that the
interim relief is necessary to avoid serious and irreparable damage prior to
the resolution of the proceedings (the “urgency test”); and
(c) Take account of the interests of the EU, and demonstrate that the urgency
identified outweighs those interests and any other interests arising (the
“European interests test”).” [Emphasis in original]
178. In very broad terms, the merits test seems to be “substantially the same” as the
requirement that there be a serious issue to be tried, as suggested by McDonald J in Eircom
(at [31]), the urgency test encompasses considerations which arise in considering the
adequacy of damages, and the European interests test requires a balancing exercise,
balancing the potential harm if a measure is implemented but ultimately determined to be
invalid, against the harm of delaying the implementation of a measure which is
presumptively valid, as does the least risk of injustice analysis. Accordingly, arguments
advanced by both parties by reference to the criteria in Zuckerfabrik, can be read across to
the application of the Okunade test.
61
179. As noted above, the DPC has accepted for the purpose of this application that TikTok
has raised serious doubts as to the validity of the Decision, i.e. has identified a serious issue
to be tried.
180. TikTok argues that if it is required to implement the Suspension Order pending
determination of its appeal, it will suffer serious and irremediable damage. It argues that
once it puts in place the Suspension Solution, that cannot readily be undone – or at least that
undoing the steps it proposes to take will be as disruptive as putting them in place in the first
instance. It argues that damages are not an adequate remedy for the damage it will suffer. In
this regard, it contends that its losses will not merely be financial, that any financial damage
it suffers will be exceptionally difficult to quantify, and that there is a serious question of
whether it could recover damages, whether on the basis of Francovich or otherwise. It relies,
in this last respect, on the decision of the Court of Appeal in Word Perfect Translation
Services. It notes that the DPC enjoys an immunity from suit pursuant to section 154 of the
2018 Act.
181. The DPC rejects the contention that damages are not an adequate remedy. It queries
the extent of the loss which TikTok claims it will suffer, but contends, in any event, that
TikTok’s purported loss is entirely financial. It argues that it is apparent from TikTok’s
evidence that any such loss will not threaten the viability of TikTok and, accordingly, the
evidence does not establish that this is one of the exceptional cases where the availability of
Francovich damages is not a full answer to a claim for interim measures.
182. In relation to the least risk of injustice, TikTok does not dispute that the court must give
all due weight to the Decision, but contends that in the particular circumstances of this case,
the balance falls in its favour. In this regard, it argues that having regard to the steps it has
put in place since the temporal scope of the Inquiry expired, there is no real risk that EEA
user data will be processed in China in breach of the GDPR and therefore, there is no
significant EU interest at stake which requires to be balanced against its undoubted interest
in not having to comply with the Decision pending the determination of its appeal. It places
reliance on the fact that the DPC has made a ‘negative’ finding, that TikTok has not satisfied
62
the requirement to show that an equivalent level of protection is available, rather than a
‘positive’ finding, that there is not, in fact, an equivalent level of protection. It also relies on
the fact that the finding of a breach of Article 46 is, in effect, historic, since the temporal
scope of the Inquiry was fixed as ending in May 2023, and cannot be relied on by the DPC
as evidence of a current risk in light of the significant changes made by TikTok, by its
implementation of Project Clover, since then.
183. The DPC argues that the EU interests in this case involve fundamental rights and
therefore must weigh very heavily against any delay in implementing the Decision. It
contends that TikTok is impermissibly inviting the court to look behind its decision when
contending that there is no real risk of a breach of the GDPR. It contends that it considered
in detail the Project Clover measures when making the Suspension Order, and accordingly,
it is impermissible for TikTok to rely on those measures now as ‘changed’ circumstances
since the making of that order. It notes that TikTok has not submitted a revised DTA since
July 2024.
184. Both parties agree that the court should not ordinarily consider the merits of the
underlying proceedings, but both, nonetheless made submissions on the merits. To be fair
to the DPC, its oral submissions on the merits were largely in response to those advanced
on behalf of TikTok who argued that its appeal on, in particular, fair procedures grounds is
“indisputable” (Transcript Day 1, p. 61).
Admissibility
185. Despite the objections to the admission of various affidavits, in particular, by the DPC,
the parties did not delay unduly in raising these objections, and so I will deal relatively
briefly with the issues here.
186. Mirroring TikTok’s objections to the admissibility of the affidavits from Ms Talus, Dr
Hunton and Professor Zang, and the evidence regarding the ‘OnCall’ platform, the DPC
63
objects to TikTok relying on evidence that there is, in fact, no risk of personal data breaches
in the circumstances of this case, which it argues is an impermissible attempt by TikTok to
‘look behind’ the Decision in this case.
187. I agree with the DPC’s position up to a point. It is only permissible in the context of a
stay applications to invite the court to consider the merits of a decision-maker’s decision
where there are no disputed issues of fact, or the issues of law are straightforward. So, where
a decision is manifestly unlawful, it might be possible to argue that, just as an injunction
will be granted as of right where there is no defence to the proceedings in which the
injunction is sought, a stay may be granted where there is no defence to the challenge to the
lawfulness of an administrative decision.
188. Although TikTok argued that some aspects of its appeal were very strong, indeed,
indisputable, it suffices to say that I do not accept that TikTok has established at this stage
that there is no answer to its claim, or that the complex issues of fact and law to which these
proceedings give rise are capable of being resolved in an interlocutory application. It is
impermissible, therefore, for TikTok to invite the court to reach conclusions on the question
of the least risk of injustice which are at odds with the findings of the DPC.
189. It is, however, permissible for TikTok to adduce evidence which addresses matters
which it argues, are not encompassed by the DPC’s decision. In this regard, it is notable that
TikTok did not seek to adduce additional Chinese law evidence, save in response to that led
by the DPC. It did, however, seek to lead evidence regarding the actual level of risk caused
by the data transfers in China in circumstances where, it argues, the DPC has only assessed
that there is a risk – because TikTok hasn’t established that there is an equivalent level of
protection to that in the EU – not what that risk is. As TikTok notes, the DPC’s own affidavit
evidence is that the level of risk is unknown.
190. Similarly, I think it is permissible for the DPC to adduce evidence regarding the level
of risk involved in granting a stay – it would be unfairly hamstrung if TikTok were so
permitted, but it could not. That is the apparent purpose of Professor Zang’s affidavit and
64
the evidence regarding the ‘OnCall’ platform. There is nothing inconsistent about that
evidence and the Decision. I stress, however, that entirely different considerations may arise
if the DPC sought to adduce the same evidence in order to defend the lawfulness of the
Decision. That is a matter for another day.
191. I can, therefore, have regard to Professor Zang’s affidavits, and, necessarily, the
affidavit delivered by TikTok in reply to him.
192. Different considerations arise in relation to Dr Hunton’s affidavit and that of Ms Talus.
Although the opinion of Ms Talus, as chairperson of the EDPB, is clearly worthy of respect,
it is not clear what evidential weight it purports to have. Her affidavit consists largely of
legal submission and her opinion that the stay should be refused. There is very limited
factual information in the affidavit, and nothing which adds to the information in the
Decision. I cannot see that it adds anything to the DPC’s case. I note that the Decision was
circulated to all the SACs in the EEA and none raised a reasoned objection. Although not
determinative of the legal test which should apply to this application, it is a factor which can
be weighed in the balance in considering the interests of justice. Ms Talus’s affidavit does
not add to that weight.
193. Nor is Dr Hunton’s evidence admissible. Dr Hunton relies on matters not relied on by
the DPC in making its decision. It is inconsistent with the DPC’s decision, or at least seeks
to advance entirely different reasons on which the Decision might have been based, e.g.
inadequacy of information, and the risks from malicious actors. The DPC is not permitted
to argue for the immediate enforcement of the Decision, i.e. the refusal of a stay, on grounds
that it could have, but did not, rely on when making the Decision. That would not involve
giving all appropriate weight to a decision which is presumptively valid, or having regard
to the EU interests arising: the Decision had little to do with the issues raised by Dr Hunton
at all.
65
Assessment
194. As is clear, there is no dispute that there is a fair issue to be tried. The DPC accepts, for
the purpose of this application at least, that TikTok’s appeal has identified serious doubts as
to validity of the Decision, and that the first threshold of the Zuckerfabrik test is met. There
was no dispute that this also meant that the Okunade threshold of a serious issue to be tried
was met. It is on the other limbs of each test where the battle lines were drawn.
Adequacy of damages / Serious risk of irremediable damage
195. TikTok has presented comprehensive evidence of the financial costs or losses it will
likely incur if required to implement the Suspension Solution. First, it has explained the
necessity for the Suspension Solution. It has then explained the likely consequences of
implementing that solution. Finally, it has sought to estimate the costs of implementing the
solution. The figures presented are, on any view, very significant.
196. The DPC has queried whether the Suspension Solution is the best means of meeting the
Suspension Order. It has not queried the purported impacts the Suspension Solution will
have on TikTok’s critical business processes if fully implemented, but has queried whether,
in fact, full implementation would be required if, for instance, the appeal was determined in
TikTok’s favour before the end of the Suspension Period. It has, through Mr Wallace’s
affidavit, queried the calculation of estimated losses/costs. In oral submissions, it was also
suggested that the any cost that TikTok might incur in implementing the Suspension
Solution might be offset by savings in further implementation of Project Clover measures,
the estimated cost of which dwarfs even the cost of the Suspension Solution.
197. It is worth observing that conflicting evidence has been presented by the parties in this
case. The DPC has not sought to cross-examine TikTok’s witnesses (nor has TikTok sought
to cross-examine the DPC’s). In light of the decision in RAS Medical Ltd v The Royal
College of Surgeons in Ireland [2019] 1 IR 63, [2019] IESC 4, a question arises as to how
66
the court should approach the evidence. As McDonald J noted in the Eircom case, the
Supreme Court has determined that cross-examination, save in exceptional cases, is not
appropriate in an interlocutory application (see, IBB Internet Services v Motorola [2013]
IESC 53). McDonald J concluded, therefore, that:
“41. I must, therefore, do the best I can on the basis of the affidavits presented. And I
must, for example, reach a conclusion as to whether Eircom has established on the
evidence that it will be exposed to serious and irreparable harm if a stay is not granted.
Since that is an issue that I am required to consider and since the onus of proof lies on
Eircom in this regard, I believe that ComReg and the Notice Parties must be entitled to
comment adversely on the quality of the evidence put forward by Eircom. In my view,
they do not have to seek to cross-examine in order to do so. That said, the fact that
cross-examination is not available at this interlocutory stage means that they cannot
readily undermine evidence which is plausible on its face.”
198. Accordingly, I must likewise do the best I can on the basis of the affidavit evidence
presented.
199. Notwithstanding the queries raised by the DPC, I am satisfied that TikTok has
established a probability that it will incur very significant costs if required to implement the
Suspension Solution. The evidence presented is robust. On the technical front, the in-house
evidence of Ms Huang is supported by the expert evidence of Professor Pietzuch and
Professor Todri. Mr Xu’s financial projections are endorsed in Mr Jacobs’s Report. Though
Mr Wallace has queried some of the methodology, TikTok has sought to address his queries
in its replying affidavits. Mr Wallace’s analysis does not, therefore, serve to undermine the
detailed evidence of TikTok.
200. Nor have the doubts expressed by the DPC, regarding the extent to which the
Suspension Solution may have to be implemented pending the hearing of TikTok’s appeal,
or any potential savings which might be achieved in the implementation of Project Clover,
been sufficiently explored by the DPC in its evidence to lead me to reject TikTok’s evidence.
67
201. In truth, the DPC’s main argument was not that TikTok would not incur significant costs
– though the precise scale of those costs was disputed – rather, it argued that any loss
suffered was purely financial, and, therefore, compensatable in damages. TikTok’s evidence
was significantly more detailed than, for instance, the evidence relied on in Case C-639/23
P(R) Amazon Services Europe Sàrl v European Commission, a decision discussed below in
more detail, which did not prevent a finding of irreparable harm in that case (though the stay
was refused on other grounds). I am satisfied, therefore, that TikTok has established to the
requisite standard that it will suffer significant financial loss if required to give effect to the
Suspension Order pending the hearing of its appeal.
202. Is there any loss which it will suffer which is not financial? TikTok, in particular in Ms
Huang’s affidavit, identifies certain non-pecuniary loss which she says TikTok will suffer.
These include loss of institutional knowledge and expertise, irreversible harm to CGE
personnel and their families, whether by their relocation or being made redundant. Mr
Jacobs refers to loss of goodwill and market value.
203. Regarding the impact on CGE personnel and their families, this cannot be regarded as
a loss to TikTok for the purpose of considering whether it will suffer harm. It may, however,
be relevant in the balancing of interests.
204. The loss of institutional knowledge and expertise is undoubtedly a loss to TikTok, but
in my view, it should properly be regarded as a pecuniary loss, since its impact is on the
value of TikTok’s business. Similarly, other purportedly non-pecuniary losses, including
damage to TikTok’s brand, or its competitiveness must also be regarded as financial or
pecuniary.
205. However, the classification of these losses as financial or pecuniary does not mean that
damages are an adequate remedy, or that the losses should not be regarded as serious and
irreparable.
68
206. First, a question arises as to whether damages would be recoverable at all if TikTok
incurred losses and ultimately succeeded in its appeal. Although the DPC argue that
Francovich damages are recoverable, the reality of that as a proposition must be open to
doubt for a variety of reasons.
207. TikTok refers to the fact that the DPC has immunity from suit, per section 154 of the
2018 Act, and argues that damages are, therefore, not available. Without determining the
issue, there must be a question over whether an emanation of the State could rely on a
statutory immunity to defeat a claim for Francovich damages. Accordingly, I don’t propose
treating the remedy as unavailable by reference to section 154. This does, however, highlight
one hurdle which any party would have to overcome if seeking to recover damages in the
event of a successful appeal against a decision of the DPC. In circumstances where TikTok’s
appeal is not confined to EU law issues, it is entirely possible that Francovich damages
would not, in any event, be available if it succeeds in its appeal: it may depend on which
grounds of appeal prove successful.
208. Difficulty in recovering Francovich damages has been recognised by the Court of
Appeal, in Word Perfect Translation Services, as a basis for concluding that Francovich
damages are not an adequate remedy. Given the scale of the potential losses which may be
suffered by TikTok, I am quite satisfied that a hypothetical remedy in damages is not an
adequate remedy for TikTok in this instance.
209. That conclusion can be reached even without considering the difficulty which would
likely arise in seeking to calculate TikTok’s losses. In Curust Financial Services Ltd v
Loewe-Lack-Werk [1994] 1 IR 450, the Supreme Court (Finlay CJ), concluded in relation to
the adequacy of damages (at p. 469):
“Difficulty, as distinct from complete impossibility, in the assessment of such damages
should not, in my view, be a ground for characterising the awarding of damages as an
inadequate remedy.”
69
210. The Court referred to there being no “insuperable difficulties” in calculating damages,
characterising it as a matter of calculating the value of market share in a “stable and well-
established” market, the sale and distribution of rust primers. In this case, the calculation of
damage which might be suffered by TikTok across a whole range of categories not
encompassed by their calculations of projected losses, would face such insuperable
difficulties that it must be regarded as virtually impossible. In Mr Wallace’s affidavit, he
refers to the lack of benchmarking of TikTok’s estimated losses, and Mr Jacobs explains that
there is no benchmarking because the type of disruption envisaged has never occurred
within the industry. This serves to highlight the impossibility of capturing all the losses
which TikTok might suffer in an entirely dynamic market, as far removed from the rust
primer market at issue in Curust as it is possible to conceive.
211. For completeness, it seems to me that in light of the decision in the Amazon case
referred to above, the same difficulty in calculating damages would lead to a conclusion that
TikTok would suffer serious and irreparable harm, i.e. the urgency test would be met.
212. At issue in Amazon was the designation of Amazon as a very large online platform
pursuant to Regulation (EU) 2022/2065 (the Digital Services Act). Such a designation
imposed an obligation on Amazon to provide an “opt out” (Article 38), and an obligation to
make publicly available, through a reliable and searchable tool, a repository containing
detailed information regarding all advertisements on the platform (Article 39). Amazon
challenged its designation as a very large online platform and sought a stay on the
obligations imposed on it by that designation.
213. There were obvious similarities to the instant case. The scale of losses predicted was of
a similar order, although the evidence substantiating that loss seems to have been
considerably weaker than here. As here, it was not suggested that Amazon’s financial
viability would be imperilled. Nonetheless, the Court was satisfied that the damage to
Amazon, if it were required to comply with the requirements of Article 39, constituted
serious and irremediable harm such as to satisfy the urgency test:
70
“132 As regards the irreparable nature of that damage, it should be borne in mind
that, admittedly, damage of a financial nature cannot, otherwise than in exceptional
circumstances, be regarded as irreparable since, as a general rule, pecuniary
compensation is capable of restoring the aggrieved person to the situation that obtained
before he, she or it suffered the damage. That is however not the case, and such damage
can then be deemed to be irreparable, if it cannot be quantified (order of the Vice-
President of the Court of Justice of 2 March 2016, Evonik Degussa v Commission,
C-162/15 P-R, EU:C:2016:142, paragraph 92 and the case-law cited).
133 However, the uncertainty linked to reparation for harm of a pecuniary nature in
a possible action for damages cannot be regarded, in itself, as a circumstance capable
of establishing that such a harm is irreparable, for the purposes of the case-law of the
Court. At the stage of seeking interim relief, the possibility of subsequently obtaining
compensation for pecuniary damage, if an action for damages is brought following
annulment of the contested measure, is necessarily uncertain. Interlocutory
proceedings are not intended to act as a substitute for an action for damages in order
to remove that uncertainty, since their purpose is only to guarantee the full effectiveness
of the final future decision that will be made in the main action, in this case an action
for annulment, to which the interlocutory proceedings are an adjunct (see, to that effect,
order of the Vice-President of the Court of Justice of 2 March 2016, Evonik
Degussa v Commission, C-162/15 P-R, EU:C:2016:142, paragraph 93 and the case-
law cited).
134 On the other hand, the situation is different where it is already clear, when the
assessment is carried out by the judge hearing the application for interim measures,
that, in view of its nature and the manner in which it will foreseeably occur, the harm
alleged, should it occur, may not be adequately identified or quantified and that, in
practice, it will not therefore be possible to make good that harm by bringing an action
for damages. That may be the case, inter alia, in a situation involving the publication
of specific and confidential commercial information (see, to that effect, order of the
71
Vice-President of the Court of Justice of 2 March 2016, Evonik
Degussa v Commission, C-162/15 P-R, EU:C:2016:142, paragraph 94 and the case-
law cited).”
214. The uncertainty was sufficient to demonstrate to the court that the pecuniary damage
alleged is irreparable.
215. Although the uncertainty arises for different reasons here, the quantification of damage
is no more straightforward, for the reasons outlined above. Accordingly, even if the
applicable threshold were a risk of serious and irremediable harm, on the evidence available,
that threshold would be met.
Least risk of injustice /EU Interests test
216. It bears emphasising that no injustice will have been done to TikTok by reason of it
having to implement the Decision, and in particular, the Suspension Order pending the
determination of its appeal, if the appeal ultimately fails. TikTok made various arguments
about the unfairness of it being subject to restrictions which have not been applied to its
competitors, but no weight can be attached to those concerns. All data controllers are
required to comply with the same rules, TikTok cannot be heard to complain if those rules
have a more significant impact on it, because of the manner in which its business is
structured, than on its competitors. Or rather, its complaint must be pursued in the legislative
rather than the judicial sphere.
217. The potential injustice which must be weighed in the balance, is the potential injustice
of being required to comply with a decision which is subsequently proved invalid. This must
be weighed against the injustice which might result if TikTok avoided, or delayed,
complying with a decision, whose validity is upheld.
72
218. In Okunade, the Supreme Court indicated that all appropriate weight should be given
to the importance of decisions which are presumptively valid being implemented. In Krikke
v Barranafaddock Sustainability Electricity Limited [2020] IESC 42, the Court again
emphasised the importance of giving appropriate weight to valid measures. In that case,
what was at issue was the orderly operation of the planning code, described by O’Donnell J
(as he then was) as being “of high public importance”.
219. That requirement is of particular significance in this case where, what is at issue is a
risk to fundamental rights. This consideration must, accordingly, be given very considerable
weight, indeed, the DPC argues that it is decisive. In this regard, as noted above, the DPC
refers to Schrems II and the CJEU’s conclusion that a supervisory authority must suspend
transfers where it determines that there has been a breach of GDPR.
220. Notwithstanding the cogent arguments by the DPC that, in effect, the risk to
fundamental rights trumps any risk of injustice to TikTok, this application cannot simply be
resolved by an invocation of such rights. Were it the case that the engagement of
fundamental rights by a decision necessarily defeated any private interest which might be
asserted, and was treated as decisive in all cases, this would negate the balancing exercise
mandated by national, and indeed Union law, rendering a stay unavailable, undermining the
potential effectiveness of remedy.
221. There are a variety of factors in this case which point to a conclusion that the least risk
of injustice would be served by a limited stay on the Suspension Order, subject to certain
conditions.
222. The first consideration is the length of stay which is required to avoid the most
immediate risk of injustice. The Decision provides a period of six months before the
Suspension Order comes into effect. As a consequence of the temporary stay which was
granted when these proceedings were entered into the Commercial List, that period would
expire towards the end of March 2026 if I refused to continue the stay. However, the parties
have advised that the substantive proceedings should be in a position to be heard in March
73
of next year, subject perhaps to developments in other proceedings. This can certainly be
accommodated by the court, indeed an earlier hearing might be possible. In other words, the
appeal could well have been heard before the Suspension Order takes effect. If this
application were framed as an application for a stay pending the delivery of judgment in the
appeal, could it seriously be doubted that the least risk of injustice would require refusal of
the stay? I think not.
223. Of course, matters are not so straightforward. There may be delays in getting the matter
to hearing, and I acknowledge that the DPC has indicated certain concerns in that regard.
TikTok will be required to take steps in advance of the Suspension Order taking effect and
does not, therefore, have the full benefit of that six month implementation period before it
must take potentially irreversible steps. Given the multiplicity of issues raised in the appeal,
a judgment may not immediately be available. Any delay by TikTok could be addressed by
way of conditions attached to a stay, and any judge hearing the appeal will no doubt be
keenly aware of the importance of delivering a timely judgment where there may be an
ongoing risk to fundamental rights, something which they will be in a better position to
assess having heard the appeal. In any event, the timing of this application and of the
Suspension Order suggests that a grant of a stay pending determination of the appeal by this
court may result in a very limited interference with the orderly implementation of a measure
which is prima facie valid.
224. A related consideration is the period of time over which the Inquiry took place, and the
additional time which the Decision afforded TikTok for compliance. Without in any way
wishing to suggest that the DPC delayed in progressing the Inquiry, especially having regard
to the number of occasions on which it afforded TikTok an opportunity to provide further
information, it is reasonable to infer that the risks involved were not regarded by the DPC
as requiring greater urgency. The urgency procedure under Article 66 of the GDPR was not
utilised. It was explained by counsel at the hearing that that procedure is only used in truly
exceptional cases, but, accepting that to be so, it is clear, at least, that this case is not that. It
is reasonable to conclude that a short further delay pending the determination of these
74
proceedings does not greatly increase the risk that TikTok’s failure to comply with Article
46 poses.
225. A further consideration is the particular nature of the finding by the DPC in this case.
The DPC has not concluded that the personal data at issue in these proceedings isn’t subject
to equivalent protection in China to that it would enjoy in the EU, rather that TikTok has
failed to discharge its obligations to establish that it is subject to such protections: what I
characterised as a negative rather than a positive finding earlier in the judgment. Moreover,
it is not the case that there are no protections in place, or no effort to afford protections by
TikTok.
226. Relatedly, it is important to note the temporal scope of the Inquiry, as determined by
the DPC. The finding that TikTok has failed to satisfy the requirements of Article 46 is
limited to a period concluding in May 2023. There is no finding that there is a current breach
of Article 46. That is not to suggest that I have concluded that it is impermissible for the
DPC to impose a Suspension Order on the basis of a finding of breach of the GDPR which
has a particular temporal scope. In this regard, I note the DPC’s argument that were it
otherwise, there would be never-ending investigations, with data controllers constantly
being afforded further opportunities to update their evidence to the DPC.
227. In this case, the DPC contends that it had regard to all the information provided by
TikTok about the changes it had made subsequent to the DPC issuing the PDD, i.e. outside
the temporal scope of the Inquiry. The DPC concluded that the Suspension Order was still
necessary. Of course, TikTok has appealed that finding, and its lawfulness, but it remains a
presumptively valid measure to which I must afford all appropriate weight.
228. However, it is, in my view, legitimate to distinguish between the findings made here
and a finding such as that discussed in Schrems II (at [111]), i.e. that the data being
transferred is not afforded an adequate level of protection, in assessing the risk of injustice
which might be occasioned if a stay were granted, that is, the risk of fundamental rights
being harmed.
75
229. In that regard, TikTok has provided detailed evidence that there is, in fact, no risk,
having regard to the Project Clover measures put in place, and the type of data involved,
and have adduced evidence from Chinese law experts, seeking to confirm that that is the
case. It has led uncontested evidence that no Chinese authority has ever sought to access
TikTok’s EEA user data.
230. On the other side, the DPC has adduced its own Chinese law evidence, and has referred
to the ‘OnCall’ incident to highlight that its concerns are not merely hypothetical. The DPC
has very fairly acknowledged that there is uncertainty about the risks involved, though it is
clear from the Decision that the risk of concern is of Chinese authorities accessing personal
data remotely accessed by CGE personnel in China, pursuant to the relevant Chinese laws
(what the DPC calls ‘the problematic laws’).
231. It would be inappropriate in the context of an interlocutory application, to express any
view on the Chinese law issue by reference to affidavits which may or may not be admissible
in the substantive proceedings. It is possible, however, while giving all due weight to the
decision, to conclude on the basis of the evidence in this application that, even assuming the
validity of the DPC’s decision, the risk to EEA user data during the period of any required
stay does not appear to be significant.
232. A stay poses no risk to the orderly implementation of the GDPR regime, or to the
implementation of the Decision in due course. The main risk in granting a stay is that any
data which is remotely accessed in China may or will not have an equivalent level of
protection to that afforded it in the EU, and, as a consequence, that data may be processed
in breach of the requirements of the GDPR, and fundamental rights will be infringed. As
noted above, this is a weighty consideration.
233. The DPC relies on the decision in Amazon where, notwithstanding a finding of serious
and irreparable harm, the CJEU refused a stay because of the EU interest in giving effect to
the Digital Services Act. Just as the balancing exercise in that case favoured refusal of a
76
stay, it argues that a stay should be refused here, whether applying the Zuckerfabrik criteria,
or the test in Okunade.
234. Though Amazon clearly illustrates the weight to be given to EU interests in carrying
out a balancing exercise, in my view, the subject matter of those proceedings and of these
are sufficiently different, such that it would not be appropriate to treat the Amazon decision
as determinative of these proceedings.
235. What was at issue in Amazon was a decision of the European Commission on a central
feature of landmark legislation, the Digital Services Act. A failure to give effect to the
decision would, in the Court’s view “lead to a delay, potentially for several years, in the full
achievement of [the] objectives” of that Act. What is at issue here could not plausibly be
considered to have such a profound effect. There is nothing in these proceedings, or in a
grant of a stay, which would affect the operation of the GDPR generally. It involves a single
decision of a supervising authority. True, it is a decision of which all other SACs have been
notified, because of the scope of TikTok’s cross-border activities, and none have objected.
That adds something to the weight which it should be afforded. But however the other SAC’s
acceptance of the DPC’s decision is characterised, it remains a single decision pursuant to
the GDPR, which regulation will remain in full force and effect irrespective of these
proceedings.
236. It is also relevant, in this instance, to consider the persons potentially affected by a stay.
In Amazon, those affected were, in effect, every person affected by the Digital Services Act.
In this case, the group effected is confined to TikTok’s users. This, of course, remains a very
significant group, with over 159 million monthly users of TikTok’s platform across the EEA.
Moreover, the evidence is that they are typically younger users, the protection of whose
rights interests requires particular care.
237. TikTok, in fact, argues that the court should have regard to how those users will be
negatively affected if the Suspension Order is put in place, due to the deterioration in the
77
service provided by TikTok. Put otherwise, it is in the interests of the very people whose
fundamental rights are at risk if the Suspension Order is stayed that that risk be continued.
238. As appears from the second infringement finding in the Decision, the finding that there
was a failure to notify users of the nature of the transfers up to 1 December 2022, the DPC
was satisfied, by reference to TikTok’s December 2022 EEA Privacy Policy that, after that
date, TikTok’s users were notified of the data transfers thereafter. As recorded at paragraph
604 of the Decisions:
“The December 2022 EEA Privacy Policy also informed EEA users that personal data
was stored on servers in the United States and Singapore, and was the subject of limited
remote access by entities in TikTok’s corporate group located in Brazil, China,
Malaysia, Philippines, Singapore and the United States.”
239. That must, I think, have some bearing on the extent to which it is necessary to refuse a
short stay in order to protect the fundamental rights of TikTok’s users.
240. What is not clear, is whether the users have been advised of the DPC’s findings against
TikTok, in particular, that it has not complied with Article 46 in relation to the transfers. I
can find no reference to such a notification in the papers. Of course, mere notification could
not suffice to render lawful a cross-border transfer of personal data which would otherwise
be unlawful. Express and informed consent to the transfer is required, per Article 49(1) of
the GDPR, to achieve that. However, in my view, any concern about the limited short-term
risk to TikTok users’ fundamental rights would be somewhat ameliorated if their continued
engagement with the platform was on an informed basis about the issues identified by the
DPC (including the fact that TikTok has appealed the DPC’s findings).
241. In light of all of the above, it seems to me that the grant of a stay on the Suspension
Order, subject to certain conditions discussed below, gives rise to the least risk of injustice
per Okunade.
78
242. Although not strictly necessary for me to decide, I also consider that, though no doubt
more finely balanced than on an application of the Okunade principles, TikTok would have
satisfied the EU interests test had it been applicable. TikTok has a much stronger claim for
interim relief in this instance than did Amazon in its proceedings under the Digital Services
Act. In that case, the asserted loss was speculative and not substantiated by detailed
evidence. More importantly, in Amazon, the EU interests ‘in play’ were certain to be
adversely affected during the period of any stay. Here, the evidence of loss is robust. The
possibility of harm to fundamental rights is far from certain. Accordingly, the serious and
irremediable harm which TikTok will suffer if the Decision is ultimately found to be invalid,
outweighs the limited risk to EU interests if there is a short delay in implementation of the
Suspension Order, on the basis of the conditions proposed.
Conclusion
243. The appropriate test in determining whether to grant a stay on the implementation of
the Suspension Order and the Corrective Order is the test in Okunade.
244. In circumstances where the DPC accepts that there is a serious issue to be tried, the
objective of the court is to seek to ensure the least risk of injustice pending the hearing of
this appeal.
245. I am satisfied on the evidence that TikTok will suffer significant damage if required to
implement the Suspension and Corrective Orders in advance of its appeal being heard. I am
further satisfied that although the damage can, broadly speaking, be characterised as
pecuniary or financial, having regard to the scale of the damage which it will suffer, the near
impossibility of quantifying the loss, and the limited prospect of TikTok ever being able to
recover that loss if successful in its appeal, damages could not be regarded as an adequate
remedy.
79
246. Although any delay in implementing the Decision does carry a risk to fundamental
rights, which weighs heavily in the balance, the evidence suggests that that risk is limited
and will be temporary. There is no risk to the implementation of the GDPR more generally
if a stay is granted.
247. In the circumstances, and subject to the imposition of conditions, the granting of a stay
in this instance creates the least risk of injustice.
248. If, contrary to what I have concluded above, the appropriate threshold for the grant of
a stay was that set out in Zuckerfabrik, the same result would be achieved. TikTok will suffer
serious and irremediable harm if no stay is granted. Although the EU interests engaged
involve a risk to fundamental rights, having regard to the extent of that risk, and the extent
of the possible loss to TikTok, it is appropriate to stay the implementation of the Suspension
and Corrective Orders, subject to conditions.
249. Those conditions flow from what has been discussed previously. First, the stay should
be for the shortest period possible. I therefore propose granting a stay pending the
determination of the appeal in this court on the basis of an undertaking by TikTok to
prosecute its appeal with all reasonable diligence and, in any event, to ensure, insofar as it
is within TikTok’s power to do so, that the appeal is heard not later than March 2026.
250. Second, TikTok will be required, insofar as it has not already done so, to notify, in a
manner to be agreed, or in default as directed by this Court, all its users of the DPC’s decision
in clear and easily understood language. Any such notification may also refer to TikTok’s
appeal and to the stay now being granted.
251. Both parties shall have liberty to apply in relation to the continuation of the stay.
80
252. As previously indicated, the proceedings will be listed on 14 November 2025 at 11 am
to address any consequential orders.
81