İrlanda Yüksek Mahkemesi — [2026] IESC 27

AN CHÚIRT UACHTARACH
THE SUPREME COURT

Supreme Court Appeal Number: S:AP:IE:2025:000148
[2026] IESC 27

O’Donnell C.J.
O’Malley J.
Hogan J.
Murray J.
Collins J.

IN THE MATTER OF SECTION 142 AND SECTION 150 OF THE DATA

PROTECTION ACT 2018

BETWEEN/

TIKTOK TECHNOLOGY LIMITED and TIKTOK INFORMATION

TECHNOLOGIES UK LIMITED

RESPONDENTS

– AND –

DATA PROTECTION COMMISSION

APPELLANT

JUDGMENT of Mr. Justice Brian Murray delivered this 30th day of April 2026

This appeal

1. This appeal arises from a decision of the appellant (“the DPC”) of 30 April 2025. There,

the DPC determined that the first-named respondent (“TikTok”) had infringed Articles

46 and 13(1)(f) of Regulation (EU) 2016/679 (“the GDPR”). The findings arose from

the transfer by TikTok of certain personal data of users of its services, to jurisdictions

outside the European Economic Area (“the EEA”). As a result, the DPC directed

TikTok to (a) suspend those transfers of data, (b) bring the processing of the data into

compliance with the GDPR, and (c) pay two administrative fines of €485M and €45M.

TikTok responded by initiating these proceedings, a statutory appeal against the

decision as enabled by ss. 142 and 150 of the Data Protection Act 2018 (“the 2018

Act”).

2. The matter now comes before this court by way of the DPC’s appeal against a decision

of the High Court (Mulcahy J.) granting a stay on the first two parts of this direction

pending the hearing of the full statutory appeal ([2025] IEHC 619). The parties agree

that the effect of the relevant provisions of the 2018 Act is that the obligation to pay the

administrative fines – the third part of the direction – was automatically stayed upon

the commencement of these proceedings.

3. Stays on administrative decisions that are the subject of proceedings by way of judicial

review, are not unusual. The factors to be taken into account in determining whether to

grant such orders have been identified and explained in a decision of this court,

Okunade v. Minister for Justice [2012] IESC 49, [2012] 3 IR 152 (“Okunade”). The

motion in this case, however, differs from most applications of this kind. This is so not

only because of the complexity of the legal and factual background to the appeal, and

not only because the application for a stay arises in the context of a statutory appeal

rather than proceedings by way of judicial review. It is also different because a

significant question arises as to whether this application is governed by Okunade at all,

or whether it should be determined by reference to a test developed by the Court of

Justice of the European Union (“the CJEU”) in the context of interim measures pending

a decision as to the validity of a provision of EU law. The DPC says that by reason of

the EU-wide effect of its decision, the test formulated in Okunade does not apply to the

grant or withholding of the stay sought by TikTok. It says that, instead, the application

should be determined using criteria formulated in Joined Cases C-143/88 and C-

92/89, Zuckerfabrik Süderdithmarschen AG v Hauptzollamt Itzehoe and Zuckerfabrik

Soest GmbH v. Hauptzollamt Paderborn (EU:C:1991:65) (“Zuckerfabrik”).

4. Two issues thus arise: which of these tests governs the application for a stay, and how

does that test fall to be applied in this case?

The parties

5. The involved legal and factual background to the impugned decision starts with the

GDPR. This Regulation has as its object the protection of natural persons with regard

to the processing of their personal data. It mandates the establishment in each Member

State of the European Union of one or more independent public authorities – ‘the

supervisory authority’. That authority is responsible for monitoring the application of

the Regulation (Article 51). The DPC is designated by the 2018 Act as ‘the supervisory

authority’ in this jurisdiction for the purposes of the GDPR (s. 11 of the 2018 Act).

6. TikTok – a company established in accordance with Irish law and having its main

establishment here – describes itself as ‘the service provider of the Tik Tok platform for

the EEA and Switzerland’. The ‘TikTok platform’ is a social media service that enables

its users to create, share and watch short form video content. TikTok’s ultimate parent

is ByteDance Ltd., a Cayman Islands registered company. It forms part of a group of

entities (“ByteDance”) some of which are based in China (“the China Group Entities”).

7. When providing services to users of its platform, TikTok processes certain personal

data of those users and (together with TikTok Information Technologies UK Ltd.)

functions in the EEA as the ‘controller’ in respect of that data within the meaning of

Article 4(7) of the GDPR. By reason of that status, TikTok is subject to particular

obligations, insofar as it is the person that determines the purposes and means of the

processing of personal data.

8. The operation of the TikTok platform involves the processing of such data on a

significant scale: there were more than 1 billion monthly active users of these services

as of September 2021, and between July and December 2024 TikTok had on average

159 million monthly active recipients in the European Union Member State countries

alone. As explained shortly, some of that data processing takes place in jurisdictions

outside the EEA (“third countries”), and the GDPR imposes significant restrictions on

cross-border processing of this kind (the GDPR has been incorporated into the EEA

Agreement).

9. The supervisory authorities may discharge an important role in regulating transfers of

personal data to third countries. Having regard to the location of TikTok’s main

establishment, the DPC is competent to act as the ‘lead supervisory authority’ in respect

of any cross-border processing carried out by TikTok (Article 56 of the GDPR). As

such, the DPC is ‘the sole interlocutor’ under the GDPR for that cross-border

processing (Article 56(6)). While, pursuant to Article 60, it discharges that function in

co-operation with other supervisory authorities, the GDPR envisages the lead

supervisory authority operating as what Advocate General Bobek in Case C-645/19

Facebook Ireland Ltd. and ors. v. Gegevensbeschermingautoriteit (EU:C:2021:5)

described as ‘a one-stop-shop’.

The legal context

10. The law of the European Union attaches high importance to the protection of personal

data. Article 8 of the Charter of Fundamental Rights of the European Union (“the

Charter”) expressly guarantees that protection, and this is given effect to by inter alia

the GDPR.

11. These protections can be readily applied to activities occurring within the EU/EEA.

However, more difficult questions present themselves when data is transferred to third

countries. In an effort to ensure that similar protections can be enforced in respect of

such transferred data, Chapter V of the GDPR lays down conditions that must be

complied with in making such transfers. These transfers may, in particular, be

authorised where they are made to a jurisdiction which the European Commission has

determined ensures an adequate level of protection for such data. Provision is made for

these ‘adequacy decisions’ of the European Commission by Article 45 of the GDPR.

12. In respect of transfers of data to third countries that do not benefit from an adequacy

decision, Article 46 of the GDPR provides that a controller or processor must ensure

that ‘appropriate safeguards’ are provided, and that such transfers may only occur on

condition that ‘enforceable data subject rights and effective legal remedies for data

subjects are available.’ These safeguards, rights and remedies may be afforded by inter

alia what are termed ‘standard data protection clauses’ (“SCCs”) adopted by the

European Commission. TikTok adopted the SCCs approved in 2010 (Commission

Decision 2010/87/EU), thereafter replacing these with SCCs that had been similarly

approved in 2021 (Commission Implementing Decision (EU) 2021/914).

13. However, neither the existence of, nor the fact of compliance with, SCCs exhausts the

obligation imposed by the GDPR on controllers or processors who are responsible for

the transfer to a third country of personal data. The CJEU has decided that while that

third country is not required to have protections governing personal data that are

identical to those applicable in the EU, those responsible for data transfers must ensure

‘a level of protection … that is essentially equivalent to that guaranteed within the

European Union by virtue of the regulation, read in the light of the Charter’ (Case C-

311/18 Data Protection Commissioner v. Facebook Ireland Ltd. and Maximillian

Schrems (EU:C:2020:559) (“Schrems II”) at para. 94). If the jurisdiction to which the

data is transferred does not itself provide this ‘essentially equivalent’ level of

protection, then it is incumbent on the data controller to put in place supplementary

measures that compensate for the lack of such protection.

14. It is, moreover, specifically provided in Article 13(1)(f) of the GDPR that where

personal data relating to a data subject is collected from that person, the controller shall

at the time the data is obtained provide the data subject with inter alia information that

the controller intends to transfer the personal data to a third country as well as

information regarding the existence or absence of an adequacy decision by the

Commission, or reference to the appropriate or suitable safeguards attending the

transfer, together with the means by which to obtain a copy of, or access to, same.

The data processing

15. The impugned decision, and the investigation that preceded it, arises from the fact that

personnel of the China Group Entities perform a range of tasks and functions which,

TikTok says, are critical to the operation of the TikTok platform. During the period

relevant to that decision, these tasks included functions related to software engineering,

maintenance and development. In order to execute these functions, staff of the China

Group Entities required access to, and use of, the personal data of TikTok users. TikTok

says that the analysis of this data by these staff enabled research and development,

security, analytics, online payments and customer and technical support. It also says

that there were significant limitations on the identity of staff who could access the data,

and the purposes for which they were permitted to do so. The DPC has said that these

tasks and functions ‘appear essential to the operation of the Tik Tok platform.’

16. All of this involved not merely the processing of data of TikTok users but, more

importantly for present purposes, the accessing of that data by personnel in the People’s

Republic of China (“China”). That jurisdiction does not benefit from an adequacy

decision of the European Commission. However, while the personnel who engaged in

this processing are based in China, the data was not permanently stored there. It was

stored in data centres in Singapore, Malaysia and the United States. The personnel of

the China Group Entities accessed this data by what TikTok terms as ‘secure and

controlled remote access’. In order to do this, the data must be transferred to and

temporarily processed in China.

17. The potential interaction between personnel of the China Group Entities who are based

in China and this data, might be seen as arising in two ways. First, they have the ability

to remotely access the data physically located in Singapore, Malaysia or the United

States, as the case may be. Second, where they actually access this data, they may and

do temporarily transfer some of it to China. This temporary transfer, TikTok says, is

necessary for the data to be available remotely to be displayed to, and used by,

personnel of the China Group Entities. At some points in the proceedings the term

‘remote access solution’ was used to describe the process whereby the data is thus

temporarily transferred to, and processed in China by, personnel of the China Group

Entities. Without local temporary processing, remote access is not possible.

18. Some of the issues in the substantive appeal depend on questions arising from these

two related aspects (there is a third feature of this that emerged in the course of the DPC

investigation, which is that contrary to representations made by TikTok in the course

of that process, some personal data of EEA users was in fact being stored on servers in

China, but while – understandably – a source of grave concern to the DPC, this is not

relevant to the decision of the DPC in issue here). However, two points in particular

should be noted. First, the DPC accepted TikTok’s position that insofar as the issues

that were presented by the inquiry are concerned, there is no permanent ‘bulk’ storage

of EEA users’ personal data in China: remote access involves processing data

permanently stored in other countries, while temporary transfer does not result in

permanent ‘bulk’ storage. Second, TikTok does not dispute the DPC’s conclusion that

the transfers were, at various times, made to between 16 and 26 China Group Entities,

with access to the data being granted to thousands of individuals working in those

entities, and that where remote access was authorised for a specific business purpose it

was in general authorised for up to 12 months.

19. Nor can there be any question but that that the data in question constitutes ‘personal

data’ for the purposes of the GDPR. At the times relevant to the impugned decision, it

comprised the customer’s user ID and TikTok username, subscriber data, user profile,

interaction and activity data, content data, technical and advertising data and purchase

information. It also included survey responses, payment information, information as to

the user’s location, advertising data and details of push notifications sent to users.

Collectively, these would show the user’s engagement on the platform, content

generated by the user, interest category selection, inferred demographic and interest

profiles, and the purchase history of the user. While TikTok says that it is not its

intention to collect from users the categories of sensitive personal data referred to in

Article 9 of the GDPR (which enjoys particular protection), it accepts that such data

may be collected incidentally or be uploaded by the user.

20. In the course of 2021, the DPC became concerned as to whether the conditions imposed

by the GDPR in respect of transfers of data outside the EEA were being complied with

at the interface between TikTok, its users’ data, and the personnel of the China Group

Entities who were undertaking the various functions to which I have earlier referred.

To that end, in September of that year, it opened an inquiry under s. 110 of the 2018

Act with a view to examining TikTok’s compliance with the requirements of the GDPR

as they relate to the transfer to China of the personal data of users of the TikTok

platform in the EEA, and the provision of information to users in relation to such

transfers as required by Article 13(1)(f) of the GDPR.

The inquiry

21. The inquiry spanned over a period of three and half years, generating a significant body

of inter partes correspondence, submissions, assessments and supporting material, and

a preliminary draft decision, draft decision and a final decision from the DPC that

extends to some eight hundred and thirty dense paragraphs. The proceedings are

characterised by an extensive collection of lengthy affidavits, thousands of pages of

exhibits, and pleadings.

22. At the nub, however, of a substantial part of the statutory appeal is the view of the DPC

that where an undertaking such as TikTok transfers data to a third country, and where

the DPC conducts an investigation into the transfer of that data, the undertaking is

required to satisfy the DPC that it has assessed the law of the jurisdiction to which the

data is being transferred, and that it has by that assessment satisfied itself that having

regard to that law and any relevant measures adopted by the undertaking, the level of

protection of the personal data is essentially equivalent to that provided by the law of

the European Union. If it has not so satisfied itself, the DPC says, the data transfers are

unlawful. In this regard the DPC makes reference to what it terms the ‘accountability

obligations’ expressed in Articles 5(2) and 24 of GDPR and the obligations in Chapter

V of the GDPR. The DPC says in its decision that ‘a controller or processor must be

able to demonstrate that is has verified and guaranteed an essentially equivalent level

of protection for the transferred personal data’.

23. From there, the DPC states, it is its responsibility to review the assessments made by

the controller so as to ascertain whether the transfers comply with the GDPR. If the

controller is not in a position to guarantee the requisite level of protection, then the DPC

as the competent supervisory authority is (the DPC says) empowered to suspend or end

the transfers. It is to be stressed that in framing the obligation of the data controller in

this way, the DPC may find a breach by the controller of the GDPR in and around data

transfers to a third country without the DPC itself determining whether the country to

which the data is transferred provides the requisite level of protection (with or without

regard to any SCCs or supplementary measures). It is sufficient, on this view, for the

DPC to decide that the data controller has acted unlawfully in itself failing to conduct

an adequate assessment and in failing to satisfy the DPC that it has done so.

24. TikTok accepted at an early stage that it could not say that the law of China provided

the requisite protection based on the SCCs alone. It noted, in particular, that there are

Chinese laws that materially diverge from EU standards (these are referred to by the

DPC as ‘the problematic laws’). However, TikTok said that this did not matter, having

regard to two factors. The first was the steps TikTok had taken to ensure the protection

of that data and the identity of the persons to which it related (these protections were,

TikTok said, further enhanced as the inquiry proceeded by means of a series of

measures adopted under what it terms ‘Project Clover’, to which I will later return).

25. The second arose from the fact that the data was not itself permanently stored in China.

TikTok said that insofar as the fact that TikTok personnel in China could access the

data remotely meant that the data had been transferred to that jurisdiction, Chinese law

did not permit the authorities there to compel those personnel to grant them access to

the data. TikTok contended that the ‘Chinese authorities are not lawfully entitled to

compel organisations and individuals to provide data that are not domestically stored

within the territory of China’. This was referred to throughout as the ‘territoriality

principle’. An expert in Chinese law whose reports were furnished by TikTok to the

DPC (Professor Xu) said, in his second report (dated 8 September 2023), that the

Chinese authorities did not have the power to compel companies related to TikTok

based in China, or those working for them, to disclose remotely accessible EEA user

data that is stored on servers outside of China in the specific circumstances of the

transfers the subject of the DPC inquiry. That report was furnished by TikTok to the

DPC on 8 September 2023 as part of its response to a Preliminary Draft Decision of the

DPC that had been circulated in May 2023 (“the PDD”). In the PDD, the DPC had

proposed making orders suspending data transfers and requiring TikTok to bring its

processing into compliance. There, the DPC recorded as follows (para. 367):

‘TikTok Ireland has failed to clarify precisely how the territoriality principle

applies in the context of the relevant laws and practices and to clarify whether,

and the extent to which such laws may apply in the context of the transfers. This

directly impacts on its ability to select appropriate measures and its ability to

verify, guarantee and demonstrate that the supplementary measures and the

SCCs are effective in respect of potentially problematic laws.’

26. TikTok’s response to the PDD was followed by an extensive exchange of

correspondence between the parties, included in which was a specific request by letter

dated 8 February 2024 from the DPC that TikTok clarify inter alia whether remote

access by personnel in China involved storage of EEA user data, including temporary

storage.

27. The second report of Professor Xu was also appended to a revised Data Transfer

Assessment (“DTA”) sent as part of the inquiry by TikTok to the DPC on 31 July 2024.

The following was said in that DTA:

‘taking account of the relevant aspects of China’s current legal framework in

the specific context of the secure Remote Authorised Access, the SCCs together

with the various Supplementary Measures ensure that EEA User Data is

afforded a level of protection essentially equivalent to that guaranteed within

the European Union. There is no impediment as a matter of Chinese law to the

China Group Entities complying with their obligations under the SCCs in the

specific circumstances of the transfers made by way of remote access and the

China Group Entities are able to satisfy those obligations.’

28. A footnote to that DTA (footnote 113) recorded as follows (referring to ‘Fangda’, a

leading Chinese law firm which advised TikTok, and to Professor Xu’s conclusions

including those to which I have just referred):

‘We have been advised by Fangda and Professor Xu that the transient

processing inherent to the facilitation of remote access in China does not alter

the above analysis. This is because the relevant data is still stored outside of

China (and only remotely accessible from within China), and so is still subject

to the requirements set out above. In addition: (i) such transient processing is

strictly protected by the constitutional right to confidentiality of correspondence

under Article 40 of the PRC Constitution and (ii) such transiently processed

data would in any event still be considered offshore data when considering the

scope of Chinese authorities jurisdiction…’

29. The DPC says that it was not furnished with the content of the advice furnished by

Fangda Partners and Professor Xu to TikTok as referred to here. It does not appear to

have sought it. In the principal affidavit sworn by the DPC for the purposes of resisting

the stay application, it says that footnote 113 constituted TikTok’s first and up to that

point only engagement with the treatment under Chinese law of the personal data of

EEA users of TikTok’s services transferred to China and processed there on the devices

of employees of China Group Entities. It stresses that this was notwithstanding the fact

that the DPC had specifically raised this issue, most recently in its letter of 8 February

2024. Professor Xu, the DPC says, first dealt with this point in a report delivered on

18 March 2025. It also says that neither that report, nor this footnote, consider the

potential power of the Chinese authorities to directly access data processed on devices

in China. TikTok, on the other hand, says in the affidavits sworn for the purposes of

the stay application that at the time it delivered the DTA it ‘understood the DPC’s

concerns to be those set out in the PDD, which made no mention of the temporary

processing’.

30. Article 60 of the GDPR requires that where a lead supervisory authority proposes to

make a decision of the kind in issue here, it should submit a draft of that decision to

other supervisory authorities. This allows those authorities to express any objections to

the draft decision. If agreement cannot be reached in relation to those views, provision

is made for the European Data Protection Board (“the EDPB”) to intervene (I will return

later to this body, and the process envisaged by these provisions). On 14 February 2025,

TikTok advised the DPC that it intended to share an update on its new safeguards and

security measures implemented under Project Clover, stating that this would be

furnished before 10 March 2025. On 21 February 2025, the DPC advised TikTok that

it had finalised and circulated its draft decision pursuant to these provisions. A copy of

the draft decision was provided to TikTok. In that draft decision, the DPC found that

TikTok had ‘continually failed’ to address the application of Chinese law to data that

was temporarily transferred to and processed in China in the course of remote access.

The decision recorded that TikTok had ‘overlooked’ how the territoriality principle

applied in respect of that data.

31. The draft decision proposed that it was appropriate, necessary and proportionate to

order the suspension of the data transfers on the basis that TikTok had infringed Article

46 of the GDPR. Particular emphasis was placed by the DPC on its view that TikTok

had failed to address whether data that was temporarily transferred to China could be

accessed by the authorities there. TikTok responded on 14 March 2025, requesting that

the DPC withdraw the draft decision. In that letter it drew the DPC’s attention to

footnote 113 to its July 2024 DTA. TikTok said inter alia that the draft decision

contained and was premised on a fundamental factual error insofar as it said that TikTok

had not assessed how Chinese law applied to the processing of EEA User Data. It also

complained about the failure to allow TikTok to make submissions in response to the

DPC’s view, as expressed in the draft decision, that Project Clover was insufficient to

ensure essentially equivalent protection.

32. On 18 March TikTok provided a third opinion of Professor Xu. That third opinion

recorded that Professor Xu had understood at the time he delivered his second opinion

that the data transfers entailed some temporary processing on computer information

systems in China as a result of remote access and that, for the avoidance of any doubt,

it was his opinion that the principles set out in his second opinion applied to the data

temporarily processed in China. On 25 March the DPC refused TikTok’s request that

the draft decision be withdrawn. The final decision was adopted on 30 April 2025.

The decision

33. The decision of the DPC was made under s. 111 of the 2018 Act, and Article 60 of the

GDPR. In it, the DPC found that TikTok had infringed Article 46 of the GDPR by

carrying out the data transfers while failing to verify, guarantee and demonstrate that

EEA User Data subject to those transfers was afforded a level of protection essentially

equivalent to that guaranteed within the European Union. It expressed this finding as

follows (para. 373 of the decision):

‘The DPC has considered all information submitted by TikTok Ireland during

the Inquiry regarding the territoriality principle. This includes the Legal

Opinions, the updated Data Transfer Assessments, and the submissions made

after the Preliminary Draft Decision. However, for the reasons set out below,

the DPC finds that TikTok Ireland has failed, on a continuing basis, to

adequately assess the level of protection of EEA Users under the Chinese legal

framework in respect of the territoriality principle and the divergences that

TikTok Ireland acknowledges to exist. In particular, TikTok Ireland failed to

adequately assess the law and practices in effect in China regarding the level

of protection of personal data of EEA Users the subject of the Data Transfers.’

34. Key to that conclusion was the DPC’s opinion that TikTok had ‘continually failed to

address the application of those laws to the processing of EEA User Data that does

occur on computer information systems in China by means of the Remote Access

Solution’ (para. 375), that it ‘has not considered the application of the territoriality

principle to the personal data while that data is processed in China’ (para. 377), that

TikTok’s ‘assessment of the territoriality principle failed to properly address the fact

that the personal data routinely subject to the Remote Access Solution is processed in

China, and therefore is located within China albeit on a temporary basis’ (para. 380),

and that ‘it has failed to consider how Chinese law and practices apply in respect of the

personal data that is transferred to China’ (para. 383). The decision recorded that

TikTok’s assessment ‘appears to assume’ that the only form of problematic access that

could occur was by Chinese authorities compelling access to EEA user data stored

outside China but ‘overlooks’ access that may be obtained while data is temporarily

processed (para. 384). It stressed that TikTok had not addressed whether access by

Chinese authorities to those computer information systems could lawfully occur

without the knowledge of the China Group Entities and/or their employees (para. 410).

It said ‘TikTok Ireland’s assessment of the territoriality principle failed to consider the

issue of Chinese authorities obtaining access to EEA User Data that was routinely

transferred to China and that was temporarily processed in China …’ (para. 512). The

DPC decision referred (at para. 96) to the fact that TikTok had delivered the third

opinion of Professor Xu on 18 March 2025, and specifically recorded that it had

considered that report, commenting ‘[h]owever, fundamental flaws in TikTok Ireland’s

assessment … remain unaddressed and are ongoing’ (para. 691).

35. Essentially, as the DPC itself puts it, the decision found that TikTok had not provided

proper verification and guarantees in respect of its account of Chinese law. It

emphasises that the decision expressly referred to the lack of legal authorities put

forward by TikTok in respect of that interpretation. In its decision, the DPC did not

provide any further reasoning as to why the third report of Professor Xu was not

accepted by it, and it did not address footnote 113 of the DTA. In the course of its

argument in this appeal, however, it highlights the passages in the PDD and

correspondence to which I have earlier referred which, it says, made quite clear that it

was concerned at all times with the protections afforded by Chinese law to the

temporarily transferred data.

36. The DPC also found that TikTok had infringed Article 13(1)(f) of the GDPR from 29

July 2020 to 1 December 2022 by failing to provide data subjects with the required

information on its transfers of personal data to China and information as to how the

processing involved remote access to personal data stored in Singapore, Malaysia and

the United States by personnel based in China (these deficiencies were found to have

been rectified in TikTok’s December 2022 EEA Privacy Policy).

37. The decision concluded that where TikTok had failed to verify, guarantee and

demonstrate that the supplementary measures and the SCCs were effective to ensure

that the personal data of EEA users was afforded a level of protection essentially

equivalent to that guaranteed within the EU, the decision in Schrems II meant that the

DPC was empowered to suspend or end the transfers. It found that TikTok had not

established that the risk of access by the Chinese authorities to EEA user data the

subject of the data transfers was theoretical, remote, or hypothetical and unlikely to

arise in practice, as TikTok had contended. Here, the DPC again emphasised that

TikTok’s assessments had failed to clarify whether and the extent to which the

‘problematic laws’ may apply in the context of the transfers, and therefore failed to set

out in a clear way the deficiencies it acknowledged existed in the Chinese legal

framework. Because the assessment was flawed, the DPC said, this interfered with

TikTok’s ability to select appropriate safeguards and supplementary measures, and

prevented it from demonstrating an essentially equivalent level of protection.

Similarly, the decision concluded that while Project Clover (which is addressed by the

DPC in the context of whether data transfers should be suspended) resulted in

significant changes to the manner in which the data transfers were implemented, it had

not changed the fact that the data transfers on an ongoing basis entailed the processing

of EEA user data on computer information systems in China.

38. Having found that it was, in the circumstances, appropriate, necessary and

proportionate to do so, the DPC made an order pursuant to Article 58(2)(j) of the GDPR

requiring TikTok to suspend the data transfers. In reaching this conclusion it explained

(at para. 708):

‘There is a risk to EEA User Data where this data is transferred to a third

country that does not provide a level of protection that is essentially equivalent,

and for which, TikTok Ireland has not verified, guaranteed and demonstrated

that the supplementary measures and the SCCs are effective to ensure that the

personal data of the EEA users is afforded a level of protection essentially

equivalent to that guaranteed within the EU … this infringement is serious in

nature.’

39. The decision thus directed TikTok to ensure ‘that any EEA User Data located in China,

as a result of the Remote Access Solution, when the order takes effect must cease being

processed in China immediately at that point in time. This includes any ongoing

temporary processing of EEA User Data on computer information systems in China’

(para. 704). This part of the order is referred to throughout as ‘the suspension order’.

40. The DPC also made an order pursuant to Article 58(2)(d) of the GDPR requiring

TikTok to bring the processing into compliance in the manner detailed in the decision

(‘the compliance order’). The effect of this order is to require that TikTok remove

access to EEA user data by China Group Entity personnel. The decision provides for a

process intended to enable TikTok to implement measures giving effect to the

compliance order and the suspension order. This involves it being given approximately

three months from the decision to tell the DPC how it plans to give effect to these

orders, with the DPC then engaging with TikTok on that plan, and following agreement

to the terms of that plan, TikTok having a further two months to give effect to it.

41. The DPC imposed administrative fines pursuant to Article 58(2)(i) of the GDPR in the

amount of €485M and €45M. It made clear in its decision that the suspension might, in

the future, be lifted (at para. 673):

‘This order provides for the situation whereby, if measures become available to

make the Data Transfers compliant, then the suspension could be re-considered.

The DPC is not imposing a permanent ban on the Data Transfers, recognising

that new measures, not currently in operation, may yet be capable of being

developed and implemented by TikTok Ireland to compensate for the

deficiencies identified in this Decision. If that situation were to arise, the DPC

would then be in a position to reconsider the suspension.’

The Appeal

42. In these proceedings, TikTok alleges a series of errors in grounding its statutory appeal

against the decision (it has also instituted judicial review proceedings, although these

are not before the court). It says, in particular, that the finding in the decision that

TikTok had continually failed to address the application of Chinese law to the

temporary data was ‘the lynchpin of the Decision’ was a ‘new finding’, was premised

on a ‘new and different concern’ that was not highlighted in the PDD circulated in May

2023, and that this finding was erroneous.

43. TikTok says that there was a failure by the DPC to either assess the third opinion of

Professor Xu or provide any explanation as to why that opinion was rejected by the

DPC. It stresses that the DPC did not advert in its decision to footnote 113 to the July

2024 DTA. It objects that ‘Project Clover’ was addressed by the DPC for the first time

in the draft decision, TikTok not having had the opportunity to make submissions on

that assessment. Project Clover, on TikTok’s case, involved the introduction of very

significant changes to its operations, costing in the region of €12bn over a period of ten

years. Project Clover has three key elements: (a) the creation of a European Enclave

for the default storage of EEA user data to which personnel of the China Group Entities

do not have access, (b) the removal of access by China Group Entities personnel to

more private data (‘protected data’) so that those personnel can remotely access only

what it terms ‘allowable data’ in TikTok’s internal systems, and (c) the implementation

of pseudonymisation measures in respect of the data that personnel of the China Group

Entities are authorised to access to prevent the re-identification of EEA users. All of

this (it is said) results in a significant difference in the content of the data being

temporarily processed. It is also said that this minimises data flows so that only a limited

subset of EEA user data is transferred from the European Enclave to TikTok’s global

data centres in Singapore, the United States and Malaysia in controlled circumstances,

and where necessary for the proper operation of the global TikTok platform. Project

Clover is supervised by an independent third-party security provider. Included in the

evidence submitted by TikTok for the purposes of the stay application was an affidavit

from an independent expert attesting to the effectiveness of the pseudonymisation

measures forming part of the project, which the expert describes as ‘appropriate and in

line with industry good practice’.

44. TikTok says that the DPC having originally failed to identify the temporal scope of its

inquiry, it then (at the end of 2022, and in its Preliminary Draft Decision issued on 17

May 2023) said that it was concerned with transfers taking place from 29 July 2020 and

‘ongoing’, limiting this for the first time to the period from 29 July 2020 to 17 May

2023 in the draft decision. This, TikTok says, had the effect that its ongoing compliance

with Article 46(1) of the GDPR and the steps taken on foot of Project Clover were not

assessed and that its rights to fair procedures were in this way breached. The DPC was

advised of measures being put in place as part of Project Clover on 28 March 2023: by

thereafter retrospectively and without notification changing the time span of the inquiry

without notice in the interim, TikTok says, Project Clover never became part of the

substantive assessment made by the DPC. While the new processes thereby introduced

by TikTok were considered at the point of the DPC’s consideration of remedy, TikTok

says that the DPC never identified precisely what its concerns with Project Clover

actually were.

45. Referring to Schrems II, TikTok says that the power to suspend the transfer of personal

data to a third country arises only where the controller or processor has not itself

suspended or put an end to the transfer, and where in the view of the supervisory

authority (in the light of all the circumstances of the data transfers), the SCCs are not

or cannot be complied with in the third country, and where the protection of the data

transferred that is required by EU law cannot be ensured by other means. Therefore,

TikTok says, the DPC could not find either a breach of Article 46 or make a suspension

order where it has not itself conducted an assessment of relevant aspects of the Chinese

legal system. It objects that the DPC thereby wrongly reversed the burden of proof of

inadequacy, shifting it via ‘the accountability obligation’, onto TikTok. It contends that

the DPC did not conduct a risk analysis as, TikTok says, is required by Article 24 of

the GDPR, and as it ought to have done before making a suspension order.

46. There are other issues identified by TikTok. It argues that the DPC erred in finding that

its privacy policy in place up to December 2022 was in breach of Article 13 of the

GDPR. It says that absent a sustainable finding of negligence (which it says was not

made) administrative fines should not have been imposed on it. TikTok argues that the

DPC erred in calculating the fine imposed upon it by reference to the turnover of

ByteDance, in particular in circumstances where it did not impute liability to

ByteDance for the infringements found in the decision. It argues that the DPC erred in

wrongly concluding that TikTok and ByteDance form part of the same undertaking and

in misapplying a presumption of decisive influence. Complaints are also made that

ByteDance was not advised by the DPC of its intention to determine the fine in this

way, and that the incorrect financial year was chosen for the purposes of calculating the

turnover on the basis of which the fine was imposed. It is also said that the DPC failed

to provide adequate reasons for its decision, and that the fines are not proportionate.

The legal basis for the stay application

47. The inquiry the subject of this appeal is governed by Part 6 of the 2018 Act. This

includes ss. 142, 143 and 150. Section 142 provides for an appeal to the High Court or

Circuit Court against the imposition of an administrative fine (the relevant jurisdiction

depends on the amount of the fine). Section 143(1) provides that where a controller or

processor does not appeal in accordance with s. 142, ‘the Commission shall, as soon as

is practicable after the expiration of the period referred to in that subsection, and on

notice to the controller or processor concerned, make an application in a summary

manner to the Circuit Court for confirmation of the decision’. Section 143(2) allows

the Circuit Court, on the hearing of an application under subsection (1), to confirm the

decision the subject of the application unless the court sees ‘good reason not to do so’.

Section 150 provides that a person affected by certain legally binding decisions of the

Commission may, within 28 days of notice of that decision, appeal same, the High

Court and Circuit Court enjoying concurrent jurisdiction over such appeals.

48. The decision of the DPC provides that the order to suspend data transfers will take

effect on a date six months from the later of (i) the date on which the period allowed

for an appeal against the DPC’s final decision under s. 150 of the 2018 Act has expired;

and (ii) the date on which the period allowed for the bringing of an application for

annulment of any decision of the EDPB under Article 263 of the Treaty on the

Functioning of the European Union (“TFEU”) has expired. Neither the decision nor

the 2018 Act specifies whether, and if so how, the bringing of an appeal against a

decision within the period fixed by s. 150 impacts upon the efficacy of that decision.

49. However, the parties agree that the effect of these provisions is that the obligation to

pay the administrative fines does not arise until the confirmation of the Circuit Court

has issued under s. 143. They also agree that because TikTok has appealed the fine, the

payment obligation is effectively stayed. The parties were in further agreement that

there was no automatic stay on the suspensory or corrective orders made by the DPC,

and they agree that the terms of the decision did not itself result in any such stay once

an appeal was brought.

50. While the parties also agreed that the High Court had jurisdiction to grant such a stay,

their respective understandings of the basis on which the court had the power to make

such an order, diverged. The DPC argued that the power derived from EU law, citing

the decision in Case C-213/89 R v. Secretary of State for Transport, ex parte:

Factortame Ltd. and others (EU:C:1990:257) (“Factortame”’) at para. 21. TikTok

contended that the power derived from the inherent jurisdiction of the High Court, and

the provisions of O. 84C r. 8(2) of the Rules of the Superior Courts (“RSC”). That

provision – part of the Order governing statutory appeals generally – states that on the

return date of a notice of motion initiating such an appeal the court may ‘where it

appears just and proper, make orders for relief of an interlocutory nature, whether in

the nature of an injunction or otherwise.’

51. In circumstances where the parties are in agreement that there is a jurisdiction to grant

a stay, it is not necessary to choose between these different versions of its source.

Indeed, it appears to me that it is at the very least arguable that the power to make what

is in substance a form of interlocutory injunction in support of a legal proceeding before

the court (the statutory appeal) can be rooted in s. 28(8) of the Supreme Court of

Judicature (Ireland) Act 1877. That being so, and while noting the force, logic and

coherence of the judgment of Hogan J. insofar as he locates the authority to make such

an order in Articles 40.3.2° and 34 of the Constitution, for my part I would prefer to

postpone a consideration of this issue to a case in which it is both necessary to answer

the question, and it has been fully argued. It is, of course, the case that the Constitution

envisages a scheme of effective legal remedies. What may not be quite as clear is what,

precisely, this entails, when the entitlement to such remedies arises, what remedies,

exactly, it envisages, whether the initial obligation to enable those remedies in

particular classes of case lies with the Oireachtas, or with the courts, and whether there

are situations in which the Oireachtas can validly decide not to enable suspensory orders

of a particular kind in a particular situation. The answers to these questions may well

throw further light on whether, and if so when, Articles 40.3.2° or 34 of the Constitution

afford a free-standing legal authority for such relief, or whether they are better viewed

as a basis for implying the power to grant such relief into a statutory scheme providing

for appeals of the kind in issue here.

The stay

52. As I have previously observed, the decision was to take effect six months after its

delivery on 30 April 2025. The appeal was commenced by originating notice of motion

issued on 27 May, a stay being sought on 5 June at the same time as an application was

made to admit the proceedings to the High Court’s Commercial List. A temporary stay

was then granted, and this was continued until the hearing of the stay motion, being

thereafter continued again until the determination of that application.

53. TikTok contended that the legal test fixed for that application was as stated in Okunade.

There, Clarke J. (as he then was) (at para. 104) explained how a court should proceed

where it is asked in the course of judicial review proceedings to stay or injunct the

operation of an administrative measure. He explained that the court should first

determine whether the applicant has established an arguable case on the merits; if not

the application must be refused. If such an arguable case is established, the court should

consider where the greatest risk of injustice would lie. In deciding that question it

should give ‘appropriate weight’ to the orderly implementation of measures which are

prima facie valid. It should give such weight as may be appropriate (if any) to any

public interest in the orderly operation of the particular scheme in which the measure

under challenge was made and give appropriate weight (if any) to any additional factors

arising on the facts of the individual case which would heighten the risk to the public

interest of the specific measure under challenge not being implemented pending

resolution of the proceedings. The court, Clarke J. said, should moreover give ‘all due

weight’ to the consequences for the applicant of being required to comply with the

measure under challenge in circumstances where that measure may be found to be

unlawful, it should, in those limited cases where it may be relevant, have regard to

whether damages are available and would be an adequate remedy, and it also should

consider whether damages could be an adequate remedy arising from an undertaking as

to damages. Finally, he said ‘subject to the issues arising on the judicial review not

involving detailed investigation of fact or complex questions of law, the court can place

all due weight on the strength or weakness of the applicant's case’ (id.).

54. The DPC, in response, contended that the correct approach was that adopted by the

CJEU in Zuckerfabrik. This requires establishment of three distinct conditions: (a) that

there are ‘serious doubts as to the validity of’ the measure in question, (b) that a stay is

required as a matter of urgency in the sense that it is necessary in order to avoid serious

and irreversible damage to the party seeking the stay, and (c) that taking account of the

interests of the EU, the urgency outweighs those interests and any other interests arising

(see Case C-334/95 Krüger GmbH & Co. KG v. Hauptzollmamt Hamburg-Jonas

(EU:C:1997:378) at paras. 43-47 and the summary in the judgment of Collins J. in

Three Ireland (Hutchinson) Ltd. and others v. Commission for Communications

Regulation [2022] IECA 300 (“Three”), in particular, at para. 70).

55. The differences between the Okunade test, and that formulated in Zuckerfabrik may be

threefold. First, it has been suggested that the Zuckerfabrik formulation might be

different from the threshold of ‘arguability’ arising in domestic law, in the sense that it

may be necessary to establish a greater degree of doubt as to the validity of the measure

than applicable in the domestic test (Pringle v. Ireland [2012] IESC 47, [2013] 3 IR 1

at paras. 484-485). This, it should be observed is not without doubt: in the course of his

judgment in Eircom Ltd. v. Commission for Communications Regulation [2022] IEHC

165 (at para. 31), MacDonald J. suggested that the requirement that there be ‘serious

doubts’ as to the validity of the EU measure arising under Zuckerfabrik might be

‘substantially the same’ as the requirement in domestic law that there be a serious issue

to be tried, and Mulcahy J. proceeded on that basis in his judgment in this case. It is not

necessary here for me to decide if he was correct in so doing, but I cannot but observe

that the confusion around this issue may be a result of the fact that the test for what is

a ‘serious doubt’ for the purposes of the Zuckerfabrik test may itself be variable,

depending in particular upon the urgency attending the award of interim measures (see

Henry G. Schermers and Denis F. Waelbroeck Judicial Protection in the European

Union (6th edn, Kluwer Law International 2001) at §1401).

56. Second, it has been proposed that the Zuckerfabrik test envisages that interim relief will

not be available unless a threshold of ‘urgency’ is met, the ‘irreparable damage’ that

is viewed as being part of this requirement not being satisfied by purely financial loss,

at least absent very unusual circumstances. Third, while Okunade requires that once

arguability is made out, the court engage in a composite analysis that is ultimately

directed to where the least risk of injustice lies, Zuckerfabrik seems on at least one view

to involve a staged test so that if an applicant fails to establish a probability of serious

and irreparable damage, the application for a stay fails without any necessity to address

the balance of interests (although, as TikTok observed in the course of its submissions,

it has been said that a court hearing an application for interim measures enjoys a broad

discretion, and that there is no rule of EU law imposing a pre-established scheme of

analysis on which the application must be assessed (Case C-397/24 P(R) AQ v.

European Chemicals Agency (ECHA) (EU:C:2024:634) at para. 47)).

57. The DPC maintained that its decision fell to be considered by reference to Zuckerfabrik

rather than Okunade because of the particular position of a lead supervisory authority

under the GDPR. In particular, it said that the provisions of Article 60 of the GDPR,

which require mandatory co-operation between supervisory authorities, had the

consequence that the DPC decision was, in effect, a decision of all supervisory

authorities that is binding across the EEA. It also attached importance to the provisions

of Article 65 of the GDPR, which governs the operation of the EDPB. This entity is

established by Article 68 of the GDPR as a union body with legal personality. It is

comprised of the head of one supervisory authority of each Member State. It may also

render decisions under the GDPR that are addressed to and binding upon the lead

supervisory authority and all other national supervisory authorities concerned where it

is not possible to obtain agreement between the national authorities (Article 65(2)). The

DPC maintained that decisions of the EDPB would, were an attempt made to suspend

them, be governed by Zuckerfabrik and thus, decisions of the national supervisory

authorities should be subject to the same legal regime.

58. The parties being in agreement that TikTok’s challenge met both the threshold of

arguability in national law, and the equivalent threshold according to Zuckerfabrik, the

focus of their respective arguments was upon the damage that TikTok contended it

would suffer were the stay not granted, and the injury to the public interest (and the

rights of data subjects) that the DPC argued would follow if the stay were granted.

59. While I will return later to the detail of its case in this regard, at a general level TikTok

divides its user data into two categories – ‘protected data’ and ‘allowable data’. It

classifies all user data as ‘protected’ unless it has been defined through TikTok’s

internal governance policies as ‘allowable’. Allowable data, in turn, is divided into

three categories – public data, interoperable data and aggregated data. Public data is

publicly available data on the TikTok platform. Interoperable data is data that is

required to make the application work across different regions of the world (for example

where an EEA user wishes to block a non-EEA user). Aggregated data is statistical

data aggregated from public or interoperable data (for example a count of the number

of public videos posted by a user on a given day in a given country). TikTok contended

that implementation of the suspension and compliance orders would require it to (a)

apply technical measures to anonymise any aggregated EEA user data that can be

accessed remotely by authorised personnel of the China Group Entities, and (b) remove

access to EEA user data that is still accessible to those personnel at the end of the

compliance period.

60. To do this, it says, would involve incurring billions of euro in expenditure, that this

would entail considerable disruption to its workforce and business, and would impact

adversely upon the experience of users. It says that a number of its critical business

processes will be severely impacted if access to the data is removed from the China

Group Entities. It claims that thousands of personnel of those entities will have to be

transferred and relocated outside China in order to enable TikTok to return to the same

level of operations in its critical business processes. That, TikTok says, will result in

the loss of valuable skill and knowledge, and it would not be in a position to return to

its previous level of operations until 2029. It says that the measures will be difficult or

impossible to reverse, and that undoing the steps it would have to take would be as

disruptive as putting them in place in the first instance. It also said that these measures

would delay for a short period the introduction of a TikTok service – TikTok shop – in

new countries in the EEA. Stakeholders will, it is said, be driven to competitor

platforms and the degradation of the user experience will damage TikTok’s brand

perception. An expert forensic accountant has prepared a report at TikTok’s request

projecting a consequent lost profit contribution at US$1,716 million, the methodology

of this report being challenged by an expert accountant on whose behalf the DPC has

sworn an affidavit.

61. The DPC, in response (while emphasising the requirement it said was imposed by

Zuckerfabrik that a stay could not be granted to protect purely financial losses, save in

very exceptional and extreme circumstances, and while urging that the losses alleged

by TikTok were entirely financial for this purpose), stresses the central importance to

the proceedings of the rights of TikTok’s EEA users. TikTok having failed to establish

that the protections it had put in place operated to ensure equivalent protection for the

data rights of those availing of its services, the DPC said that transfers were taking place

that did not comply with the GDPR. Those subjects had the right not to have their data

removed from the EU/EEA in those circumstances, and that right was breached for as

long as TikTok was permitted to proceed with the transfers that had been suspended by

the DPC decision. Much of the evidence adduced by TikTok addressing the

consequences for its business if the orders made by the DPC are not stayed are disputed,

and the methodology underlying that evidence was contested by the DPC in its

responding affidavits. The DPC emphasises that the figures suggested by TikTok as

representing the financial impact of the decision represent 4.9% of the net profit of

ByteDance for 2024 and just 1% of the revenue reported for that year. It also stresses

that neither it nor the court is in a position to interrogate the evidence relied upon by

TikTok in this regard. Much of that evidence is dependent on assumptions produced

primarily by reference to information and considerations internal to TikTok that have

not been independently tested and verified. Moreover, it is said, TikTok’s calculations

of its losses assume that there are no alternatives to the solutions proposed by it to obtain

compliance with the DPC decision.

The High Court judgment

62. The application for a stay proceeded over four days from October 7 to 10, 2025.

Mulcahy J. delivered a detailed and comprehensive judgment on 13 November

explaining why he proposed to grant the stay. His reasoning, essentially, was as follows:

(i) He felt that the decision-making procedure created by the GDPR was novel, and

accordingly that the identification of whether the application is governed by

national procedural law or by the criteria governing an application to stay an

EU measure cannot solely be resolved by reference to the distinctions drawn in

Zuckerfabrik or another decision of the CJEU to which I will come presently,

Case C-432/05 Unibet (London) Ltd. v. Unibet (International) Ltd.

(EU:C:2007:163) (“Unibet”). Instead, he felt, the answer must be found in the

terms of the GDPR itself.

(ii) Mulcahy J. stated that it appears from Article 60(6) of that regime that a decision

of a supervisory authority is only binding on the supervisory authorities

concerned, as defined in Article 4(22) of the GDPR. However, he held that

where the transfers in issue are occurring across the EEA, the decision will have

binding effect on most, if not all, supervisory authorities. He held that where the

State has jurisdiction to regulate the activities of a data controller whose main

establishment is in the State, the fact that a decision binds that data controller

within the EU was not a sufficient point of distinction from any other decision

by a national regulator made pursuant to EU law to warrant the disapplication

of national procedural autonomy in proceedings before a national court. He

stated that the novel aspect of the GDPR regime is that the decision binds other

supervisory authorities concerned and observed that this must be understood as

a manifestation of the ‘one-stop shop’ regime. Mulcahy J. held that the decisions

of a lead supervisory authority are not binding as to the interpretation of the

GDPR, rather the purpose is to ensure the integrity of the one-stop shop

mechanism and to enable data subjects and data controllers to deal with a single

supervisory authority in respect of any given issue.

(iii) He found that the GDPR clearly provides that a decision of a supervisory

authority is a decision of that body with the important legal consequence that a

challenge to that decision must be brought in the courts of the Member State in

which that supervisory authority is established. Mulcahy J. stressed that the

GDPR makes no provision for harmonisation of procedural rules for challenges

to decisions made under that Regulation, and noted that Recital 143 of GDPR

expressly provides that ‘proceedings … should be conducted in accordance with

that Member State’s procedural law’. The judge stated that the conferring of

jurisdictions on national courts and the express invocation of national

procedural law must be regarded as a deliberate choice by the legislature. He

stated that it would be a surprising omission if the GDPR does require

harmonisation in relation to applications for interim measures.

(iv) He held that since the EDPB is an EU body established under the GDPR, the

Zuckerfabrik criteria would likely apply to interim relief sought in connection

with a challenge to a decision of that body. He said that while any challenge to

a decision adopted by a supervisory authority on the basis of an EDPB ruling

pursuant to the consistency mechanism must still be brought in the Member

State of that lead supervisory authority, where the validity of a decision of the

EDPB is at issue a national court must refer that question to the CJEU for

determination. He held that where the GDPR expressly recognises that the

validity of decisions of supervisory authorities and of the EDPB must be

determined in different fora, there is nothing anomalous about different criteria

applying in relation to decisions the validity of which must be challenged before

national courts or before the CJEU.

(v) The judge found that the relevant case law is based on the proposition that either

national procedural rules apply or the Zuckerfabrik criteria apply, which, he

stated, reflects the reality; if a national court were required to apply the

Zuckerfabrik criteria to a stay application this would involve a departure from

procedural autonomy, insofar as those criteria differ from those applicable to

stay applications in that jurisdiction. He held that there is nothing in the case

law of the CJEU or of the national courts which suggests that national

procedural autonomy should not apply to applications for a stay.

(vi) Mulcahy J. noted that the issue in the application before him arose from the

procedural rules applicable to a preliminary application and not from the

interpretation of the GDPR. Therefore, he said, the possibility of differing

interpretations or applications of EU law did not arise. He observed that this

court confirmed in Dowling v. Minister for Finance [2013] IESC 37, [2013] 4

IR 576 (“Dowling”) that the national law procedure in relation to the granting

of interim measures respects the principles of equivalence and effectiveness.

(vii) Mulcahy J. said that in this case, not only is there no challenge to an EU

measure, but a significant part of the challenge is advanced on what might be

regarded as purely domestic law grounds. He held that although the decisions

of the DPC are capable of having EU-wide effect, that effect is confined to the

decision concerned and, in substance, the affected parties. Mulcahy J. noted that

such a scope does not require that the procedural autonomy of the courts of a

Member State conferred with jurisdiction be displaced. He held that the decision

fell to be considered in accordance with the principles set out in Okunade.

(viii) As to the adequacy of damages/serious risk of irremediable damage limb of the

test in Okunade, Mulcahy J. was satisfied that TikTok had established to the

requisite standard that it would suffer significant loss if required to give effect

to the suspension order pending the hearing of its appeal. As to the question of

whether any loss which it would suffer would be financial, he stated that the

loss of institutional knowledge and expertise TikTok says it will suffer should

properly be regarded as a pecuniary loss since its impact is on the value of

TikTok’s business. He held that other purportedly non-pecuniary losses,

including damage to TikTok’s brand or its competitiveness must also be

regarded as financial or pecuniary. However, Mulcahy J. stated, the

classification of these losses as financial or pecuniary did not mean that

damages were an adequate remedy, or that the losses should not be regarded as

serious and irreparable. Mulcahy J. noted that the question arose as to whether

damages would be recoverable at all if TikTok incurred losses and ultimately

succeeds in its appeal. He stated that there must be a question over whether an

emanation of the State could rely on a statutory immunity (as is provided for in

s. 154 of the 2018 Act) to defeat a claim for Francovich damages. Accordingly,

he noted that this is a hurdle which any party would have to overcome if seeking

to recover damages in the event of a successful appeal. Mulcahy J. held that

given the scale of potential losses which may be suffered by TikTok, a

hypothetical remedy in damages is not an adequate remedy for TikTok in this

instance. He held that even if the applicable threshold were a risk of serious and

irremediable harm, on the evidence available that threshold would be met.

(ix) As to the least risk of injustice, Mulcahy J. stated that no injustice will have

been done to TikTok by reason of it having to implement the decision, and in

particular, the suspension order pending the determination of its appeal, if the

appeal ultimately fails. He held that all data controllers are required to comply

with the same rules; TikTok cannot be heard to complain if those rules have a

more significant impact on it than on its competitor because of the manner in

which its business is structured. Mulcahy J. held that the potential injustice

which must be weighed in the balance is that of being required to comply with

a decision which is subsequently proved invalid, which must be set against the

injustice which might result if TikTok avoided, or delayed, complying with a

decision the validity of which is upheld. He commented that in Okunade the

Supreme Court indicated that all appropriate weight should be given to the

importance that presumptively valid decisions be implemented. Mulcahy J. held

that that requirement is of particular significance where what is at issue is a risk

to fundamental rights. However, he held that the application cannot simply be

resolved by an invocation of such rights. He stated that were it the case that the

engagement of fundamental rights by a decision defeated any private interest

which might be asserted, this would negate the balancing exercise mandated by

national and Union law rendering a stay unavailable, undermining the potential

effectiveness of that remedy. Mulcahy J. held that there were a variety of factors

which point to the conclusion that the least risk of injustice would be served by

a limited stay on the suspension order, subject to certain conditions.

(x) As to the length of the stay which is required to avoid the most immediate risk

of injustice, Mulcahy J. noted that the decision provided a period of six months

before the suspension order comes into effect. He stated that as a consequence

of the temporary stay, which was granted when the proceedings were entered

into the Commercial List, that period would expire towards the end of March

2026 if he refused to continue the stay. He stated that TikTok will be required

to take steps in advance of the suspension order taking effect and therefore it

does not have the full benefit of the six-month implementation period before

needing to take potentially irreversible steps. Mulcahy J. held that a short further

delay in TikTok’s compliance with the orders pending the determination of these

proceedings does not greatly increase the risk that TikTok’s failure to comply

with Article 46 of the GDPR poses. He noted that the DPC has not concluded

that the personal data at issue is not subject to equivalent protection in China to

that which it would enjoy in the EU, rather that TikTok has failed to discharge

its obligations to establish that the personal data is subject to such protection.

The judge held that there is no finding that there is a current breach of Article

46. He held that a stay posed no risk to the orderly implementation of the GDPR

regime, nor to the implementation of the decision in due course. Mulcahy J.

stated that it was not clear whether TikTok’s users had been advised of the

DPC’s findings against TikTok, in particular, that it has not complied with

Article 46 in relation to the transfers. He held that any concern about the limited

short-term risk to TikTok users’ fundamental rights would be somewhat

ameliorated if their continued engagement with the platform was on a basis

where they were was informed as to the issues identified by the DPC.

63. Mulcahy J. granted the stay pending the determination of the substantive appeal. He did

so on the basis of an undertaking by TikTok to prosecute its appeal with all reasonable

diligence and, in any event, to ensure insofar as it is within TikTok’s power to do so,

that the appeal is heard not later than March 2026. He stated that TikTok was required

to notify, in a manner to be agreed, or in default as directed by the court, all of its users

of the DPC’s decision in clear and easily understood language.

Zuckerfabrik

64. The test posited by the Court of Justice in Zuckerfabrik falls to be understood against

the background of its earlier decision in Factortame. There, it was found that national

courts when applying community measures having direct effect must enjoy the power

to make interim orders protecting the rights thereby asserted against Member States.

The issue in Factortame arose in proceedings in which it was said that primary

legislation introduced in the United Kingdom imposing nationality requirements on the

ownership of fishing vessels was contrary to Community law. Interim relief was sought

before the English courts suspending the application of that legislation pending a

challenge in those courts to the validity of the measures. The Court of Justice answered

a referred question of whether it was permissible for national law to preclude interim

relief in these circumstances – as the law of the United Kingdom did – on the basis that

national rules which prevented, even temporarily, Community rules and judgments

from having full force and effect are incompatible with requirements of the full

effectiveness of Community law. Moreover, it held that it would impair the

effectiveness of the provision then governing the making of references to the Court of

Justice, Article 177 of the EEC Treaty (now Article 267 TFEU), if a national court

having stayed proceedings pending a reply by the Court of Justice to a referred question,

was not able to grant interim relief until it delivered its judgment following the response

of that court.

65. The Court of Justice did not answer a second question referred to it as to the criteria to

be applied in deciding whether or not to grant such relief. The Advocate General had

proposed that those criteria would be a matter for national law, subject to the national

law rules not rendering exercise of the rights impossible and to these being no less

favourable that those available in cases relating only to national law (para. 34; Advocate

General Tesauro). Before the Court of Justice, all parties appear to have accepted that

the test was governed by national law, the European Commission in fact urging that the

approach set out in American Cyanamid Co. v. Ethicon Ltd. [1975] AC 396 was

appropriate in the circumstances. That view commanded some support in the academic

commentaries at that time (see, in particular, Peter Oliver, ‘Interim Measures: Some

Recent Developments’ (1992) 29 Common Market Law Review 7, 12). It might be

thought that this was understood by all involved as following inevitably from the

principle of national procedural autonomy: the substantive issue in the case was

addressed to the validity of a national law, not of a community measure, and would be

decided by the national courts applying their own procedural law. There was every

reason to assume that the conditions attached to the grant of any suspensory relief would

also be a matter for the national courts applying their own rules of procedure.

66. While it might be said that Zuckerfabrik concerned the same general issue as did

Factortame – the power of national courts to grant interim relief the effect of which

was to suspend the implementation of measures that were said to conflict with EU law

– it did so in a fundamentally different context. In Zuckerfabrik, the underlying

challenge sought the annulment of both Council Regulation (EEC) 1914/87 and of a

national decision (“the decision”), imposing levies that implemented that Regulation.

The effect of the impugned provisions was to require payment by the applicant sugar

producers of significant sums intended to contribute to losses sustained by the

Community from sugar exports. The applicants brought an action before the national

courts seeking annulment of the decision, in support of which they contended that

Council Regulation (EEC) 1914/87 was invalid. They sought interim orders suspending

the obligation to make payments on foot of the decision until the Court of Justice had

ruled on the validity of Council Regulation (EEC) 1914/87 pursuant to the necessary

reference from the national courts to that end. One of the questions referred to the Court

of Justice was directed to whether a national court had the power to grant the interim

suspensory orders in question.

67. Whereas in Factortame the preclusion on the grant of interim measures derived from

national law (the common law of the United Kingdom not permitting orders suspending

the operation of primary legislation), in Zuckerfabrik the apparent obstruction to the

grant of this relief arose from EU law and, in particular, from the view that for national

courts to interfere with the implementation of Community law would be beyond their

competence having regard to the supremacy of Community law. That clog was easily

removed: the legal protection guaranteed by Community law, it was found, includes the

right of individuals to challenge the legality of Community regulations before national

courts and to request those courts to make a reference for a preliminary ruling. That

right would be compromised if individuals were not, pending the decision of the Court

of Justice on foot of that reference, in a position to obtain a decision granting suspension

of the enforcement of regulations thereby impugned (the national courts, of course,

themselves not having the power to rule that a Community act is invalid, Case 314/85

Foto-Frost v. Hauptzollamt Lübeck Ost (EU:C:1987:452 ). In that regard, the court,

referring to Factortame, said that the interim legal protection which Community law

ensures for individuals before national courts must remain the same irrespective of

whether they contest the compatibility of national legal provisions with Community

law, or the validity of secondary Community law, in view of the fact that the dispute in

both cases is based on Community law itself (para. 19-20). That statement, however,

was made in a context in which the validity of the national measure was entirely

dependent on the validity of the Community law, and in which the decision of the

national court as to the former would be dictated by that of the Court of Justice

regarding the latter.

68. Thus, it was the fact that Article 185 of the EEC Treaty (in the context of applications

for annulment) expressly enabled applicants to request the suspension of enforcement

of a contested act by the Court of Justice itself, that drove and determined scope of this

conclusion. Logically, if in such an annulment action the Court of Justice could order

interim suspension of an impugned measure, the national courts should be able to grant

similar relief where they referred the same question of validity to the Court of Justice.

As the court put it: ‘the coherence of the system of interim legal protection therefore

requires that national courts should also be able to order suspension of enforcement of

a national administrative measure based on a Community regulation, the legality of

which is contested’ (para. 18). Since the power thus deduced by the court corresponded

to that under Article 185, the conditions it imposed were those established and applied

by the court in deciding applications in proceedings brought pursuant to that provision.

Such uniform application, the court said, is a fundamental requirement of the

Community legal order. So, while the suspension of enforcement of administrative

measures based on a Community regulation was ‘governed by national procedural law,

in particular as regards the making and examination of the application’, the

‘conditions’ to which the application was subject must be ‘uniform so far as the

granting of such relief is concerned’ (para. 26). One of those conditions was that

suspension was necessary ‘in order to avoid serious and irreparable damage to’ the

party seeking the order (para. 28). Importantly, it was said, ‘purely financial damage

cannot, as the Court has held on numerous occasions, be regarded in principle as

irreparable’ (para. 29).

69. The conditions thus imposed by the court were conditions of Community law, and not

of national law. That corresponded not only with the theory on which the power was

based (that the right to challenge Community legislation in national courts and to

request a reference to the CJEU would be diminished if those courts were unable to

make such suspensory orders) but it reflected the fact that the national court was never

going to decide the issue of validity; its interim orders were not merely suspensory, but

preliminary to the decision of the Court of Justice itself on the underlying challenge to

the validity of the Regulation. The parasitic attack on the national measures was entirely

dependent on the success of the claim that the Regulation was invalid. That decision,

obviously, would be made by the European Court only by reference to EU law.

70. The criteria by reference to which such suspensory orders are made was developed in

the subsequent cases (see Case C-465/93 Atlanta Fruchthandelsgesellschaft mbH and

ors v. Bundesamt für Ernährung und Forstwirtschaft (EU:C:1995:369) and Joined

Cases C-453/03, C-11/04, C-12/04 and C-194/04 ABNA Ltd. and ors v. Secretary of

State for Health and ors (EU:C:2005:741)), propounding the factors to which I have

earlier referred – proof that there are serious doubts as to the validity of the measure in

question, that a stay is required as a matter of urgency in the sense that it is necessary

in order to avoid serious and irreversible damage to the party seeking the stay, and that

the urgency outweighs the interests arising. Moreover, and as the DPC points out in its

submissions, the law is now that pecuniary damage will generally be considered serious

and irreparable only where the applicant can establish that absent a stay it would find

itself in a situation likely to jeopardise its financial viability, or its market share would

be significantly altered and there would be structural or legal obstacles preventing it

from regaining that share (Case T-139/24 R Webgroup Czech Republic v. Commission

(EU:T:2024:475) at paras. 77-81, upheld in C-620/24 P(R) WebGroup Czech Republic

v. Commission (EU:C:2025:136) at para. 19).

71. The CJEU case law suggests that at least part of the reason that financial losses will not

constitute an irreparable damage is that they can be recovered in an action for damages

under the theory recognised by the Court of Justice in Joined Cases C-6/90 and C-9/90

Andrea Francovich and Danila Bonifaci and ors. v. Italian Republic (EU:C:1991:428)

(“Francovich”). However, this means that a person who might have a theoretical claim

to damages under Francovich if the challenged decision is declared invalid, may well

never obtain such damages, with the result that their application for interim relief has

been refused on an assumption that has not materialised. The consequence is, as Collins

J. put it in Three (at para. 87):

‘…financial loss might be regarded as reparable even though the prospect of

actually recovering monetary compensation was limited by reason of the

restrictive rules governing the non-contractual liability of the Union and its

institutions (rules which, as mentioned, apply also to the non-contractual

liability of Member States under Francovich).’

72. The ‘restrictive rules’ to which reference is made here derive from Joined Cases C-

46/93 and C-48/93 Brasserie du Pêcheur SA v. Germany and R v. Secretary of State for

Transport, ex parte: Factortame Ltd. and ors (EU:C:1996:79) (“Brasserie du

Pêcheur”). There it was explained that the right to recover financial loss consequent

upon breach of provisions of EU law depended not merely upon the rule of law

infringed being intended to confer rights on individuals, and that loss causation be

established, but also that ‘the breach must be sufficiently serious’ (para. 51). That latter

requirement meant that the Member State ‘manifestly and gravely disregarded the

limits on its discretion’ (para. 55), that in turn enabling a consideration of the following

factors (para. 56):

‘the clarity and precision of the rule breached, the measure of discretion left by

that rule to the national or Community authorities, whether the infringement

and the damage caused was intentional or involuntary, whether any error or

law was excusable or inexcusable, the fact that the position taken by a

Community institution may have contributed towards the omission and the

adoption or retention of national measures or practices contrary to Community

law.’

73. In the course of his opinion in Francovich, the Advocate General (Mischo) observed

the combined effect of Factortame and Zuckerfabrik as being that Community law

could directly confer on national judicial authorities the power to ensure effective

protection of rights and could lay down conditions governing the exercise of the

jurisdiction which it thus conferred on national courts (para. 55). He also said that it

was ‘not to be excluded’ that the conditions for the grant of the suspension of the

operation of a national administrative measure set out in Zuckerfabrik might also

govern the suspension of the operation of a national statute which was contrary to

Community law (id.).

74. That this was not so was made clear in Unibet. There, a series of questions were referred

by a Swedish court in proceedings brought by claimants seeking to challenge the

compatibility with EU law of provisions of national legislation prohibiting the

advertising by foreign gaming companies of their services. One of the questions was

directed specifically to whether in such a case, an application for interim relief was

governed by national law, or whether the national court must apply the criteria outlined

in Community law for interim protection. Both the Advocate General (Sharpston) and

the court concluded that, provided the remedies met tests of effectiveness and

equivalence, the criteria governing their grant were fixed by national and not

Community law.

75. In reaching that conclusion each started from the premise that it is for the domestic legal

systems to lay down the detailed procedural rules governing actions for safeguarding

Community law rights subject to principles of effectiveness and equivalence. From

there, the opinion and judgment variously observed (a) that the case was concerned

with a national law measure, (b) by definition it applied in only one Member State, (c)

that it was more logical for the procedure governing interim suspension of a national

law on grounds of alleged incompatibility with Community law to be the same as that

governing interim suspension of a national law on other purely domestic grounds, (d)

that the rationale of Zuckerfabrik (that there was a Community interest in having

uniform criteria governing interim orders where only the CJEU has jurisdiction to

declare the measure invalid) was inapplicable where the underlying challenge was to a

measure of national law (the foregoing all appear in the opinion of the Advocate

General at paras. 91-94) and (e) that where the issue in the underlying proceedings was:

‘…the effects of national legislation where the compatibility of that legislation

with Community law is contested … in the absence of Community rules

governing the matter, it is for the domestic legal system of each Member State

to determine the conditions under which interim relief is to be granted for

safeguarding an individual’s rights under Community law’

(judgment of the court paras. 79 and 80).

76. In Dowling (where the court confirmed that the Okunade test satisfies the requirements

of equivalence and effectiveness), this court fixed the test derived from Zuckerfabrik as

operating where there is a challenge to the validity of an EU act. It observed of the

decision in Unibet (at para. 86):

‘where there is a challenge to a national measure, national procedural rules

are to apply subject to the principles of equivalence and effectiveness. It follows

that it is possible that different results might arise in different member states, in

the event of a challenge to similar national measures, because of the

applicability of different procedural regimes, provided always that each such

regime must provide an effective remedy.’

Which test?

77. The argument advanced by the DPC – urged forcefully and at points ingeniously by

Ms. Smith SC and Ms. Donnelly SC – revolved around what they presented as the sui

generis and unique nature of the DPC decision in issue. In that regard, the argument

focussed on the ‘one-stop shop’ put in place by the GDPR. The DPC emphasised that

the effect of Article 60 GDPR is that the lead supervisory authority cannot reach a

decision of the kind in issue here without the agreement of all ‘supervisory authorities

concerned’ (that is authorities in states in which data subjects who are substantially

affected or likely to be so affected by the processing reside (Article 4(22) of the

GDPR)). Where a draft decision is submitted to the supervisory authorities concerned

(as is required) and where a reasoned objection is communicated by such a supervisory

authority, the lead supervisory authority must submit the decision to a consistency

mechanism provided for in Articles 63-65 of the GDPR. That mechanism, broadly,

involves the formation by the EDPB of an opinion which, if not accepted by the lead

supervisory authority, will be followed by a decision of the EDPB which shall be

binding on the lead supervisory authority and the other supervisory authorities. The

lead supervisory authority must, under Article 65(6) then adopt its final decision ‘on

the basis of’ the decision of the EDPB. Thus, if that process had been exhausted in the

inquiry undertaken by the DPC into TikTok and the decision questioned by a

supervisory authority concerned, the ultimate decision would – although legally that of

the DPC – comprise a decision in substance made by the EDPB.

78. Recital 143 expressly provides that:

‘where a decision of a supervisory authority implementing a decision of the

Board is challenged before a national court and the validity of the decision of

the Board is in issue, that national court does not have the power to declare the

Board’s decision invalid but must refer the question of validity to the Court of

Justice …’.

79. The DPC says that that decision, thus, could only be annulled by the CJEU, could only

be suspended in accordance with Zuckerfabrik, and, it followed, the same legal theory

should apply to all such decisions of the DPC. There would, the DPC argues, be a

‘fundamental illogicality’ if one test governed the suspension of a decision where there

had been disagreement between the supervisory authorities concerned, but another

where there had not. Indeed, it was observed in submissions, it was in theory possible

that a decision of a lead supervisory authority could be challenged on grounds that could

only be adjudicated upon by the CJEU, but also on other grounds that were not

dependant on the EDPB decision. That, it was suggested, demanded that the same test

for the grant of an interim stay be applied across the board.

80. If, in contrast, the decision is not the subject of a reasoned objection, Article 60(6)

provides that the supervisory authorities concerned are ‘deemed to be in agreement with

that draft decision and shall be bound by it’. Although normally the lead supervisory

authority is responsible for adopting and notifying the controller or processor of the

decision (Article 60(7)), Article 60(8) provides that where a complaint is rejected, the

supervisory authority where the complaint was lodged, instead of the lead supervisory

authority, is responsible for adopting the decision and notifying the complainant.

Article 60(9) provides that where a complaint is upheld in part and rejected in part, the

lead supervisory authority is responsible for adopting the portion of the decision

wherein the complaint is partially upheld and notifying it to the controller, while the

supervisory authority where the complaint was made is responsible for adopting the

portion of the decision wherein the complaint is partially rejected and notifying it to the

complainant. This, the DPC explains, is for the purpose of determining the Member

State within which the decision can be challenged. In this way, it urges, the consistency

and co-operation mechanism ensures that all decisions of supervisory authorities

involving cross-border processing are made either jointly with the consensus of all

supervisory authorities concerned under Article 60, or are made pursuant to a binding

decision of the EDPB, an EU body, under Article 65. All such decisions are binding

throughout the EU/EEA.

81. The DPC framed these provisions as part of a broader context whereby the object of

the GDPR is to obtain a consistent, equivalent and high level of protection of personal

data across all Member States, arguing that this demanded that the approaches adopted

by different supervisory authorities are not fragmented, and are homogenous. All of

this, it contended, dictated that the conditions attaching to the making of interim orders

the effect of which would be to suspend a decision of a lead supervisory authority had

to be uniform and thus governed by EU law. Moreover, it said, decisions of a lead

supervisory authority of the kind in issue here necessarily affected data subjects

throughout the EU/EEA, thereby demanding a single rule of law governing the making

of such interim suspensory orders. Thus, it contended, the position was closer to

Zuckerfabrik than to Unibet, in the latter of which the Advocate General had

emphasised that it was appropriate that interim orders be governed by national

procedural law because they applied in only one Member State.

82. The various facets of this sophisticated argument break down when attention is paid in

the first instance not to the legal regime governing the grant or withholding of interim

measures, but to (a) the law that ultimately determines whether the decision challenged

is valid or invalid, (b) the location of the power to hear and decide that challenge, and

supervisory authority. It follows from the third of these, in particular, that only one

national court can stay that decision, so the risk of inconsistent decisions across the

network of national courts that featured in Zuckerfabrik, does not arise. Each of these

three features of the legal context should, moreover, be viewed in the light of the fact

that notwithstanding the need for agreement with other supervisory authorities,

decisions of the lead supervisory authority such as that in issue here, are those of that

authority alone, and this remains the situation even where the EDPB has issued a

decision (Case C-97/23 P WhatsApp Ireland v. European Data Protection Board

(EU:C:2026:81)).

83. Article 78 of the GDPR provides that each natural or legal person shall have the right

to an effective judicial remedy against a legally binding decision of a supervisory

authority concerning them. It states that proceedings against a supervisory authority

shall be brought before the courts of the Member State where that authority is

established. This means – and there was no dispute about this – that it is Irish law that

will determine not merely the substantive law by reference to which the legality of the

decision is determined, but also the standard of review, the admissibility of evidence

on review, the procedures governing that review, and the threshold for judicial

intervention. This point was specifically debated by members of the court with counsel

for the DPC in the course of the hearing: when the court at the end of the day decides

to allow the statutory appeal, or to disallow it, it does so on the basis, counsel said, of

Irish law, not European law. Of course, some challenges will be based on the principles

of EU data protection in general, and the provisions of the GDPR in particular, but this

is not the only basis on which a decision of the DPC could be found invalid. As this

case shows, it is to be expected that some challenges will raise issues of procedural

fairness, and the exact parameters of those principles will be products of national law.

In a similar vein, counsel urged that even if a ground of appeal was solely and

exclusively based on national law, the Zuckerfabrik test would continue to apply, yet in

that very situation Francovich damages would not lie.

84. All of this exposes an incoherence in the legal framework as it is viewed by the DPC –

that a court would apply a test which, as Zuckerfabrik shows, is one of EU law, to

determine the incidental question of whether a decision should be suspended, but an

Irish law test to the fundamental and substantive question of whether the challenged

decision is actually valid. It also reveals that the GDPR enabled a far more fundamental

fragmentation of the decision-making process than will follow from the application of

national law to the question of an interim suspension. To take one example instanced

in the DPC’s submissions, where data controllers with their main establishments in

different Member States infringe the GDPR in the same manner, not only might one

obtain a stay, while the other might not, but one may secure a determination of

invalidity by reference to legal or procedural rules that are not applicable to the other.

It would also mean that in a case in which the ground of challenge was only one of

national law, the court would be applying that EU law test to determine if there should

be suspension, the test incorporating a consideration of the merits of the case, but those

merits being determined not by EU law, but by domestic law. The test would function

on the basis that financial losses alone would not suffice to ground a stay because of

the availability of Francovich damages, yet in that situation Francovich damages would

not – on the DPC’s account of the law – be available at all. This is far removed from

the position in Zuckerfabrik where the entire basis for the challenge to the national law

measure was predicated on the challenge to the validity of the underlying Regulation,

that challenge being one determined by the Court of Justice by reference to its

procedural law, and exclusively by reference to EU law.

85. Some discordance, as it were, is a necessary consequence of the failure to harmonise

the rules governing substantive legality and, indeed, this was expressly recognised by

this court in Dowling (at para. 86, which I have earlier quoted). The real question is

where the discordance should lie, and how it can be minimised. What the DPC contends

for is the deduction from the GDPR of partial – and selective – harmonisation of the

rules governing interim suspension pending an adjudication as to validity, where there

has been no comprehensive harmonisation of the rules that actually govern legality.

That is both illogical and unprincipled. There has never been a case in which it has been

remotely suggested that EU law dictates the terms of an interim suspension of a

challenged decision where EU law does not itself exclusively determine the basis on

which the decision can be challenged, let alone a case in which the issue of validity

would in actuality be decided not by the CJEU, but by the national court. The effective

qualification of national procedural autonomy demanded by the decision in

Zuckerfabrik was the product of the need to align the jurisdiction of national courts to

receive a challenge to the validity of an EU measure, with the legal framework within

which such a measure could be annulled by the CJEU itself. The context was one in

which, as I have earlier observed, the challenge to the national measure was entirely

parasitic upon the CJEU’s decision as to the validity of the EU measure. It followed

logically that the conditions for suspension of each must be the same. That rationale is

of no application to the challenge the subject of these proceedings, which will be

decided by national courts quite independently of the outcome of any proceeding before

the CJEU.

86. In fact, far from authorising that partial harmonisation, the GDPR proposes the

opposite. Noting – as counsel for the DPC acknowledged in the course of submissions

– that national procedural autonomy is the ‘default position’, Recital 143 provides that:

‘[p]roceedings against a supervisory authority should be brought before the

courts of the Member State where the supervisory authority is established and

should be conducted in accordance with that Member State’s procedural law.

Those courts should exercise full jurisdiction, which should include jurisdiction

to examine all questions of fact and law relevant to the dispute before them’.

87. That unqualified assertion of national procedural autonomy does not – as the DPC

stresses – appear in the text of the GDPR, but it affords a strong indication of legislative

intent and an affirmation of what follows from what the Advocate General in Unibet –

hardly controversially – described as ‘the general rule’. That she made that comment

when considering the test to be applied to interim suspensory measures demonstrates

that these are indeed matters of procedural and not substantive law, that prima facie fall

within the purview of national law (subject of course to requirements of equivalence

and effectiveness). When viewed in that way, it is difficult to accept the argument

suggested by the DPC that the reference to national procedural law incorporated tests

developed by the CJEU and imposed by reason of the requirements of EU law. National

procedural autonomy arises precisely because there are no EU rules governing a matter,

and thus demands that the Member States ‘lay down the detailed rules of administrative

and judicial procedures designed to ensure a high level of protection of rights which

individuals derive from EU law’ including ‘how the remedies provided for by

Regulation 2016/679 must be implemented…’ (Case C-132/21 BE v. Nemzeti

Adatvédelmi és Információszabadság Hatóság (EU:C:2023:2) (“BE”) at paras. 45 and

46).

88. Indeed, the CJEU has consistently referenced the interpretation of Article 78 of the

GDPR to the provisions of Recital 143 (see BE at para. 41 and Joined Cases C-26/22

and C-64/22 UF and AB v. Land Hessen (EU:C:2023:958) at para. 52). From that, one

might generally expect some express deviation from the apparent terms of Recital 143,

had such a deviation been intended, not least of all in a context in which the departure

from the application of national law contended for is partial rather than complete. At

issue in this case is – as in Unibet and Factortame – a national measure the legality of

which will be judged by the standards applied by national law to all such decisions. It

would be surprising in those circumstances were EU law to prescribe the mechanisms

that will protect the effectiveness of any remedy ultimately granted (subject of course

to the national rules complying with principles of effectiveness and equivalence), and

astonishing if the displacement of those rules were to occur implicitly and without any

indication of a legislative intent to do so. For those reasons, the contention of the DPC

that the appropriate test to be applied to this application is that derived from

Zuckerfabrik must be rejected.

The request for a reference to the CJEU

89. The DPC has requested, in the event that the court disagrees with the position it urges

as to the applicability of the Zuckerfabrik test to this application, that we make a

reference to the CJEU as to that issue. The DPC urges – and in this respect I think it

correct – that the disapplication of the obligation on a final instance national court to

make a reference in interlocutory matters as suggested in Case C-107/76 Hoffmann-La

Roche AG v. Centrafarm Vertriebsgesellschaft Pharmazeutischer Erzeugnisse mbH

(EU:C:1977:89) (at paras. 5-6) operates only where the issue provisionally decided in

the interlocutory proceedings may be re-examined in the substantive proceedings and

may be subject to a reference to the CJEU at that point. Nonetheless, I agree with Hogan

J.’s explanation in his judgment of the difficulties that arise when seeking to apply the

third paragraph of Article 267 to decisions such as that in issue here, given the

disinclination of the CJEU to address a matter that is no longer live and/or has been

overtaken by events. It is, I think, for this combination of reasons that the texts

recognise the reality that references are but rarely made in applications for interim

injunctions (see Schermers and Waelbroeck at §542). To that extent, and for the reasons

outlined by Hogan J., a reference should not be made.

90. That said, for my part I do not believe that this is a case which meets the conditions for

an obligatory reference as postulated in the case law of the CJEU. The substantive

argument advanced by the DPC runs directly contrary to the decision of the court in

Unibet. There is no decision of the CJEU subsequent to Unibet that comes close to

suggesting the decision in Unibet should be limited in the manner necessary to sustain

the DPC’s argument – that is restricted in its scope to measures that may have an effect

only in the Member State in which the relief is sought. Any such test would be hard to

formulate with any useful precision, and the reference in Unibet to this consideration

must be understood as descriptive of the case before the court, and not prescriptive of

any test.

91. The decision in Zuckerfabrik was addressed to the grant of interim suspensory relief

pending the determination by the CJEU of a challenge to the validity of an underlying

EU act. It is only where an applicant seeks to stay a national measure implementing

such an EU act pending such a challenge, that the test outlined in Zuckerfabrik is

engaged. The rationale for the decision does not extend to a measure promulgated by a

national authority, the validity of which is tested before a national court, and the legality

of which may be decided in accordance with national law. It would be counterintuitive

and illogical to render the grant of interim relief pending the outcome of a legal

proceeding subject to a rule of EU law derived from the decision in Zuckerfabrik, when

the legal proceeding itself will be determined in accordance with national law. Far from

the GDPR suggesting any basis on which such a principle could be adopted by national

courts, its terms are consistent only with the contrary. That the material provided by the

parties (while noting the reservations of the DPC on some aspects thereof) suggests that

this is the view seemingly adopted in all other jurisdictions to have addressed this or

similar issues only reinforces the conclusion that this case comes within the

construction of the third paragraph of Article 267 TFEU posited by the court in Case

C-561/19 Consorzio Italian Management and anor. v. Rete Ferroviaria Italiana SpA

(EU:C:2021:799) (at para. 33): the issue is the subject of a decision of the CJEU

(Unibet), and the correct interpretation of EU law is ‘so obvious as to leave no scope

for any reasonable doubt’.

92. Finally – and in this regard also I agree with the judgment of Hogan J. – if the approach

to the grant of interim stays to decisions of bodies such as the DPC I suggest later in

this judgment is properly applied, the differences between the test applied by national

law and that proposed in Zuckerfabrik are not necessarily substantial. In and of itself,

this is a basis for refusing to refer.

Okunade

93. The significance of the decision in Okunade lay in the fact that, for the first time, the

court sought to take account in structured way of the particular features of suspensory

orders made in the course of legal challenges to the validity of administrative decisions.

I have outlined earlier the approach formulated by the court to that end. In this appeal,

however, the question of how that methodology falls to be applied arises in a very

particular context. Unlike some administrative decisions – including that in issue in

Okunade itself – the application in issue here arises from a decision that does not just

directly affect one person or a small number of persons. It impacts TikTok, obviously,

but also potentially affects the interests of many users of its services, whose

fundamental rights in the protection of their personal data may be impacted by the

decision of the DPC and, in consequence, the suspension of that decision. It is a decision

which, as Hogan J. observes in the course of his judgment, is akin to a legislative

measure of general application.

94. In Pesca Valentia Ltd. v. Minister for Fisheries and Forestry [1985] IR 193 this court

rejected the argument advanced by the defendants in that case that where an

interlocutory injunction was sought restraining the enforcement of conditions attached

to a fishing licence granted pursuant to a statutory provision that expressly allowed the

imposition of such conditions, a special principle should be applied to reflect the fact

that the effect of the injunction would be to suspend the exercise by the Minister of a

power expressly granted to him by law (see the judgment of Finlay CJ, with whom

Walsh, Griffin, Hederman and McCarthy JJ. agreed, at p. 201). Insofar as that case

suggests that the court should approach the making of orders suspending the operation

of acts of this kind by simply applying the test previously understood as following from

Campus Oil v. Minister for Industry (No.2) [1983] IR 88 (“Campus Oil”) (that is by

inquiring into whether the plaintiff has established a fair question to be tried, whether

damages would be an adequate remedy for the plaintiff if the injunction is not granted

and they succeed in their claim, and whether the balance of convenience favours the

grant or refusal of such relief) it should no longer be viewed as good law. Even on its

own terms, the decision in Pesca Valentia sits in the teeth of a number of earlier

decisions in which similar injunctive relief was emphatically refused, and in particular

with the importance attached by the court in Campus Oil itself to the presumptive

validity of a ministerial order made pursuant to statute (see the judgment of O’Higgins

CJ in Campus Oil at p. 107 and James P. Casey ‘Constitutional Law – Enjoining the

Enforcement of Statutes’ (1985) 7 DULJ 123). In point of fact, not long after Pesca

Valentia was decided, in Cooke v. Minister for Communications (Irish Times Law

Report, 20 February 1989) the court refused an application for an interlocutory

injunction restraining the enforcement of provisions of the Radio and Television Act

1988 pending a challenge to the constitutional validity of certain provisions of that

legislation: an injunction, it was said, could not be granted if it had the effect of

permitting illegal activity (although similar orders suspending the enforcement of the

Wireless Telegraphy Acts against the plaintiffs were made by the High Court in

Carrigaline Community Television v. Minister for Transport [1994] 2 IR 359, being

subsequently upheld in this court). The actual decision in Pesca Valentia, it might also

be observed, was unusual : the court seemed to suggest that if the challenge ultimately

failed, the plaintiffs could be prosecuted for breach of the licence conditions during the

pendency of the stay – a conclusion that might be thought inconsistent with the grant

of the injunctive relief sought.

95. More fundamentally, the court in Merck Sharp & Dohme Corporation v. Clonmel

Healthcare Ltd [2019] IESC 65, [2020] 2 IR 1 (“Merck”), has reframed the decision in

Campus Oil. The court has thereby made it clear that Campus Oil should not be

understood as positing a single test for the grant of an interlocutory injunction in all

cases. Instead, it will on occasion require substantial qualification and exception. Thus,

it was that the test derived from that case was explained as resolving many applications

for interlocutory injunctions and as a valuable guide to the analysis of any application,

but not as prescribing ‘strict mechanical rules for the control of future cases’

(O’Donnell J. (as he then was) in Merck at para. 34). Reflecting the rationale of

Okunade, O’Donnell J. stated that the underlying theme of the decision in American

Cyanamid was in its assertion of the flexibility of the remedy and the essential function

of an interlocutory injunction in ‘finding a just solution pending the hearing of the

action’ (para. 34).

96. When applied to the suspension of legal provisions or administrative decisions of the

kind in issue in this case, that analysis demands the consideration of three particular but

related factors. First, in cases of this kind, the availability of damages or compensation

simply cannot discharge the decisive function it does in private law proceedings.

Usually, in domestic law absent proof of a reckless or knowing excess of power,

damages will not be available for losses caused by an invalid administrative decision.

As I have explained, Francovich damages, where they arise, are also subject to quite

particular restrictions which will often function to prevent the award of damages for

losses caused by bona fide decisions made by statutory bodies when exercising

discretionary powers. Conversely, the interests sought to be protected by a respondent

in such proceedings may not be reducible to damages capable of recovery on foot of an

undertaking and, if they are, any financial loss arising from the failure to implement

such a decision will often have been suffered not by the public body defending the

proceedings, but by third parties. Therefore, in the vast majority of applications for

stays or injunctions to arrest the operation of legislation or decisions of administrative

agencies in the exercise of their statutory powers, any debate about whether loss or

damage is or is not capable of calculation is futile. At the very least, in this regard, the

focus of such applications must be quite different from that in a private law action.

97. Second, decisions of the kind in issue here attract in law a presumption of legal validity,

to which a court must insofar as possible, give effect. There is, it has been frequently

emphasised, a corresponding public interest in the law – including administrative

decisions made pursuant to law – being enforced. Moreover, and unlike most cases in

which an injunction is sought in a purely private law context, the suspension of a

legislative measure or administrative decision will often affect the rights of third parties

who are not before the court. These are factors to which the court must attach

‘significant weight’ when determining whether to grant relief suspending the operation

of such a measure, not least of all because such measures when presumed valid,

represent the status quo ante (Okunade at para. 92; Merck at para. 62; Krikke and ors.

v. Barranafaddock Sustainability Electricity Ltd. [2020] IESC 42 (“Krikke”) (at para.

10)).

98. Third, the trial judge in this case (at para. 184 of his judgment) recorded the parties as

agreeing ‘that the court should not ordinarily consider the merits of the underlying

proceedings’. In fact, the more recent case law has quite clearly veered away from the

absolutist position reflected in some of the decisions applying American Cyanamid and

Campus Oil that the merits of a case are relevant to the grant or refusal of interlocutory

relief only to the extent that the court must be satisfied that the claimant has established

an arguable case or a ‘fair issue to be tried’. The law has now moved to a point at which

the merits are always relevant, and in which there will be cases in which the strength of

the claimant’s underlying action may be dispositive. This was explained most

emphatically by O’Donnell J. in Merck, where he said (at para. 62):

‘In cases where the balance of convenience may be finely balanced, it may be

appropriate to have regard, even on a preliminary basis, to the strength of the

rival arguments as they may appear to the court. Certainly, if it was apparent

that Clonmel’s case for invalidity was strong … then that might weigh against

the grant of an injunction … Courts are correctly reluctant to express views on

cases which are to come to trial. However, it would be absurd if this rule of

abstention were to result in a court conducting an agonised and necessarily

imperfect assessment of a number of variable factors in a field with which it has

little familiarity and where the evidence is indirect, written and untested, all the

while averting its attention from the area (perhaps of pure law) in which it can

justifiably claim expertise’.

99. This echoes comments of Laddie J. in Series 5 Software Ltd. v. Clarke and ors. [1996]

1 All ER 853, 865:

‘…the court should not attempt to resolve difficult issues of fact or law on an

application for interlocutory relief. If, on the other hand, the court is able to

come to a view as to the strength of the parties’ case on the credible evidence,

then it can do so … To suggest otherwise would be to exclude from

consideration an important factor and such exclusion would fly in the face of

the flexibility advocated earlier in American Cyanamid.’

100. The limitation envisaged here is important: the court must strike a balance between

affording due weight to the strength of a legal claim that can be clearly identified and

confidently addressed in an interlocutory application, and enmeshing a court at an

interlocutory hearing in either an undergrowth of untested and incomplete evidence, or

in legal issues of novelty or complexity that are ill-suited to summary disposition. Thus,

in Okunade, Clarke J, concluded that the court can, in determining whether to make

such orders ‘have regard to the strength of the case at least where, as will frequently

be the case, the challenge does not involve issues of fact as such or the sort of complex

questions of law which … “call for detailed argument and mature considerations”’ (at

para. 98, citing Lord Diplock in American Cyanamid). Most recently, in HA O’Neil

Ltd v. Unite the Union and ors. [2024] IESC 8, O’Donnell CJ (at para. 73) put the

position as follows in the context of an application for an injunction to restrain certain

actions undertaken in the course of a trade dispute:

‘That conclusion is if anything reinforced by any assessment of the relative

strengths of the parties' cases. This is a particularly appropriate course where

the balance is otherwise equal and where indeed the possibility of

uncompensatable loss is difficult to assess and where, as here, the issue is one

of solely legal analysis which is not dependent on any issue of fact, which may

require the assessment of oral evidence. Courts should always be wary about

over-confident predictions of the likely outcome of cases which have yet to be

argued fully, and there are many cases which were assessed as weak or even

unstateable, and which later triumphed. However, faced with the choice

between attempting on the one hand, an assessment of the likely course of events

in fact, and assessment of damage that is largely speculative if an injunction is

or is not granted in a field of activity in which a court may not have any

particular expertise, and on the other hand, an assessment of the strength of the

respective legal arguments by an experienced judge, it may be preferable to

allow the matter to be decided on an assessment of something in which the court

is an expert rather than an amateur.’

The relevance of the merits of the case to the grant of a stay

101. The very nature of public law challenges is that there will often be greater scope for

the identification of clear issues of law that can be thus factored into the balance than

in many applications for injunctions in private law actions (Okunade at para. 95).

Moreover, the consequence of the presumption of validity is that the case for requiring

more than merely an arguable case before the due operation of legal measures is

suspended will often be overwhelming: ‘[a]n individual ought not be permitted to

obtain from a court an order disapplying the law … merely by asserting a stateable,

though perhaps weak, case and a fear of substantial damage’ (per O’Donnell J. in

Krikke at para. 11).

102. It is therefore not surprising that in the United Kingdom there are cases in which the

criteria for the grant of a stay in at least certain judicial review proceedings have been

framed by reference to a requirement that a claimant establish ‘a strong prima facie

case’ on the merits (R(H) v. Ashworth Hospital Authority [2002] EWCA Civ. 923,

[2003] 1 WLR 127 at para. 93 (per Mummery LJ)). More recently, the Court of Appeal

of England and Wales has noted that there is support at first instance for the proposition

that in a public law claim the court will generally be reluctant to grant interim relief in

the absence of a ‘strong prima facie case’ to justify the granting of an interim injunction

(see, for example, the judgment of Warby J. in R. (on the application of Easybus Ltd.)

v. Stansted Airport Ltd. [2015] EWHC 3833 (Admin), at paragraph 95; and the

judgment of Farbey J. in R. (on the application of Remus White Ltd., t/a Heathside

Preparatory School) v. Ofsted [2018] EWHC 3324 (Admin), at paragraph 21).

However, it was observed by Lindblom LJ in R(X) v. Office for Standards in Education,

Children’s Services and Skills & Anor [2020] EWCA Civ 594 (at para. 66):

‘[t]his is not to say that the relevant case law at first instance supports the

concept of a “strong prima facie case” being deployed as a “threshold” or

“gateway” test in such cases, but rather that the underlying strength of the

substantive challenge is likely to be a significant factor in the balance of

considerations weighing for or against the granting of an injunction’.

103. Today, the position in that jurisdiction is that while a ‘strong prima facie case’ is not

an absolutely essential element in all successful applications for interim relief of this

kind, if a claim does not disclose a ‘strong prima facie case’ that will weigh against the

grant of an injunction (R. (on the application of RRR Manufacturing Pty Ltd.) v. British

Standards Institution [2024] EWCA Civ 530 at para. 96). The rationale for that position

reflects what I said earlier, and indeed derives from the decision of the House of Lords

in R. v. Secretary of State for Transport, ex p. Factortame (No. 2) [1991] 1 AC 603

(“Factortame”) where the imposition of a general (but not invariable) strong prima

facie case requirement for orders arresting the operation of legislation was rooted by

the majority (Lord Goff) in the balance of convenience, while being identified by Lord

Jauncey as a threshold requirement. They were justified by all members of the court on

the basis of the strong public interest in the enforcement of the law (‘particular stress

should be placed upon the importance of upholding the law of the land, in the public

interest, bearing in mind the need for stability in our society, and the duty placed upon

certain authorities to enforce the law in the public interest’ per Lord Goff at p. 673).

104. While both Okunade and Merck envisage the strength (in addition to the stateability)

of a challenge being potentially relevant to the decision whether to grant interlocutory

injunctive relief, in no case has this court previously required that injunctive relief in

public law challenges be usually refused where the applicant cannot establish a strong

case on the merits. However, the case for imposing such a requirement in the case of

applications to suspend the operation of at least some administrative decisions, and of

provisions of law, is coercive. Orders of this kind function to displace the status quo

ante. Where, as here, the Oireachtas has established a body for the purposes of

formulating and enforcing rules intended to ensure protection of the rights and interests

of users of services in particular contexts, or (as is often the case with regulatory bodies)

in specific sectors of the economy, courts must be very slow to arrest those decisions,

particularly where (as in this case) the Oireachtas has established a right of statutory

appeal against the regulator’s decision, but has not provided for an automatic stay

thereon where that appeal is invoked. The same can be said of those agencies charged

with ensuring fair competition, adherence to technical standards, the protection of

vulnerable cohorts of the public and/or the protection or promotion of general consumer

welfare. In cases in which the regulated entity will, more often than not, not be in a

position to recover damages where it implements a decision that is subsequently

overturned on appeal or determined to be unlawful, the strength of the case advanced

by the appellant or applicant must be of critical importance in the calculation to be

undertaken by a court: the stronger that case appears, the more pressing the exigency

of justice that demands that the claimant’s interests are protected pending a full trial.

105. This was convincingly explained by Lord Bridge in the course of his judgment in

Factortame (at p.659-660):

‘If, in the end, the claimant succeeds in a case where interim relief has been

refused, he will have suffered an injustice. If, in the end, he fails in a case where

interim relief has been granted, injustice will have been done to the other party.

The objective which underlies the principles by which the discretion is to be

guided must always be to ensure that the court shall choose the course which,

in all the circumstances, appears to offer the best prospect that eventual

injustice will be avoided or minimised…

… On the other hand, if they failed after a grant of interim relief, there would

have been a substantial detriment to the public interest resulting from the

diversion of a very significant part of the British quota of controlled stocks of

fish from those who ought in law to enjoy it to others having no right to it. In

either case, if the final decision did not accord with the interim decision, there

would have been an undoubted injustice. But the injustices are so different in

kind that I find it very difficult to weigh the one against the other.

… In the circumstances I believe that the most logical course in seeking a

decision least likely to occasion injustice is to make the best prediction we can

of the final outcome and to give to that prediction decisive weight in resolving

the interlocutory issue.’

106. Conversely, the statements from Krikke I have earlier quoted make clear that it is not

acceptable that the law – and this includes decisions of statutory agencies made in

accordance with statute – be suspended on the basis of weak but stateable cases, and

allegations of very substantial damage if that law or those decisions are implemented.

Once again, this assumes particular importance in the context of decisions of a

regulatory agency of the kind in issue here. Many decisions of the kind the subject of

this appeal are the end point of lengthy inquiries, consultation papers, draft decisions

and extensive interaction between the regulator and the undertaking concerned. When

matched against the highly diluted nature of the threshold arising from a requirement

of stateability, it will not be difficult in very many cases to construct an arguable basis

for judicial review or an appeal. At the same time – as the CJEU has stressed in its

subsequent case law considering the Zuckerfabrik test – interim stays can potentially

operate to delay for several years the full achievement of the legislator’s objectives and,

as this case shows, have the potential to significantly impact the fundamental rights of

many European citizens (Case C-639/23 P(R) European Commission v. Amazon

Services Europe Sàrl (EU:C:2024:277) at para. 157). Stays, as the DPC puts it, can

impede and even frustrate regulatory objectives. It is not satisfactory that the process of

implementing the law can be arrested on such a thin – and often too easily constructed

– basis.

107. While that conclusion can be easily rationalised, defining a threshold that requires an

applicant or appellant to establish something more than mere arguability is more

challenging. A consideration of the judicial statements in the preceding section of this

judgment shows that this requires not merely putting words on a test that can be readily

understood and applied, but also the extraction from that test, whatever it may be, of

cases that demand either an extensive assessment of the evidence or a prolonged

analysis of novel theories of law. The case law – most recently and comprehensively

examined in the judgment of Collins J. in Blythe v. Commissioner of An Garda

Síochána [2023] IECA 255 (“Blythe”) (in particular, at paras. 123-129) – shows how

the process of formulating the strength of a case that lies between the arguable and the

unanswerable, risks immersion in a sea of adjectives which, thereafter, are not always

consistently applied or understood.

108. As it happens, the term ‘prima facie case’ (with and without the elaboration ‘strong’)

has proven itself particularly vulnerable to that phenomenon. As the analysis in Blythe

shows, this has been variously used to describe positions along a spectrum that start

with arguability or a moderately enhanced version thereof, to proof on the balance of

probabilities that the claimant would succeed at trial. In Blythe itself (where the issue

was the merits limb of the test to be applied in determining whether to grant a Norwich

Pharmacal order), Collins J. (with whom Murray and Ní Raifeartaigh JJ agreed) settled

on the following formulation in respect of applications of that kind (at para. 129):

‘in my view, as a threshold requirement, an applicant for a Norwich Pharmacal

order should be required to demonstrate that he or she has a strong case against

the alleged wrongdoer. That threshold test is well-established in this

jurisdiction and its application is more predictable and certain than any

threshold based on a “good arguable case”, “prima facie” or “strong prima

facie case”. It requires that the court be satisfied that the applicant's putative

claim against the alleged wrongdoer is “likely to succeed at trial”: That does

not, however, involve the court in a trial of the action or require it to adjudicate

on complex or contested issues or on the merits of any defence potentially

available to the alleged wrongdoer.’

109. Emphasising that where a court in considering an application for a stay or injunction

concludes that this test has been met, it is by definition engaged in a preliminary

assessment and thus not tying the trial court to any conclusion on any aspect of the

merits, this mirrors the test as is often said to apply in private law to the grant of a

mandatory interlocutory injunction. The various expressions of that test are gathered

together in the decision of the Court of Appeal in Ryanair DAC v. Skyscanner Ltd.

[2022] IECA 64 at paras. 64-65: ‘a strong case that … is likely to succeed at the hearing

of the action’; ‘unusually strong and clear’; ‘the clearest of cases’; ‘particularly strong

and powerful’; ‘directed to the degree of assuredness the court would have that the

applicant will succeed having regard to the clarity of their case, and the credibility of

the evidence they adduce to support it’ (references omitted).

110. For the reasons I have outlined it is appropriate that the same test be usually applied

to applications for stays arresting the operation of legislative measures and

administrative decisions of the kind in issue in this appeal. The English cases to which

I have referred eschew the imposition of a threshold or gateway test of a strong prima

facie case for public law injunctions, preferring to present this as a general, but not

invariable, requirement, and locating it in the broader inquiry as to the ‘the balance of

convenience’ (see Courts and Tribunals Judiciary, The Administrative Court: Judicial

Review Guide 2025 (August 2025) at paras. 16.6.1-16.6.2). Clarity of analysis is better

achieved, however, if the requirement of a ‘strong case’ as I have defined it is viewed

as a specific inquiry that should be undertaken by the court when deciding whether to

grant interim relief the effect of which is to arrest or suspend the enforcement of legal

provisions, or decisions made by statutory regulatory agencies of the kind in issue here.

111. At the risk of repetition, it should be understood that the requirement to establish a

strong case as a general precondition to such relief is subject to three provisos. First, it

applies to applications to suspend the operation of legislative measures and to

administrative decisions of general application of the kind in issue in this appeal. These

include decisions made by statutory agencies when exercising regulatory powers to

protect the interests of consumers in sectors of the economy, the entitlements and

expectations of users of particular services or specific rights vested in the public as a

whole. Whether the requirement should be more generally applied to other

administrative decisions is a matter for debate in another case.

112. Second, this is a general requirement to which extreme and unusual circumstances

may well demand exceptions. While stressing that usually this hurdle must be

surmounted, there may be cases in which justice demands that it be dispsensed with.

Third, built into the formulation of a strong case is the assumption that a point of law

can be identified by an applicant or appellant on which a court can in an interlocutory

application confidently reach a conclusion for this purpose. If a point requires extensive

submissions, detailed analysis of extensive evidence, or if the point is one of legal

novelty or complexity, while it may ultimately ground a case that succeeds, it should

be viewed as generally insufficiently clear and sharp to sustain an interlocutory order

of this kind. If, therefore, the statutory appeal in issue in this case is as broad as TikTok

seemingly contends it to be (and, obviously, I am expressing no view on this), the fact

it has a good case that the regulator erred in its analysis of the evidence or in its detailed

application of the law to that evidence will not avail it in an application to arrest a

decision that is adverse to its interests. While different considerations will apply if a

stay is sought to be continued pending the delivery of a decision in a case or pending

appeal (when the trial judge will have had an opportunity to reach a fully informed view

of all aspects of the merits of the case), an applicant or appellant can only usually expect

to succeed in a pre-trial interlocutory application to suspend the operation of such a

decision if it can point to an issue that is clear, that can be precisely formulated and

applied, and that a court in an interlocutory application can conclude is of sufficient

merit to justify the grant of what should be understood as an exceptional and not a

routine remedy.

113. This means that applicants or appellants with stateable cases may find that they have

expended resources in complying with regulatory decisions that may be ultimately

quashed or set aside, and that they will be unable to recover the cost of that expenditure.

That, however, is a purely economic and commercial cost, which has always been

viewed by the law as meriting less rigorous protection than personal injury or direct

damage to property. Such losses reflect the costs of transacting in a sector of the

economy, or field of activity, that has been made subject to such regulation. In

circumstances where the Oireachtas has not provided for automatic stays on decisions

of the regulatory agency in question, it inevitably follows that the legislative

understanding is that those subject to such regulatory decisions face the risk that they

will have to comply with measures that may ultimately be quashed or set aside. Even

where a strong case as I have explained it is established by an applicant or appellant, a

court should not arrest decisions of this kind simply because there will be an

irrecoverable financial loss if the decision is to take effect. Something significantly

more – such as a clear and substantial disproportion between the cost to and impact

upon the applicant or appellant if the decision is not stayed, and the impact upon the

public interest reflected in the decision if it is stayed – is required.

The correct approach to the stay application in this case

114. Decisions made by the DPC under Article 58 of the GDPR implement a strong policy

of the Community legislator in the protection of personal data of EU citizens, in this

case where that data is transferred out of the EEA. Those decisions operate to protect

the fundamental rights of EU citizens, and it is the DPC – and not the courts – that has

been vested by the legislator with the initial and significant responsibility of

determining how those rights ought thus to be guarded within the framework of the

GDPR. Here, the decision arises from TikTok’s commercial operations, and as with

decisions of other regulators of commercial activity, the courts should be slow to

suspend those determinations. Where they are challenged, the following approach

should guide a court determining whether an interim order granting a stay should be

made:

(i) As explained in Okunade, there is no question of a stay being granted unless the

applicant or appellant establishes that they have a stateable case.

(ii) It should only be in the most unusual circumstances – if ever – that a stay should

be granted without the establishment by the applicant or appellant that they have

a strong case in the sense explained in this judgment. In cases of this kind, this

demands identification of a ground that is sufficiently clear and weighty that the

court can conclude that the point is one that is that is likely to succeed at trial.

(iii) In the uncommon situation in which the court concludes that the applicant or

appellant in proceedings of the kind in issue here enjoys a realistic prospect that

they will recover damages to compensate them for losses caused by a decision

that is ultimately quashed, and where there are reasonable grounds for believing

that the harm caused by the decision can be substantially reduced to a claim for

damages, one would expect that a stay should rarely issue, and that the various

factors to which I have earlier referred would usually demand that an applicant

be left to their remedy in damages.

(iv) In the absence of any basis for such a claim in damages the court should not

undertake any analysis of whether the harm caused by the challenged order is

capable of calculation or determination. Unless there is a realistic prospect that

there is a cause of action to recover damages at all, this is irrelevant to the

calculus.

(v) From there, the court must strike a balance between the irreparable harm caused

to the applicant or appellant in the event that a stay is not imposed and they

prevail in their claim, and the damage to the public interest in the administration

of the statutory scheme pursuant to which the regulator is functioning, if the

stay is granted. This is, necessarily, a fact sensitive inquiry dependant on a clear

identification both of the specific harm which it is alleged will be caused to the

applicant if the injunction or stay is not granted, and the particular damage to

the public interest in general or the rights of third parties in particular if it is.

(vi) While the presumptive validity of the regulator’s decision is taken into account

in requiring that an applicant establish a strong case as a precondition to a stay,

the court must also have regard in considering the public interest in the

administration of the statutory scheme in question to the fact that, where that

scheme is intended to operate to protect rights and interests of service users, or

indeed the public at large, a stay should rarely issue where to do so will

jeopardise the effective protection of those entitlements in any substantial way.

(vii) The harm to the applicant should be examined cognisant of the fact that, usually,

irrecoverable expense incurred in complying with a regulatory decision – albeit

one eventually quashed on review or appeal – is properly understood as a cost

of conducting business in certain sectors of the economy, and an inevitable

consequence of the decision of the Oireachtas to establish powers of regulation

in that field. Courts in considering applications for such relief should not accede

to them just because compliance with the decision will entail some irrecoverable

financial loss. Something significantly more – such as a clear and substantial

disproportion between the cost to and impact upon the applicant or appellant if

the decision is not stayed, and the impact upon the public interest reflected in

the decision if it is stayed – is required.

115. The parties in this appeal did not address the court in any detail as to the merits of the

underlying case, the DPC having conceded that TikTok had identified ‘serious doubts

as to the validity’ of its decision within the meaning of Zuckerfabrik and, it followed,

an ‘arguable case’ as contemplated by Okunade. What, exactly, the threshold of

‘serious doubts as to the validity’ of the measure meant, was not explored at the hearing.

That being so, and noting the lack of clarity around the meaning of that term, in normal

circumstances the court would afford the parties the opportunity to make further

submission on the orders it should make having regard to this reformulation of the

proper approach to an application of this kind.

116. However, the substantive statutory appeal has proceeded at a rapid pace. Mulcahy J.

granted the stay on 13 November, and this court heard the DPC’s appeal against that

decision over two days (17 and 18 February). The full hearing of the statutory appeal

commenced on 3 March. While I would adopt the view that the question of whether

TikTok has established a ‘strong case’ is an open one, by now the narrow issue of

whether it has met that threshold for the purposes of interim pre-trial relief has been

overtaken by the fact that the substantive hearing has concluded. In those

circumstances, it appears to me that the most sensible course of action is for the stay

granted by Mulcahy J. to be continued unless and until the DPC decides that it is

appropriate to seek to have the issue revisited before him (whether pending delivery of

his judgment, a reference to the CJEU, any appeal from his decision, or otherwise). In

the event of such an application being made, Mulcahy J. will of course be considering

a different question from that now before this court, because he will no longer be

deciding whether to grant a stay pending the hearing of the substantive action. Clearly,

for the purposes of any such application the trial judge will take account of the merits

of the case, but he will be judging the strength of that case having heard the entire action

and, on that basis, will not be engaging in the type of preliminary assessment that I have

found should properly be made when determining whether to grant pre-trial relief.

117. Finally in this regard, I am not satisfied that this is a case in which, based upon the

information presently before the court, it can be said with any confidence that TikTok

might expect to obtain damages were a stay on the decision of the DPC refused and the

decision later quashed. Aside entirely from the immunity it enjoys pursuant to s. 154 of

the 2018 Act, the decision of the DPC was not presented before this court as anything

other than a bona fide determination reached on the basis of its appraisal of the

provisions of the GDPR as applied to the facts as found by it. As the case presently

appears, there is no basis on which it could be said that it would face liability in

domestic law for misfeasance in public office (if national law has any role in

conditioning a cause of action in damages arising from the DPC decision). I would

expect that the conditions attached to Francovich damages by the decision in Brasserie

du Pêcheur would present a significant difficulty were TikTok to seek to claim damages

on that basis for the discharge of a function of the kind arising here. The conditions

imposed by the Francovich jurisprudence on the recovery of damages are in such

circumstances, as counsel for the DPC correctly put it in argument, ‘onerous and

difficult to achieve’. While, of course, the expression of a view to that effect at an

interlocutory stage should not impact upon the ability of a trial court to conclude

otherwise, the extent of the adjudicative power vested in the DPC, and the absence of

any suggestion before this court that any infringement of TikTok’s rights was deliberate

or reckless would strongly point against such relief. While not prejudging any claim for

damages TikTok might choose to eventually agitate, I would for the purposes of this

application exclude the prospect of recovering any damages from my consideration of

the stay application. The question accordingly reduces itself to an inquiry as to whether

TikTok had a strong case and, if it did have such a case, where the balance of justice as

I have explained it above, properly lay.

The evidence in this case

118. In those circumstances, I will limit myself to observing that had the test formulated in

this judgment been applied, and had Mulcahy J. been satisfied that such a strong case

as I have defined it had been made out, he would have been correct to grant the stay.

Three factors combine to render the case one in which, exceptionally, the argument in

favour of a stay was compelling.

119. The first is the very short time for which the decision was to be stayed. This is a factor

to which Mulcahy J. rightly attached considerable significance. As he explained, the

decision itself allowed six months before the suspension order would take effect. As a

consequence of the temporary stay granted when the proceedings were initiated, that

period would have expired at the end of March 2026 were the stay not continued. By

then, the hearing of the appeal was likely to have commenced (as matters transpired,

the oral hearing had concluded by then). It was reasonable to assume that temporally,

therefore, the stay had a very limited impact. Of course, at the conclusion of the

substantive appeal hearing the question of extending the stay was liable to have arisen

again pending judgment, the making of a reference to the CJEU, or in the event of an

appeal. However, these are distinct stages of the proceedings and, as I have explained,

by then the court will have formed an opinion as to the broader merits of the proceedings

which would, quite properly, exercise a significant influence over whether any stay

should be extended.

120. The second relates to the impact on the rights of users of TikTok’s services in the

event that the application for a stay were successful. Here, I attach significance to the

fact that the DPC has not decided that the Chinese legal system fails, at a general level,

to ensure essentially equivalent protection of that data to that guaranteed in the EU for

transfers pursuant to the SCCs implemented by TikTok. It has, in particular, not found

that the Chinese authorities have the legal power to compel the disclosure of data that

is temporarily transferred by TikTok in this way. Had the DPC so concluded, the court

would be faced with a very particular balancing exercise. On one side of that balance

would have stood a presumptively lawful decision by the authority with the power of

determining the matter, that the state of Chinese law was such that access of this nature

could lawfully occur. That finding – and the systemic importance of its being

recognised and implemented – would have fallen to be measured against the impact

upon TikTok if it complied with the decision, won its appeal, and could not obtain

damages to compensate it for the resulting loss.

121. However, what the DPC has decided here is, in a number of important respects, far

narrower and more specific. Far from contradicting the account of Chinese law

proffered by TikTok, it elected to accept that account, and to take it ‘at its height and

at face value’. This necessarily defines what exactly the court must presume to be valid.

Thus, the DPC has concluded that TikTok has failed to establish that for a period that

ended in May 2023, the protections provided by a combination of Chinese law, the

SCCs, and the supplementary measures put in place by TikTok were not adequate in

relation to the temporary transfer of data. What is presumed valid is a determination

of a failure of assessment, not an affirmative finding as to the state of the law in the

third country.

122. That failure of assessment is not of a present state of affairs, but of an historic situation.

The failure relates to circumstances that are now more than three years old. Moreover,

those circumstances are focussed only on the temporary transfer of data. Thus, the DPC

did not find any want in TikTok’s assessment that under Chinese law data located

outside that jurisdiction – although accessible from within China – could not be the

subject of lawful interception by the Chinese authorities. The failure of assessment as

found by the DPC related to situations in which that data had been temporarily

transferred to China in the manner I have previously described. This was also the

subject of some debate with counsel for the DPC at the hearing. Counsel for the DPC

was clear in their position that (a) the DPC did not find fault with TikTok’s assessment

that once the data was outside China Chinese law did not permit the its authorities to

access that data, and (b) that the fundamental point made by the DPC was that TikTok

had not shown that access to the data could not be obtained while it was being processed

temporarily by personnel in China.

123. This limits the risk to the rights of TikTok’s customers if the halting of the data

transfers is suspended and the decision is eventually upheld. As a result of what

Mulcahy J. correctly characterised as the DPC’s ‘negative finding’, combined with the

limited reach of the DPC’s concern (access by the Chinese authorities in the course of

a temporary transfer of data), the threat to those rights is, necessarily, less immediate

and more remote than it would have been had there been a final and considered

determination that there was a lack of essential equivalence to EU law. It is also a threat

that occurs in circumstances that have altered in the course of the time period covered

by the decision, insofar as the breach of the rights of TikTok’s users to be provided with

information on data transfers pursuant to Article 13(1)(f) of the GDPR was found to

have ceased on 1 December 2022.

124. In saying this I do not ignore the point urged strongly by the DPC that included in the

data protection rights of TikTok’s customers was a right not to have their data

transferred to a jurisdiction in circumstances in which the data controller had not

satisfied themselves to the required standard as to the degree of protection afforded to

the data by the laws of that jurisdiction. Nor do I overlook that the DPC has, for the

purposes of this application, adduced expert evidence from Professor Zang that, if

correct, undermines significantly critical aspects of the version of Chinese law

presented by TikTok to the DPC as part of the process leading to the impugned decision

(this evidence has been contested in responding affidavit evidence and in reports of

Professor Xu and Mr. Zhang of Fangda Partners). However, while the right of TikTok’s

users as described by the DPC is both protected and important, the critical issue in

determining whether to grant an interim stay must be focussed upon the risk of intrusion

by the Chinese authorities in the personal data of TikTok’s users having regard to the

findings made in the impugned decision. Even then, were one to take account of

evidence favourable to the DPC that is extrinsic to that decision, the evidence is that

the Chinese authorities have never sought to obtain from TikTok or its personnel EEA

user data, and that the effect of the implementation of Project Clover has been to further

restrict the access by China Group Entity employees to the personal data of EEA users,

and has resulted in pseudonymisation of that data. For my part, I do not see how the

court in determining whether to grant the stay sought can properly now effectively re-

open the evidential framework within which the DPC determined its inquiry by looking

to evidence that directly contradicts the evidence tendered by Professor Xu in the course

of the inquiry, having regard to the fact that the DPC proceeded in its decision on the

basis that it taken TikTok’s evidence ‘at its height’. For these various reasons, and

having regard to the enhanced protections introduced on foot of Project Clover, I agree

with the conclusion of the trial judge that even assuming the validity of the DPC’s

decision, ‘the risk to EEA user data during the period of any required stay does not

appear to be significant’ (at para. 231).

125. The third factor relates to the impact on TikTok if the decision is not stayed and found

to be unlawful. Here, the court must be astute to the combined and related risks that

present in a context in which the court is determining the application for a stay solely

on the basis of affidavit evidence, in which the temptation for applicants to overstate

and exaggerate the impact of a decision of this kind is ever present, and having regard

to my earlier analysis positing that a stay should not issue only because a claimant has

tendered evidence that they will incur financial loss if the order is not made and they

succeed in their claim. That said, on any view the contention that the impact of a

decision such as that in issue here for any undertaking engaged in cross-border activities

is immense, and is both inherently plausible and supported by cogent, detailed and

convincing evidence.

126. The affidavits sworn by Ms Elaine Fox on behalf of TikTok indicate that the data

transfers in question occur by way of secure and controlled remote access by authorised

personnel within entities based in China, who perform a range of operational,

engineering, security and product-related functions necessary to the operation of the

TikTok platform in the EEA. It is further averred that, even following the

implementation of Project Clover, such remote access forms part of an integrated global

operational model, whereby those personnel support, inter alia, platform stability,

incident response, content delivery systems and the ongoing development and

deployment of product features. On that basis, compliance with the suspension order

would not merely entail the cessation of a discrete category of data flows, but would,

in turn, require the removal or replacement of those functions from the global

operational structure that TikTok has instituted.

127. The evidence is that in order to comply with such a requirement, TikTok would need

to undertake a process of what is described as ‘headcount and capacity buildback’,

involving the relocation within the EEA or other permitted jurisdictions of functions

presently performed by those personnel. That process would, on the evidence, require

not only the recruitment of additional personnel, but also the transfer or reconstruction

of institutional knowledge, the reconfiguration of technical systems and workflows, and

the reorganisation of engineering and operational teams presently structured on a global

basis. The affidavit evidence also describes the architecture within which those

functions presently operate, including the use of geographically distributed data centres

and controlled remote access systems, together with supplementary measures, designed

to regulate and secure access to EEA user data. In that context, the cessation of remote

access from personnel based in China would necessitate a re-engineering of those

arrangements, rather than a simple reallocation of tasks.

128. Not only is this credibly averred, but the evidence is that compliance with the orders

will restrict TikTok’s ability to effect product and feature updates, algorithm updates,

bug identification and issues resolution, and the prevention and resolution of platform

and service outages. That evidence is made more intelligible when read against the

evidence of the present operating model: the case advanced by TikTok is that the

personnel whose access would be affected are not peripheral to the business, but support

functions said to be necessary to the ongoing operation, maintenance and development

of the platform. The evidence is that this will cause a significant decrease in user

engagement with the platform, and thus both potentially impact its user base, and create

the risk that some users shift their attention and engagement to competing service

providers. TikTok is a ‘data driven’ platform, and the suspension orders will have the

effect of restricting data access for a substantial share of the personnel that operate and

support the platform. It is difficult to see how it could not but have a very significant

impact on its day-to-day operations.

129. All of this is likely to impact on significant lost profit contributions, estimated in the

affidavit evidence as being in the region of US$1,716 million and cause consequent

brand damage and impairment, reduction in shareholder value, and a six-month delay

in the launch of TikTok shop in those parts of the EEA region in which it is not presently

available. In addition, TikTok says that other TikTok entities outside the EEA will incur

additional personnel costs of US$3.105 billion. This will be accompanied by an

inevitable loss of institutional knowledge and expertise, and an adverse impact on

TikTok’s competitiveness. It will also, on TikTok’s evidence, result in significant

decreases in productivity across a range of different key roles – engineers, data

scientists, product managers and quality assurance personnel (the range of the impact

runs from between 18% to 46% in these different roles). Even allowing for the

questions raised in the DPC’s evidence around these losses and the methodology

brought to bear on their calculation, the figures are, as the trial judge said, on any view,

very significant. I agree with his assessment that it ‘has established a probability that

it will incur very significant costs if required to implement the Suspension Solution’,

and with his description of the evidence it has adduced to support this as ‘robust’ (at

para. 199). While – as the DPC emphasised – these figures fall to be considered against

the backdrop of a business that appears to be immensely profitable, and the figures

constitute a small proportion of its annual revenue, I am not certain that this is the

appropriate benchmark against which to judge their proportionality. They are perhaps

more usefully viewed as multiples of the sum fixed by the DPC itself as the proper fine

for the breaches it found over a period of almost three years.

130. It follows that the potential impact identified is not confined to loss and damage that

is simply financial or to matters of cost or inconvenience. Rather, on the evidence

available to the court on this application, there is a credible basis for concluding that

TikTok’s compliance within the timeframe specified in the decision of the DPC could

give rise to material operational disruption, including risks to platform functionality,

delays in development and deployment of features, and pressures on system resilience

and incident response capability.

131. The prejudice extends to the forced re-engineering of an operating model said to

depend, at present, on controlled remote access by identified personnel to limited

categories of data, the migration or rebuilding of those functions elsewhere, the

associated loss of expertise and institutional knowledge, and the risk of impaired service

continuity during that process. The consequent dislocation alleged by TikTok is, on its

face, grounded in a sufficiently detailed account of the manner in which the platform

operates, such that it cannot be characterised as speculative. The evidence available to

the court on this application establishes that the implementation of the decision would

involve a wholesale disruption to a significant part of TikTok’s commercial operations

which, if effected, would appear to be without precedent in the industry within which

it operates.

132. Leaving aside the difficulties in reducing that damage to a reliable assessment that

could form the basis for an action for damages (which, as I have said I simply do not

see as arising in this case), the nature and scale of the impact on TikTok if the decision

were not stayed pending the outcome of the proceeding in the High Court, when viewed

in the light of the duration of the stay and the actual threat to the data protection rights

of its users, would – if a strong case had been established – have justified the making

by Mulcahy J. of the order sought by it.

133. Whether it is appropriate to extend this stay further will depend upon the consideration

by the trial judge of the various factors addressed in this judgment, while bearing in

mind that applications for a stay after the case has run its full course raise issues that

are in some respects quite distinct from those arising where a stay is sought at a pre-

trial stage. That question could arise pending the delivery of judgment, the making of a

reference to the CJEU or pending appeal. In the latter case, the outcome of a further

stay application will obviously depend on outcome: if TikTok succeeds, one would

have thought that the proven strength of its case would weigh heavily in the balance. If

it fails, the converse must apply. In the event of a reference, the trial judge will have to

consider whether the strength of the case as a whole as he then assesses it when viewed

against the relationship between the damage to TikTok if there is no stay, and the impact

on the public interest if there is, meets the consideration of a clear and substantial

disproportion articulated in the course of this judgment.

Conclusion

134. For the foregoing reasons I would dismiss this appeal. The legal test governing a stay

on a decision of the DPC of the kind in issue in this case is properly one of national,

and not of European Union, law. Insofar as the DPC has requested that the court refer

a question to the CJEU on this issue, I have concluded that the court should not do so

for the reasons set forth in this judgment, including that the proper resolution of the

issue is so clear as not to require a reference. I have explained how that test should be

reconfigured for applications seeking to stay the operation of regulatory decisions of

general effect intended to protect the rights and interests of users of services such as

that in issue here. These orders should be viewed as wholly exceptional. Such a stay

should only very rarely, if ever, be granted unless the court is satisfied that the applicant

or appellant has established a strong case as I have defined it here. If such a strong case

is established, the court will only rarely be concerned with whether the loss or damage

caused by the refusal of the stay will be capable of calculation, and will more commonly

be addressing itself to the balance of justice between the impact on the applicant or

appellant if the stay is refused and they succeed in their challenge or appeal, and the

impact on the public interest or rights of third parties if the stay is granted and the

applicant or appellant fails in their case. It is not appropriate for this court at this stage

of these proceedings to express a view as to whether such a strong case has been

established. If it had been established, Mulcahy J. would have been correct in the

circumstances to grant the stay. That being so, it appears to me that the most sensible

course of action is for the stay granted by Mulcahy J. to be continued unless and until

the DPC decides that it is appropriate to seek to have the issue revisited before him

(whether at the conclusion of the submissions, pending a reference to the CJEU, or

pending any appeal, or otherwise). In the event of such an application being made,

Mulcahy J. can then address any such application while taking account of the various

factors identified in the course of this judgment.

TikTok Technology Limited & Anor v Data Protection Commission

Karar metni