View source for High Court - 2025/248 MCA

{{COURTdecisionBOX

|Jurisdiction=Ireland
|Court-BG-Color=
|Courtlogo=Courts_logo1.png
|Court_Abbrevation=High Court
|Court_Original_Name=High Court
|Court_English_Name=High Court
|Court_With_Country=High Court (Ireland)

|Case_Number_Name=2025/248 MCA
|ECLI=

|Original_Source_Name_1=High Court
|Original_Source_Link_1=https://www2.courts.ie/acc/alfresco/e401aa8e-bc84-4a36-9ec9-fa469a83882a/2025_IEHC_619.pdf/pdf#view=fitH
|Original_Source_Language_1=English
|Original_Source_Language__Code_1=EN
|Original_Source_Name_2=
|Original_Source_Link_2=
|Original_Source_Language_2=
|Original_Source_Language__Code_2=

|Date_Decided=13.11.2025
|Date_Published=
|Year=2025

|GDPR_Article_1=Article 13(1)(f) GDPR
|GDPR_Article_Link_1=Article 13 GDPR#1f
|GDPR_Article_2=Article 46 GDPR
|GDPR_Article_Link_2=Article 46 GDPR
|GDPR_Article_3=Article 46(1) GDPR
|GDPR_Article_Link_3=Article 46 GDPR#1
|GDPR_Article_4=Article 60 GDPR
|GDPR_Article_Link_4=Article 60 GDPR
|GDPR_Article_5=
|GDPR_Article_Link_5=
|GDPR_Article_6=
|GDPR_Article_Link_6=

|EU_Law_Name_1=
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=

|National_Law_Name_1=
|National_Law_Link_1=
|National_Law_Name_2=
|National_Law_Link_2=

|Party_Name_1=TIKTOK TECHNOLOGY LIMITED 
|Party_Link_1=https://www.tiktok.com/en/
|Party_Name_2=
|Party_Link_2=
|Party_Name_3=
|Party_Link_3=

|Appeal_From_Body=DPC (Ireland)
|Appeal_From_Case_Number_Name=
|Appeal_From_Status=
|Appeal_From_Link=https://dataprotection.ie/en/news-media/latest-news/irish-data-protection-commission-fines-tiktok-eu530-million-and-orders-corrective-measures-following#_ftn1
|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=
|Appeal_To_Link=

|Initial_Contributor=RP
|
}}

A court granted TikTok a conditional stay of the DPA’s order to suspend data transfers to China, finding the company faced irreparable harm and that the temporary risk to users’ fundamental rights was limited during the appeal procedure.

== English Summary ==

=== Facts ===
TikTok challenged a [[DPC (Ireland) - TikTok|decision]] and related suspension order issued by the Irish DPA concerning transfers of EEA user data to China under [[Article 46 GDPR]]. 

In the decision, the DPA found that TikTok had infringed [[Article 46 GDPR#1|Article 46(1) GDPR]] by failing to ensure that personal data of EEA users transferred outside the EEA (specifically through remote access by personnel in China) received a level of protection essentially equivalent to that available within the EU during the relevant period. 

The DPA also found a breach of [[Article 13 GDPR#1f|Article 13(1)(f) GDPR]] for failure to provide required information about such data transfers to data subjects.

Consequently, the DPA imposed administrative fines totalling €530 million, a suspension order requiring TikTok to suspend the data transfers, and a corrective order  requiring TikTok to bring its processing operations into compliance.
 
TikTok initiated an appeal against the DPA decision. The appeal automatically stayed the obligation to pay the administrative fines, but it did not stay the suspension order or corrective order.

TikTok applied for a stay of those orders, asserting that compliance would require billions of euros in expenditure, significant business disruption, and harm to stakeholders’ experience, and that such losses could not be remedied if TikTok ultimately succeeded on appeal.

The DPA opposed the stay, asserting that the ongoing data transfers posed risks to the fundamental rights of TikTok’s 159 million monthly EEA users.

=== Holding ===
The Court held that the appropriate legal standard for deciding whether to grant a stay should be decided according to the national procedural rules (Okunade test), rather than the harmonized EU ones (Zuckerfabrik test). Under the Okunade test, the Court must identify the course of action carrying the least risk of injustice pending the appeal. As the DPA accepted that TikTok’s appeal raised a serious issue to be tried, the Court focused on whether damages would be an adequate remedy and where the balance of justice lay.

The Court found that TikTok had established, on the evidence, that implementing the suspension and corrective orders prior to the appeal would cause it significant harm, principally financial but of such scale, complexity, and unquantifiable nature that damages could not be considered an adequate remedy. The Court further concluded that the prospect of TikTok recovering any such losses, even if successful on appeal, was limited, making the harm effectively irreparable.

While the Court recognised that delaying the DPA’s orders carried a risk to the fundamental rights of EEA users, it determined that the evidence showed this risk to be limited, temporary, and insufficient to outweigh the far greater injustice TikTok would suffer without a stay. The Court also noted that no broader risk to the enforcement of the GDPR regime would arise from granting interim relief.

Accordingly, the Court granted a stay of the suspension and corrective orders, subject to conditions designed to minimise delay and protect users’ interests. TikTok was required to prosecute its appeal with all reasonable diligence to ensure a hearing by March 2026 and to notify users of the DPA’s decision in clear and accessible language.

== Comment ==
''Share your comments here!''

== Further Resources ==
''Share blogs or news articles here!''

== English Machine Translation of the Decision ==
The decision below is a machine translation of the English original. Please refer to the English original for more details.

<pre>
APPROVED                                                       [2025] IEHC 619






                               THE HIGH COURT

                                COMMERCIAL

                                                       Record No.: 2025/248 MCA


             IN THE MATTER OFSECTION 142AND SECTION 150

                     OFTHE DATAPROTECTIONACT 2018

Between:


        TIKTOK TECHNOLOGY LIMITED and TIKTOK INFORMATION

                         TECHNOLOGIES UK LIMITED

                                                                       Applicants

                                      And


                      DATAPROTECTION COMMISSION

                                                                      Respondent


      JUDGMENT of Mr Justice Rory Mulcahy delivered on 13 November 2025

Introduction



   1. On 14 September 2021, the respondent (“the DPC”) commenced an inquiry (“the

   Inquiry”) into the first applicant (“TikTok”) in accordance with section 110 of the Data
   ProtectionAct 2018 (“theAct”) regarding the transfer by TikTok of its users’personal data

   to China. The DPC is the State’s supervisory authority for the purpose of the General Data

   Protection Regulation, Regulation 2016/679 (“the GDPR”).


   2. Following a detailed investigation, and having consulted with other supervisory

   authorities in accordance with Article 60 of the GDPR, the DPC issued its decision on 30

   April 2025 (“the Decision”). The Decision defined the temporal scope of the Inquiry as

   relating to data transfers taking place from 29 July 2020 until 17 May 2023. In the Decision,


                           NO REDACTION REQUIREDthe DPC found that TikTok had infringed Article 46(1) the GDPR by failing to ensure that

personal data of its users within the European Economic Area (“EEA Users”) which was
transferred outside the EEA, in this case by being made available by remote access to

personnel based in China (“the data transfers”), was afforded a level of protection

essentially equivalent to that provided within the European Union (“EU”) during the
Inquiry’s temporal scope.The Decision also found a breach ofArticle 13(1)(f) of the GDPR,

that TikTok had failed to provide required information on the data transfers to data subjects

from 29 July 2020 to 1 December 2022.


3.   As part of the Decision, the respondent imposed administrative fines totalling €530

million. The second applicant (“TikTok UK”) has been joined to these proceedings on the

basis that it is the entity which will ultimately be responsible for paying any such

administrative fines. The DPC disputes its standing as a party in these proceedings, but that
issue does not require to be resolved at this time.


4.   In addition to the administrative fines, the DPC made an order pursuant to Article

58(2)(j) of the GDPR requiring TikTok to suspend the data transfers (“the Suspension

Order”) and an order pursuant to Article 58(2)(d) requiring TikTok to bring its processing
into compliance with the GDPR (“the Corrective Order”). These orders were to take effect

six months after the date of the Decision.


5.   By originating notice of motion issued on 27 May 2025, TikTok appealed the Decision

pursuant to sections 142 and 150 of theAct. TikTok pleads errors of law and fact on the part
of the DPC. It contends that the data transfers, by virtue of its standard contractual clauses

(SCCs) and, inter alia, additional measures put in place by TikTok pursuant to what it calls

“Project Clover”, are afforded an equivalent level of protection to that provided within the

EU.Inaddition,TikTok contendsthatthe Decision was reached in breachof fairprocedures.
TikTok also claims that the DPC has erred in its interpretation of relevant Chinese laws.


6.   By operation of section 142 of theAct, the appeal operates as a stay on the requirement

to pay the administrative fines. However, thereis noautomaticstay onthe Suspension Order

                                            2or Corrective Order (for convenience, any further reference to the Suspension Order can be

read as referring to both orders). This judgment concerns TikTok’s application to stay those
orders. In short, TikTok claims that the steps it will be necessary to take in order to comply

with the Suspension Order will require it to incur billions of euros expenditure, will be

disruptive of its business and of its workforce, and will diminish its stakeholders’
experience. It contends that most of this loss cannot be made good if it ultimately succeeds

in its appeal. In order to provide it with an effective remedy, TikTok argues, the Suspension

Order must be stayed pending the determination of its appeal.


7.   The DPC opposes the stay. It contends that the fundamental rights of TikTok’s 159

million monthly EEAusers are at risk if the data transfers continue.


8.   Theproceedings wereenteredintheCommercialListoftheHighCourton 5June2025.
TikTokappliedforastayontheDecisionatthattime,onthebasisoftheaffidavitsgrounding

the entry application. The stay application was opposed by the DPC. The court granted a

temporary stay up to the hearing of this application, which was listed for 7 October 2025.
The stay application was heard over four days from 7 to 10 October 2025. When the hearing

commenced, the DPC did not oppose a continuation of the stay pending the determination

of this application.


9.   Aswill beseen, muchofthedebatebetweenthe parties concernedthe test whichshould

beapplied to an application forastayonadecisionoftheDPC.TheDPC argues that, having
regard to particular features of the decision challenged, a decision made in accordance with

the GDPR, in consultation with other EU supervisory authorities, and with their consent or

agreement, the appropriate threshold is that applied by the CJEU in an application for
interim measures, referred to below as the Zuckerfabrik test. TikTok contends that the

Decision should be treated in the same way as any other national law measure made in

purported compliance with EU law, and that the relevant threshold is the well-established

test applied to such national law measures, the Okunade test.




                                             310. Section 149(5)of theDataProtectionAct 2018 (“the2018Act”)provides that theDPC,

when publishing its decision following an investigation “shall ensure” that the decision is
published in a manner which doesn’t disclose a person’s commercially sensitive

information. Section 156 ofthe 2018Act confersanexpress poweron thecourtto hear some

or all of proceedings under the Act otherwise than in public. At the outset of the hearing,
TikTok applied for an order that its commercially sensitive information referred to in the

affidavits and exhibits grounding the stay application be treated as not having been referred

to in open court, and not published or disclosed to any third party, in order to protect its

confidential nature.


11. It is clear from the decision in Gilchrist and Rogers v Sunday Newspapers [2017] IESC
18, [2017] 2 IR 284, that even where an express power to hear proceedings otherwise than

in public exists, the court is obliged to consider whether the interests of justice requires a

restriction on the public’s access to the hearing, and, if so, whether there are any less
restrictive measures than a hearing in camera which would ensures that justice is done.


12. In circumstances where the statute expressly confers protection on commercially

sensitive information by section 149(5) of the 2018Act when the DPC publishes a decision,

it would wholly undermine that protection, or the effectiveness of any remedy provided by

the GDPR and the 2018 Act, if a person was required to forego that protection in order to
challenge that decision in accordance with the 2018 Act. In those circumstances, I was

satisfied that the order sought – which fell well short of an in camera hearing – was the least

restrictive means of preserving the interests protected by the statute. Accordingly, I agreed
to make an order pursuant to section 156 of the 2018Act.


13. Of course, the only information which should be protected by an order made pursuant

tosection156istheinformationwhichtheDPCwasunderaduty toprotect whenpublishing

a decision pursuant to section 149(5), unless TikTok wish to advance some additional

ground justifying its protection. For the purposes of the stay hearing, there was no real
debate about the extent of the information which TikTok claimed should fall within the

scope of the section 156 order, though the DPC reserved its entitlement to contest whether

                                             4   particular information fell to be protected in the future. For the purpose of the stay hearing

   only, therefore, all the information which was highlighted by TikTok as being commercially
   sensitive was treated as falling within the scope of the order made pursuant to section 156

   of theAct.



The General Data Protection Regulation



   14. The GDPR is the centrepiece of the reform of the EU regulatory framework for
   protection of personal data (see, generally, Kuner, Bygrave and Docksey, The EU General

   Data Protection Regulation (Oxford University Press, 2020)). It is a Regulation of some

   complexity and its interpretation will, no doubt, play a significant role in the resolution of

   TikTok’s appeal. However, for the purposes of resolving this stay application, two related
   issues are relevant. First, what is the nature of the decision by a supervising authority such

   as the one the subject of this appeal.And second, does the GDPR provide any indication of

   the threshold which should be applied by a court when considering an application for a stay,

   or interim measures, in respect of such a decision.


   15. Briefly, TikTok’s position is that that the GDPR makes clear that a decision of a

   supervising authority is a decision of that supervising authority alone, and is therefore a
   national law measure, subject to challenge on the basis of a member state’s procedural law

   in accordance with the principle of procedural autonomy. It argues that national procedural

   autonomy is the default in the absence of express harmonisation, and that the GDPR makes

   clear that the default position applies where a challenge is, as here, to a decision of a
   supervising authority. It argues, therefore, that this application should be decided by

   reference to national procedural law.


   16. TheDPC accepts that procedural autonomyis thedefault position and that thethreshold

   for the grant of a stay on a measure giving effect to EU law would ordinarily be subject to
   national procedural rules. However, it contends that the decision of a supervising authority

   is, because of the mandatory co-operation procedures inArticle 60 of the GDPR, in effect a

                                                5joint decision ofall supervising authoritieswhichis binding acrosstheEU (in fact, the entire

EEA on account of its incorporation into the EEAAgreement). This effect of a supervising
authority’s decision means, argues the DPC, that the procedural autonomy afforded to the

member states in relation to legal proceedings challenging a decision of a supervisory

authority must be subject to a requirement that the same standard is applied as applies to the
assessment of applications for interim measures when an EU measure is challenged. It

contends that this is consistent with an interpretation of the GDPR as a whole and the case

law of the CJEU.


17. Recital 1 of the GDPR recognises that the protection of natural persons in relation to

the processing of personal data is a fundamental right and references Article 8(1) of the

Charter of Fundamental Rights of the European Union (the Charter) andArticle 16(1) of the

Treaty on the Functioning of the European Union (TFEU), each of which provides that
everyone has the right to the protection of personal data concerning him or her.


18. Recital 4 provides that:


     The processing of personal data should be designed to serve mankind. The right to the

     protection of personal data is not an absolute right; it must be considered in relation to

     its function in society and be balanced against other fundamental rights, in accordance
     with the principle of proportionality. This Regulation respects all fundamental rights

     and observes the freedoms and principles recognised in the Charter as enshrined in the

     Treaties,inparticulartherespectforprivateandfamilylife,homeand communications,
     the protection of personal data, freedom of thought, conscience and religion, freedom

     of expression and information, freedom to conduct a business, the right to an effective

     remedy and to a fair trial, and cultural, religious and linguistic diversity.


19. Recital 11 relates to harmonisation:


     Effective protection of personal data throughout the Union requires the strengthening
     and setting out in detail of the rights of data subjects and the obligations of those who


                                             6     process and determine the processing of personal data, as well as equivalent powers

     for monitoring and ensuring compliance with the rules for the protection of personal
     data and equivalent sanctions for infringements in the Member States.




20. Recital 101 concerns the transfer of data outside EU:


     Flows of personal data to and from countries outside the Union and international

     organisations are necessary for the expansion of international trade and international

     cooperation. The increase in such flows has raised new challenges and concerns with
     regardtotheprotectionofpersonaldata. However,whenpersonaldata aretransferred

     from the Union to controllers, processors or other recipients in third countries or to

     international organisations, the level of protection of natural persons ensured in the

     Union by this Regulation should not be undermined, including in cases of onward
     transfers of personal data from the third country or international organisation to

     controllers, processors in the same or another third country or international

     organisation. In any event, transfers to third countries and international organisations
                                                                      5
     may only be carried out in full compliance with this Regulation. A transfer could take
     placeonlyif, subject to theotherprovisions of this Regulation, theconditions laiddown

     in the provisions of this Regulation relating to the transfer of personal data to third

     countries or international organisations are complied with by the controller or

     processor.


21. Recitals 124 to 126 discuss the role of supervising authorities and the competence of

lead supervising authorities. Recital 126 refers to decision-making by supervisory

authorities:


     The decision should be agreed jointly by the lead supervisory authority and the

     supervisory authorities concerned and should be directed towards the main or single

     establishment of the controller or processor and be binding on the controller and
     processor. The controller or processor should take the necessary measures to ensure

                                            7     compliance with this Regulation and the implementation of the decision notified by the

     lead supervisory authority to the main establishment of the controller or processor as
     regards the processing activities in the Union.



22. Recital 143 refers to the entitlement to a judicial remedy. It distinguishes between the
remedy available where a challenge is to a decision of a supervising authority, and where

the challenge is to a decision of the European Data Protection Board (EDPB).



     Any natural or legal person has the right to bring an action for annulment of decisions
     of the Board before the Court of Justice under the conditions provided for in Article

     263 TFEU. As addressees of such decisions, the supervisory authorities concerned

     which wish to challenge them have to bring action within two months of being notified

     of them, in accordance with Article 263 TFEU. Where decisions of the Board are of
     direct and individual concern to a controller, processor or complainant, the latter may

     bring an action for annulment against those decisions within two months of their

     publication on the website of the Board, in accordance with Article 263 TFEU. Without
     prejudice to this right under Article 263 TFEU, each natural or legal person should

     haveaneffectivejudicial remedybeforethecompetentnationalcourtagainstadecision

     of a supervisory authority which produces legal effects concerning that person. Such a

     decision concerns in particular the exercise of investigative, corrective and
     authorisation powers by the supervisory authority or the dismissal or rejection of

     complaints. However, the right to an effective judicial remedy does not encompass

     measures taken by supervisory authorities which are not legally binding, such as
     opinions issued by or advice provided by the supervisory authority. Proceedings

     against a supervisory authority should be brought before the courts of the Member

     State where the supervisory authority is established and should be conducted in

     accordance with that Member State’s procedural law. Those courts shouldexercise full
     jurisdiction, which should include jurisdiction to examine all questions of fact and law

     relevant to the dispute before them.



                                            8     Where a complaint has been rejected or dismissed by a supervisory authority, the

     complainant may bring proceedings before the courts in the same Member State. In the
     context of judicial remedies relating to the application of this Regulation, national

     courts which consider a decision on the question necessary to enable them to give

     judgment, may, or in thecaseprovidedfor in Article267TFEU,must, request theCourt
     of Justice to give a preliminary ruling on the interpretation of Union law, including this

     Regulation. Furthermore, where a decision of a supervisory authority implementing a

     decision of the Board is challenged before a national court and the validity of the

     decision of the Board is at issue, that national court does not have the power to declare
     the Board’s decision invalid but must refer the question of validity to the Court of

     Justice in accordance with Article 267 TFEU as interpreted by the Court of Justice,

     where it considers the decision invalid. However, a national court may not refer a

     question on the validity of the decision of the Board at the request of a natural or legal
     person which had the opportunity to bring an action for annulment of that decision, in

     particular if it was directly and individually concerned by that decision, but had not

     done so within the period laid down in Article 263 TFEU.


23. Article 4(21) and 4(22) of the Regulation define “supervising authority” and

“supervising authority concerned”.


     (21)   ‘supervisory authority’ means an independent public authority which is

     established by a Member State pursuant to Article 51;


     (22)   ‘supervisory authority concerned’means a supervisory authority which is
     concerned by the processing of personal data because:


        a. the controller or processor is established on the territory of the Member State

            of that supervisory authority;






                                            9        b. data subjects residing in the Member State of that supervisory authority are

            substantially affected or likely to be substantially affected by the processing;
            or


        c. a complaint has been lodged with that supervisory authority…



24. Chapter V relates to the cross border transfer of data, that is transfers outside the

EU/EEA. The overriding requirement is that the rights guaranteed by the GDPR are not

compromised by any such transfer of personal data, that data is afforded an equivalent level

of protection in a third country as it would be within the EU.Article 44 provides:


     Any transfer of personal data which are undergoing processing or are intended for

     processing after transfer to a third country or to an international organisation shall
     take place only if, subject to the other provisions of this Regulation, the conditions laid

     down in this Chapter are complied with by the controller and processor, including for

     onward transfers of personal data from the third country or an international

     organisation to another third country or to another international organisation. All
     provisions in this Chapter shall be applied in order to ensure that the level of protection

     of natural persons guaranteed by this Regulation is not undermined



25. Articles 45 and 46 provide alternative mechanisms for ensuring equivalent protection.
Article 45 provides for the making of adequacy decisions by the European Commission.

Where the Commission has determined that adequate protection is provided in a third

country, it can issue a decision to that effect. Any transfers to that country consistent with
the adequacy decision do not require further authorisation. Adequacy decisions were the

subject of the leading cases, Case C-362/14, Schrems v Data Protection Commissioner

(“Schrems I”) and Case C-311/18, Data Protection Commissioner v Facebook Ireland Ltd

and Schrems (“Schrems II”).




                                           1026. Where, as here, there is no adequacy decision, transfers are still permitted without

specific authorisation where the data processor satisfies the requirements ofArticle 46:


 1. In the absence of a decision pursuant to Article 45(3), a controller or processor may
     transfer personal data to a third country or an international organisation only if the

     controller or processor has provided appropriate safeguards, and on condition that

     enforceable data subject rights and effective legal remedies for data subjects are
     available.



 2. The appropriate safeguards referred to in paragraph 1 may be provided for, without

     requiring any specific authorisation from a supervisory authority, by:
        a) a legally binding and enforceable instrument between public authorities or

            bodies;

        b) binding corporate rules in accordance with Article 47;
        c) standard data protection clauses adopted by the Commission in accordance

            with the examination procedure referred to in Article 93(2);

        d) standard data protection clauses adopted by a supervisory authority and

            approved by the Commission pursuant to the examination procedure referred to
            in Article 93(2);

        e) an approved code of conduct pursuant to Article 40 together with binding and

            enforceable commitments of the controller or processor in the third country to

            apply the appropriate safeguards, including as regards data subjects’rights; or
        f) an approved certification mechanism pursuant to Article 42 together with

            binding and enforceable commitments of the controller or processor in the third

            country to apply the appropriate safeguards, including as regards data subjects’
            rights.




27. The decision in these proceedings was that TikTok had failed to satisfy the DPC that
the transfer by it of personal data to China was in accordance withArticle 46(1).



                                            1128. Article 49 provides for derogations from the requirements ofArticles 45 and 46. These

are available, inter alia, where:


     (a)    the data subject has explicitly consented to the proposed transfer, after having

     been informed of the possible risks of such transfers for the data subject due to the

     absence of an adequacy decision and appropriate safeguards…


29. Chapter VI of the GDPR deals, inter alia, with the decision-making functions of

supervisory authorities. Pursuant to Article 51, each member state is required to designate

at least one supervisory authority responsible for monitoring the application of the GDPR.
Article 56 sets out the competencies of a supervisory authority. During the course of the

hearing, I was informed that there are a total of 47 supervisory authorities within the EEA,

as some states, notably Germany, have more than one supervisory authority.


30. Article 56(1) provides:


     Without prejudice to Article 55, the supervisory authority of the main establishment or

     of the single establishment of the controller or processor shall be competent to act as

     leadsupervisoryauthorityforthecross-borderprocessingcarriedoutbythatcontroller
     or processor in accordance with the procedure provided in Article 60.




31. Article 58(1) of the GDPR sets out the investigative powers a supervisory authority
shall have,Article 58(2) its corrective powers.



32. Article 60 sets out the co-operation procedure between supervising authorities when,

inter alia, investigating a complaint. Sub-articles 1 to 3 concern obligations in relation to
the sharing of information. These include, at sub-article 3, an obligation on a lead

supervising authority (“LSA”) to provide draft decisions to other supervisory authorities

concerned (“SACs”) for their opinion and to “take account of their views”. Other SACs may
provide reasoned objections to the draft decision. If agreement cannot be reached on those

                                            12objections, aconsistency mechanism is provided, whereby any disagreement can be referred

to the EDPB for resolution. A decision of the EDPB pursuant to Article 65 of the GDPR is
binding upon the supervisory authorities. The EDPB is established by Article 68(1) of the

GDPR as a union body with legal personality. It is comprised of the heads of at least one

supervisory authority from each member state.


33. Two further articles merit attention.Article 66(1) provides for an accelerated procedure

in cases of urgency:


     In exceptional circumstances, where a supervisory authority concerned considers that

     thereisanurgentneedto actinordertoprotecttherightsandfreedomsofdatasubjects,
     it may, by way of derogation from the consistency mechanism referred to in Articles

     63, 64 and 65 or the procedure referred to in Article 60, immediately adopt provisional

     measures intended to produce legal effects on its own territory with a specified period
     ofvaliditywhichshallnotexceedthreemonths. Thesupervisoryauthorityshall,without

     delay, communicate those measures and the reasons for adopting them to the other

     supervisory authorities concerned, to the Board and to the Commission.


34. Finally,Article 78 of the GDPR requires that member states provide effective remedies

regarding decisions of supervisory authorities:


     1. Without prejudice to any other administrative or non-judicial remedy, each natural

        or legal person shall have the right to an effective judicial remedy against a legally
        binding decision of a supervisory authority concerning them.

     2. Without prejudice to any other administrative or non-judicial remedy, each data

        subject shall have the right to an effective judicial remedy where the supervisory

        authority which is competent pursuant to Articles 55 and 56 does not handle a
        complaint or does not inform the data subject within three months on the progress

        or outcome of the complaint lodged pursuant to Article 77.

     3. Proceedings against a supervisory authority shall be brought before the courts of

        the Member State where the supervisory authority is established.
                                            13     4. Where proceedings are brought against a decision of a supervisory authority which

        was preceded by an opinion or a decision of the Board in the consistency
        mechanism, the supervisory authority shall forward that opinion or decision to the

        court.


35. The decision-making process and consistency mechanism have been analysed by the

CJEU in a number of cases. The DPC referred, in particular, to the Opinion of theAdvocate

General,    in    Case     C-645/19,     Facebook      Ireland    Inc     and    Ors     v

Gegevensbeschermingsautoriteit (“Facebook”), in whichthe question referred was whether
a supervisory authority in one member state could bring proceedings before the court of that

state with regard to cross-border processing, where it was not the LSAfor that processing.



36. In concluding that it was permissible to do so only in the particular circumstances
provided in the GDPR (in Article 58(5)), the Advocate General considered the legislative

history of the GDPR and described the approach ultimately adopted in the GDPR as a “one-

stop shop” mechanism, language repeated in the court’s judgment. He considered the
respective roles of LSAs and other supervisory authorities:


     85.   Second, the Council intended to mitigate the role and competence of the LSA, by

     making the procedure more inclusive. The text of the Commission’s Proposal was

     considered to be somewhat ambiguous on the point, and possibly giving rise to an

     exclusive competence of the LSA over cross-border data processing. A number of
     corrections were made to the text in order to enhance the ‘proximity’ between data

     subjects and the supervisory authorities. Inter alia, the involvement of other

     supervisory authorities in the decision-making process was significantly increased.


     86.   For its part, the European Parliament also supported the creation of the one-

     stop-shop mechanism, with an enhanced role for the LSA, but proposed to strengthen

     the system of cooperation among the supervisory authorities. Both the Explanatory



                                           14    Statement to the Draft Report of the Parliament and the European Parliament

    legislative resolution of 12 March 2014 are rather clear in that regard.


    87.    In essence, with the Council’s and the Parliament’s intervention, the one-stop-

    shop mechanism, previously heavily leaning towards the LSA, was turned into a more
    balanced two-pillar mechanism:theleadingrole of theLSAwithregardto cross-border

    processing is preserved, but it is now accompanied by an enhanced role for the other

    supervisory authorities which actively participate in the process through the

    cooperation and consistency mechanisms, with the Board given the role of referee and
    guide in the event of disagreement.




37. At [111] the Advocate General described the LSA as a “primus inter partes…. Only

able to act with the consent of the SACs”.


38. The CJEU in agreeing with theAdvocate General’s conclusions used similar language

regarding co-operation and consensus.


39. Both parties also referenced Case C-97/23P, WhatsApp Ireland Ltd v EDPB. In those

proceedings, WhatsApp challenged a decision of the EDPB made pursuant to the
consistency mechanism. The application was dismissed by the General Court as

inadmissible. An appeal to the CJEU is pending, but the Advocate General’s opinion,

delivered on 27 March 2025, is that the proceedings are admissible, and that a decision of
the EDPB under the consistency mechanism is a “challengeable act” for the purpose of

Article 263 TFEU. The Advocate General provides a helpful summary of the consistency

mechanism:


    “10.    The task of monitoring and enforcing the rules of the GDPR is entrusted to the

    various supervising authorities of the Member States within their respective territories.




                                          15        11.    To tackle the possible fragmentation in the implementation of data protection

        rules across the European Union that may result from such a ‘decentralised’ system,
        the GDPR provides for cooperation between national supervisory authorities.

        12.    When a data processing operation has a cross-border dimension, the authority

        in charge of the processor or controller at issue – the lead supervisory authority (LSA)
        –mustcirculateitsdraft decisionenforcingtherulesoftheGDPRagainsttheprocessor

        or controller under its competence to the concerned supervisory authorities of other

        Member States.

        13.   If those other authorities agree with the interpretation of the GDPR and with the
        enforcement measures proposed by the LSA, the latter may adopt its final decision,

        which is binding on the controller or processor at issue.

        14.    However, if those other supervisory authorities express relevant and reasoned

        objections with which the LSA disagrees or considers them not to be relevant or
        reasoned, the LSA must submit the matter to the EDPB for the latter to take a decision.

        15.   The EDPB adjudicates the dispute between the national supervisory authorities

        involved and resolves that individual case by means of a binding decision.
        16.   According to Article 65(2) of the GDPR, that decision is addressed to and binds

        the LSA and all the other supervisory authorities concerned. The decision is also

        published on the EDPB’s website.

        17.   Within prescribed deadlines and on the basis of that binding EDPB decision, the
        LSA must adopt its final decision, which is then notified to the controller or processor

        at issue.”



Data ProtectionAct 2018



   40. Part 6 of the 2018Act concerns enforcement of the GDPR. Sections 108 and 109 of the

   Act give the DPC power to investigate complaints made to it. Section 110 entitles the

   Commission to carry out an Inquiry of its own volition:



                                              16        110. (1) The Commission, whether for the purpose of section 109(5)(e), section 113(2),

        or of its own volition, may, in order to ascertain whether an infringement has occurred
        or is occurring, cause such inquiry as it thinks fit to be conducted for that purpose.



   41. Where an Inquiry pursuant to section 110 has taken place, section 111 provides that the
   DPC shall do one of the following:



        (1) Where an inquiry has been conducted of the Commission’s own volition, the

        Commission, having considered the information obtained in the inquiry, shall—
        (a) if satisfied that an infringement by the controller or processor to which the inquiry

        relates has occurred or is occurring, make a decision to that effect, and

        (b) if not so satisfied, make a decision to that effect.


   42. If the DPC makes a decision that there has been a breach, then section 111(2) requires

   that it also consider whether to exercise any corrective power and, if so, what corrective

   power to exercise.


   43. Section 154 of theAct provides the DPC with immunity from suit:


        Civil or criminal proceedings shall not lie in any court against the Commission, a

        Commissioner, an authorised officer or a member of the staff of the Commission in

        respect of anything said or done in good faith by the Commission, Commissioner,
        authorised officer or member of staff in the course of the performance or purported

        performance of a function of the Commission, Commissioner, authorised officer or

        member of staff.


The Inquiry



   44. As appears from the Decision, during the course of its supervision interactions with

   TikTok, the DPC was informed by TikTok that certain personnel located in China accessed

                                              17personal data of TikTok’s EEAusers in order to provide support services in connection with

the operation of its platform, including functions related to software engineering,
maintenance and development. On 26 March 2021, TikTok provided the DPC with its data

transfer assessment (“DTA”) for China, an assessment of the level of protection afforded to

data transferred to China, together with supporting documentation.


45. In the Decision, the DPC describes the TikTok platform as follows:


     “36.   The TikTok platform is a social media service allowing users to create and share

     short-form videos of up to 10 minutes in length. It is available as an app for Android

     and iOS, and via the website www.tiktok.com. TikTok accounts can be created by users
     aged 13 years and over using a phone number and email address. A TikTok profile

     typicallycontains a profilephoto or videoandusername.Theappshows apersonalised

     ‘For You’feed of videos for each user, recommended based on factors such as the user’s
     selected interest categories, device and account settings, and interaction with the app.

     Users can create, watch, ‘like’ and comment on videos, ‘follow’ other users’ profiles,

     and send direct messages to other users.


     …



     38.    TikTok Ireland has stated that the TikTok service is not offered or available in

     China, where the ByteDance group of companies separately operates “a similar but
     entirely distinct” video-sharing platform called Douyin…”



46. ByteDance Limited is TikTok’s ultimate parent. Though it is registered in the Cayman
Islands, many of the ByteDance group of companies and its employees are based in China.



47. On 7 April 2021, the DPC received a submission from Stichting Onderzoek

Marktinformatie, a Dutch non-governmental organisation, raising concerns about the



                                           18processingofpersonaldatabyTikTok,duetorisks foryoungusersandthenon-EEAtransfer

of personal data.


48. On 28 May 2021 and 5 July 2021, the DPC received requests for mutual assistance
from the French supervisory authority, Commission Nationale de l’Informatique et des

Libertés, requesting that the DPC investigate matters pertaining to TikTok’s transfer of

personal data to China.


49. On14September2021,theDPCnotifiedTikTokofthecommencementoftwoinquiries
pursuant to section 110 of the Data ProtectionAct 2018 (so-called “own volition” inquiries),

including the inquiry which led to the decision the subject of these proceedings (“the

Inquiry”).


50. TikTok responded to the commencement notice on 12 October 2021. The response
included an updated DTA.Afurther updated DTAwas provided on 28 January 2022.


51. On 11 May 2022, the DPC requested further information from TikTok. Having sought

an extension of time to provide a response, TikTok responded on 20 June 2022.


52. On 7 July 2022, the DPC provided TikTok with a detailed Statement of Issues and

invited submissions on same. The issues for determination were summarised as follows:


     “(1) The DPC will consider and determine, within the scope of the Inquiry, the relevant

     facts as to TikTok Ireland’s reliance on the 2010 SCCs in connection with the transfers
     the subject of the Inquiry involving remote access to personal data of EEA users by the

     China Group Entities.


     (2) The DPC will consider and determine, within the scope of the Inquiry, the relevant

     facts as to the scope of TikTok Ireland’s reliance, if any, on the derogations set out in

     Article 49 GDPR, and in particular Article 49(1)(b) GDPR, and, if necessary, review

     and determine the lawfulness of same in the context of the transfers the subject of the
     Inquiry.

                                           19     (3)TheDPCwillconsideranddeterminewithinthescopeoftheInquirywhetherTikTok
     Ireland can demonstrate that it has complied with its responsibility to assess the level

     of protection of personal data of EEA users the subject of transfers to the China Group

     Entities using SCCs under Article 46(2)(c) GDPR for the purpose of Articles 44 and
     46(1) GDPR, having regard in particular to TikTok Ireland’s responsibility as a

     controller in light of Article 5(2) and 24 GDPR. This will include consideration as to

     whether TikTok Ireland has adequately assessed whether, and the extent to which, there

     is a risk that the personal data of EEA users remotely accessed by the China Group
     Entities may be subject to potentially problematic laws and practices in effect in China,

     and whether, and extent to which, there is a risk that the 2010 SCCs are not being

     complied with, or cannot be complied with, by the China Group Entities in the context

     of the transfers the subject of the Inquiry.


     (4) The DPC will consider and determine, within the scope of in the Inquiry, whether

     TikTok Ireland can demonstrate that the supplementary measures implemented by
     TikTok Ireland and the China Group Entities in respect of the remote access by the

     China Group Entities to personal data of EEA users are effective, together with the

     2010 SCCs, to ensure that EEA users are provided with the appropriate safeguards,

     enforceable rights and effective legal remedies required by Articles 44, 46(1) and
     46(2)(c) GDPR, so that the personal data of EEA users is afforded a level of protection

     essentially equivalent to that guaranteed within EU by the GDPR.


     (5) The DPC will consider and determine whether TikTok Ireland has complied with its

     obligations under Article 13(1)(f) GDPR with reference to the information it provides

     to EEAusers of the TikTok platform concerning the transfers the subject of the Inquiry.”


53. When furnishing the Statement of Issues, the DPC indicated that in respect of the

second issue, it intended having regard to information on government access to personal

data in China set out in the “Final Report EDPS/2019/02-13, Legal study on Government

                                           20access to data in third countries for the EDPB (November 2021)” (“the Milieu Report”).

TikTok raised certain queries on the Statement of Issues and responded in substance on 15
September 2022. TikTok notified the DPC of its intention to submit expert evidence in

relation to the Milieu Report. It also informed DPC that it was in the process of updating its

DTAfor China and expected to complete this by 13 October 2022, that it was in the process
of updating its EEA privacy policy, and that it would shortly be amending its Intra-Group

Agreement for the purpose of transitioning from the 2010 SCCs to the new ones (“the 2021

SCCs”), and that this would be done by 27 December 2022. TikTok also queried the

temporal scope of the Inquiry and were advised it was “ongoing”.


54. On 13 October 2022, TikTok provided the DPC with an expert report on Chinese law,

addressing the Milieu Report, from Professor Ke Xu, Professor of Law of the Law School,

University of International Business and Economics, Beijing. It also provided an update to
the DTA (“the October 2022 DTA”). It provided its privacy policy on 22 October 2022,

and information on the 2021 SCCs in December 2022.


55. The DPC sent a request for further information on 21 February 2023, raising queries

regarding the 2021 SCCs.


56. When responding to this request on 28 March 2023, TikTok provided information on
further measures it was putting in place, referred to as Project Clover, to ensure the

protection of EEAuser data. It advised that implementation had commenced.


57. The DPC raised queries about the turnover of TikTok’s parent company, ByteDance in

April 2023. On 17 May 2023, it issued a Preliminary Draft Decision (“the PDD”).The PDD
defined the temporal scope of the Inquiry as commencing on 29 July 2020 and ongoing. The

provisional findings are summarised in TikTok’s affidavit grounding the appeal as follows:



      a) In respect of Issue 1, the DPC set out a summary of the facts it considered to be
         relevant and necessary to the determination of the issues set out in the PDD in

         §165.

                                           21b) In respect of Issue 2, the DPC provisionally found that, by failing to clarify
   precisely how the territoriality principle applies in the context of the laws and

   practices outlined in Section 2.2 of the DTA and the Data Transfers (the regulation

   of public authority access to personal data in China), TikTok Ireland had failed to
   comply with its responsibility to adequately assess the level of protection of EEA

   Users under the Chinese legal framework for the purposes of Articles 44 and 46

   GDPR and, further, had failed to demonstrate compliance with Articles 44 and 46

   with regard to the processing the subject of the transfers (PDD, §299).


c) In respect of Issue 3, the DPC provisionally found that TikTok Ireland had failed to

   verify, guarantee and demonstrate that the supplementary measures and the SCCs

   are effective to ensure that EEA User Data is afforded a level of protection
   essentially equivalent to that guaranteed in the EU (PDD, §§365 - 371).

   Specifically, the DPC expressed the provisional view that TikTok had failed to

   certify, guarantee and demonstrate that the supplemental measures or the SCCs
   address the risks associated with the Data Transfers falling subject to the National

   Intelligence Law, the Counter-Espionage Law, Article 18 of the Anti-Terrorism

   Law, and the PRC Cybersecurity Law (the Relevant Chinese Laws, described by

   the DPC as the "Problematic Laws" in the PDD).



d) In respect of issue 4, the DPC expressed the provisional view that TikTok Ireland

   could not rely on derogations under Article 49 GDPR in respect of the Data

   Transfers, which are systemic, repetitive and continuous (PDD, §397).


e) In light of its provisional findings in respect of Issues 1 - 4, the DPC made a

   provisional finding that TikTok Ireland had infringed Article 46(1) GDPR

   regarding the Data Transfers by failing to verify, guarantee and demonstrate that
   the supplementary measures and the SCCs are effective to ensure that EEA User


                                     22         Data is afforded a level of protection essentially equivalent to that guaranteed in

         the EU (PDD, §398).


      f) respect of issue5, theDPC madeaprovisional finding TikTokIreland hadinfringed
         Article 13(1)(f) GDPR from 29 July 2020 to December 2022 by failing to provide

         data subjects with information on its transfers of personal data to China and

         information as to how the Data Transfers concerned remote access to personal
         data stored in Singapore and the United States by CGE Personnel based in China

         (PDD, §432).


      g) The DPC provisionally decided (i) to make an order pursuant to Article 58(2)(j)

         requiring TikTok Ireland to suspend the Data Transfers, (ii) to make an order

         pursuanttoArticle58(2)(d)GDPRrequiringTikTokIrelandtobringtheprocessing
         into compliance in the manner specified in the PDD, and (iii) to impose two

         administrativefines pursuant toArticle58(2)(i)GDPRin theranges of €450 -€500

         million and €30 - €50 million respectively.



58. TikTok made submissions on the PDD on 9 September 2023. It provided a second

opinion from Professor Xu, reports from two law firms, Fangda and Clifford Chance, a

technical report on Project Clover (“the Project Clover Technical Report”) and a report

from NCC Group. It subsequently provided a report from Dr Prateek Mittal concerning
TikTok’s privacy solution. It provided an updated DTA on 6 October 2023 (“the October

2023 DTA”).


59. On 8 February 2024, the DPC wrote to TikTok seeking clarification on matters arising

from TikTok’s response to the PDD, including whether remote access by personnel in China

involved storage of EEA user data in China, including temporary storage.


60. Between March and June 2024, TikTok responded to this request and sought

confirmation that the DPC would have regard to the materially new information provided

                                          23by it since the PDD. It requested that the DPC withdraw the PDD and issue a revised PDD

in light of the new measures which TikTok had put in place. Although the DPC confirmed
that it would have regard to all information provided, it declined to withdraw the PDD,

considering it to be unnecessary.


61. On 31 July 2024, TikTok provided the DPC with a further revision to its DTA (“the

July 2024 DTA”). This is the most up-to-date DTAso far provided by TikTok.


62. On 6 December 2024, TikTok advised the DPC that it had updated its Intra-Group
Agreement to reflect changes in the processing of data in China. On 14 February 2025, it

indicated that it intended to provide updates on the further implementation of Project Clover

by 10 March 2025.


63. On 21 February 2025, the DPC informed TikTok that it had finalised a draft decision
(“the Draft Decision”) and circulated it to the concerned supervisory authorities pursuant

toArticle 60 of the GDPR.As stated in the Draft Decision at [95]:


     “Given that thematters under examinationin theinquiryentail cross-border processing

     across Europe, all other supervisory authorities were engaged as SACs for the purpose

     of the co-decision-making process outlined in Article 60 of the GDPR.”


64. The DPC provided TikTok with a copy of the Draft Decision. The temporal scope of
the Inquiry pursuant to the Draft Decision was stated to be from 29 July 2020 to 17 May

2023.


65. The Draft Decision contained findings on each of the five issues identified in the

Statement of Issues. In relation to Issue 2 in the Statement of Issues, it found:


     “392. … the DPC finds that TikTok Ireland failed to adequately assess the level of
     protection of personal data of EEA users the subject of transfers to the China Group

     Entities using SCCs. While TikTok Ireland acknowledged relevant divergences between

     the level of protection afforded by the law and practices of China compared with

                                           24     European Union law, its assessment of the territoriality principle resulted in it

     concluding that the Data Transfers fell outside the territorial scope of the problematic
     laws. However, the DPC finds that TikTok Ireland’s assessment of the territoriality

     principle failed to clarify whether, and the extent to which, such laws may apply in the

     context of the Data Transfers, and failed to set out in a clear way the deficiencies it
     acknowledged to exist in the Chinese legal framework. By failing to adequately assess

     the law and practices in China in the context of the Data Transfers, TikTok Ireland

     failed to comply with its responsibility to assess the level of protection of personal data

     of EEA users the subject of transfers to the China Group Entities using SCCs.


     393.   The DPC also finds that TikTok Ireland’s failure to adequately assess the level

     of protection provided by Chinese law and practices resulted in it failing to verify,

     guaranteeand demonstratethat that thepersonaldata of EEAUsers subject to theData
     Transfers was afforded a level of protection essentially equivalent to that guaranteed

     within the European Union…


     399.   … [T[his has prevented TikTok Ireland from verifying and guaranteeing that

     data subjects have enforceable rights and effective legal remedies. Having failed to

     verify and guarantee that the Data Transfers were afforded a level of protection

     essentially equivalent to that guaranteed within the European Union, it is clear that
     TikTok Ireland was also not in a position to demonstrate an essential equivalent level

     of protection.”


66. In relation to Issue 3, the Draft Decision concluded:


     “475. The supplementary measures were not sufficient to prevent the risk of potential

     application of problematic access by Chinese authorities supported by problematic

     laws, and, thus, were not sufficient to ensure that the personal data of EEA users was

     afforded a level of protection essentially equivalent to that guaranteed within the EU.
     TikTok Ireland’s assessment of law and practices in China and the supplementary


                                            25     measures implemented based on that assessment have failed to appropriately account

     for theriskof access supported byproblematiclaws to EEAUser Datathat is processed
     in China.For thereasonsset out above,theDPCfinds thatthesupplementarymeasures

     implemented by TikTok Ireland were inadequate to compensate in respect of this risk.

     Therefore, theDPC findsthat TikTokIreland failedto verifythat EEAUser Data subject
     to the Data Transfers would be afforded a level of protection essentially equivalent to

     that guaranteed within the European Union in circumstances where TikTok Ireland

     failed to verify that problematic laws could not be applied to EEA User Data processed

     in China. The DPC also finds that TikTok Ireland failed to implement appropriate
     safeguards and supplemental measures to guarantee that EEA User Data subject to the

     Data Transfers would be afforded a level of protection essentially equivalent to that

     guaranteed within the European Union.


     476.   Accordingly, the DPC finds that TikTok Ireland failed to verify, guarantee and

     demonstrate that the supplementary measures implemented by TikTok Ireland and the

     China Group Entities in respect of the Data Transfers were effective, together with the
     2010 SCCs and the 2021 SCCs, to ensure that EEA users were provided with the

     appropriate safeguards, enforceable rights and effective legal remedies required by

     Articles 44, 46(1) and 46(2)(c) GDPR, so that the personal data of EEA users was

     afforded a level of protection essentially equivalent to that guaranteed within EU by the
     GDPR.”



67. The DPC made the following finding of infringement:


     “544. In light of the foregoing, as set out in Issues 1 – 4, the DPC finds that TikTok

     Ireland infringed Article 46(1) GDPR regarding the Data Transfers. As set out above,

     TikTok Ireland failed to adequately assess the level of protection provided by Chinese
     law and practices to the personal data of EEA Users the subject of transfers to the

     China Group Entities using SCCs. It failed to verify, guarantee and demonstrate that

     the supplementary measures and the SCCs were effective to ensure that the personal

                                           26     data of EEA Users is afforded a level of protection essentially equivalent to that

     guaranteedwithintheEU.TikTokIrelanddidnot,andcouldnot,relyonthederogations
     under Article 49 GDPR in respect of the Data Transfers made during the temporal

     scope. Consequently, TikTok Ireland transferred EEA User Data to China without

     complying with the conditions laid downbyChapter Vof theGDPRand did not identify
     a valid lawful basis for the Data Transfers.



     545.   Accordingly, during the temporal scope of the Inquiry, from 29 July 2020 to 17

     May 2023, TikTok Ireland infringed Article 46(1) GDPR by carrying out the Data
     Transfers while failing to verify, guarantee and demonstrate that that the personal data

     ofEEAUsers subjecttotheDataTransferswas affordedalevelofprotectionessentially

     equivalent to that guaranteed within the European Union.”


68. Having regard to the fact that the temporal scope of the Inquiry ended on the date the

PDD was provided to TikTok, the DPC separately considered the changes made by TikTok

since that date when considering whether to make any suspension or correction order. The
Draft Decision records that:



     “665. The DPC has carefully considered all of the additional supplementary measures

     implemented by TikTok Ireland after the temporal scope of the Inquiry. The additional
     supplementary measures do not address the risk of Chinese authorities accessing the

     personal data that is accessed by employees of the China Group Entities in plain text.

     The DPC finds that TikTok Ireland has not demonstrated that EEA User Data subject
     to the Data Transfers cannot be subject to problematic access by Chinese public

     authorities. TikTok Ireland’s ongoing failure to adequately assess the level of protection

     provided by Chinese law and practices to the personal data of EEA users the subject of

     transfers interferes with its ability on an ongoing basis to select appropriate safeguards
     and supplementary measures, and prevents it from demonstrating an essentially

     equivalent level of protection. Therefore, the DPC’s concerns regarding the Data

     Transfers, as set out at Issues 2 and 3 of this Draft Decision, remain in respect of the

                                           27        ongoing Data Transfers. For that reason, the DPC finds that TikTok Ireland has failed

        on a continuing basis to demonstrate that the supplementary measures that it has
        implemented and the SCCs are effective to ensure that the personal data of EEA users

        is afforded a level of protection essentially equivalent to that guaranteed within the EU.

        …


        667.   In light of the foregoing, the DPC orders TikTok Ireland pursuant to Article

        58(2)(j) GDPR to suspend the Data Transfers in accordance with the timeline outlined

        below.”



   69. On 14 March 2025, TikTok requested that the DPC withdraw the Draft Decision,

   alleging fundamental errors of fact and breaches of fair procedures. On 18 March 2025, it
   provided a third report from Professor Xu to address a purported gap inTikTok’s assessment

   of Chinese law identified in the Draft Decision. By letter dated 25 March 2025, the DPC

   refused the request to withdraw the Draft Decision.


   70. Although the DPC received comments on the Draft Decision from three SACs (those
   of France, Holland and Berlin), it received no reasoned objections. Accordingly, the DPC

   adopted the Decision with “non-material” amendments from the Draft Decision on 30April

   2025.



Disclosure of issue concerning TikTok’s ‘OnCall’platform


   71. On 21 March 2025, TikTok disclosed to the DPC that, contrary to statements made

   during the course of the Inquiry that no EEA user personal data was stored in China, it had

   discovered that some personal data had, in fact, been stored in China. TikTok has an internal
   helpdesk called ‘OnCall’, which is hosted in China. The platform included a free text field

   in which the technical issue giving rise to the help request can be described. It emerged that

   in a limited number of cases, TikTok’s support agents had included personal data in that
   field rather than simply summarising the technical issue.Asmall number of those instances

                                              28   related to EEA user data. Upon discovering the issue, TikTok moved the data out of China

   and further access from China was restricted.



Grounds of appeal



   72. TikTok has appealed the Decision on a variety of grounds. For the purpose of this

   application, the DPC has accepted that TikTok has identified “serious doubts as to the

   validity of the measure”, the threshold in Zuckerfabrik, or “a fair or bona fide or serious

   issue to be tried”, the Okunade criteria.


   73. TikTok advances various grounds in respect of the fines imposed, including that the

   DPC incorrectly calculated the fines by reference to the turnover of its parent company,
   ByteDance Limited.


   74. Regarding the findings of a failure to comply with Article 46 of the GDPR, TikTok

   claims various breaches of fair procedure by the DPC including that it relied on matters

   raised for the first time in the Draft Decision circulated pursuant toArticle 60 of the GDPR

   and therefore deprived TikTok of an opportunity to address those issues. It claims that the
   DPC made manifest errors in its assessment of the relevant Chinese laws.


   75. As regards the Suspension Order the subject of this application, TikTok argues that the

   DPC failed to carry out the assessments required byArticle 46, as interpreted in Schrems II,

   and contends that accordingly, the DPC could not properly have made such an order in
   circumstances where the temporal scope of its inquiry ended on 17 May 2023.



The stay application



   76. TikTok applied to enter the proceedings in the Commercial list of the High Court on 5
   June 2025. As part of that application, TikTok sought a stay on the operation of the


                                              29Suspension Order. The DPC did not oppose the application for entry, but did oppose the

stay. The court (Sanfey J) granted an interim stay pending the hearing of a full stay
application.



77. TikTok filed a comprehensive suite of affidavits in support of its application for a stay.
It initially filed twelve affidavits grounding the application. The DPC filed five affidavits in

reply. TikTok filed a further ten affidavits in response. The DPC filed a single further

affidavit in reply, and TikTok then filed two more replying affidavits. Fortunately for the

court, the contents of TikTok’s first two rounds of affidavits are summarised in affidavits
sworn by Elaine Fox, Head of Privacy, Europe and Head of Ireland at TikTok. For the

purpose of this judgment, a brief summary of the evidence adduced will suffice at this

juncture. Particular details will be discussed as necessary when assessing the application for

a stay.

78. TikTok does not dispute that certain data which meets the definition of personal data

under the GDPR can be accessed by personnel of certain China Group Entities (CGEs),

being a list of identified companies. It calls this allowable data. It explains that the allowable

data is stored in data centres outside China, but can be remotely accessed by certain CGE
personnelinChina.Itdescribesthedatawhichcan beremotely accessedas (i)inter-operable

data, data needed fortheTikTok platformto operateglobally; (ii)public data,atypeofinter-

operable data which is publicly available and accessible by anyone on the TikTok platform,

and (iii) aggregated data, allowable data which is compiled and expressed in a summary
way. It describes the data as the “less confidential data” collected by TikTok about EEA

users and Ms Fox avers that all of this data is, in any event, pseudonymised in a manner

which prevents the re-identification of EEAusers.


79. TikTok’s position is that it will have to put in place the following additional measures

to give effect to the Suspension Order. It will have to apply technical measures to anonymise

any aggregated data, and it will have to remove access to the remaining EEA user data to
CGE personnel. It calls these two steps the Suspension Solution.


                                            3080. Eoghan Kerins, TikTok’s Global Head of Digital Rights avers that he is responsible for

all data disclosures to authorities for theTikTok website outside of the US. He explains how

this process is managed within TikTok. He also avers that there has never been a request for
EEAuser data by any authority in China from TikTok and he is not aware of any of the CGE

or any ByteDance entity in China having received such a request. This is reflected in

transparency reports published by TikTok bi-annually.


81. Thomas Wlazik, Head of Europe and Israel and Global Business Solutions and
Managing Director of TikTok Germany GmbH provided an affidavit in which he explained

theTikTok platform and identified its stakeholders. These include users, advertisers, sellers,

businesses, and public organisations and non-profits.


82. Yuquiao Huang, Project Management Office Team Member at TikTok Inc, has sworn
an affidavit in which sheaversto theeffect implementing the Suspension Solution will have.

Itidentifiesanumberofcriticalbusinessprocesseswhichwillbeseverelyimpactedifaccess

to the data is removed from CGE personnel. In support of Ms Huang’s analysis, Professor

Peter Pietzuch, Professor of Distributed System, Department of Computing at Imperial
College London, prepared an expert report, which he exhibits on affidavit. He considers that

the analytical framework applied by Ms Huang is appropriate and agrees with her

assessment regarding the significant impact on TikTok’s critical business processes.


83. Ms Huang also explains that if the Suspension Solution is implemented, a very

significant number of CGE personnel, numbering in the thousands, will have to be
transferred and relocated outside China so that TikTok can, in time, return to the same level

of operations in its critical business processes. On TikTok’s analysis, full capacity will not

be restored until 2029. Ms Huang avers that these measures will be very difficult to reverse,
and explains why.


84. He also explains that Suspension Solution will delay the launch of a TikTok service,

TikTok Shop, in new countries in the EEAfor a short period.


                                           3185. Vilma Todri,Associate Professor of Information Systems and Operations Management

at Emory University’s Golzueta Business School,Atlanta also prepared a report, verified on
affidavit, about the adverse impact the Suspension Solution will have on key stakeholders:

users, creators, advertisers and sellers. This will, Professor Todri says, ultimately drive

stakeholders to competitor platforms.


86. She also expresses the opinion that the degradation in the stakeholder experience will
likely inflict harm on TikTok’s brand perception.


87. Paul Jacobs of Grant Thornton prepared a report on the financial impact of the

suspension solution. His report is based on financial analysis provided by Weishu Xu,

Investor Relations Team Member at ByteDance Inc who has also sworn an affidavit. Mr

Jacob opines that a reasonable estimate of lost profit contribution for TikTok in the EEA is
US$1.716 billion in the suspension period, being three years from the date the Suspension

Order comes into effect, to include the period before it takes effect.


88. In addition, he estimates that other TikTok group entities, outside the EEA, will incur

additional personnel costs of US$3.105 billion. He describes these lost revenues and costs
as extremely significant. He also describes the estimates as conservative insofar as they do

not take account of other likely losses such as impacts on company/market valuation, and

impacts on goodwill/brand.


89. JianyeYe, Head of Privacy and Security Engineering Department, TikTok Inc swore an

affidavit explaining the data controls and protections operated by TikTok, including a
detailed description of the measures put in place under Project Clover. He refers to the fact

that NCC Group has been appointed as a third-party cybersecurity and privacy engineering

provider to review, validate and monitor the protections and assure their continued efficacy.
TikTok’s position isthat themeasures whichit has put in place provideequivalent protection

to that available within the EEA and that the DPC misunderstood, made errors, or

inadequately assessed the measures TikTok has put in place when making the Suspension

Order. This, of course, is disputed by the DPC.

                                            3290. An affidavit, exhibiting his report, was also filed by Stephen Bailey, Global Director of

Privacy at NCC Group, which has been appointed to provide oversight of TikTok’s data

controls and protections, which explains the Project Clover controls and NCC’s oversight
role. In particular, he describes how the process of pseudonymisation works to prevent

attribution of data to an EEAuser.


91. In addition, Professor Stefan Schiffner, Professor of IT Security and Computer

Networks at Berufliche Hochschule Hamburg, prepared a report, also verified in an
affidavit, in which he concludes that the method for testing of the effectiveness of the

pseudonymisation by NCC was appropriate and in line with industry good practice.


92. The DPC’s principal replying affidavit was sworn by Cian O’Brien, Deputy

Commissioner in the DPC. His affidavit commenced with some preliminary observations,
includingthattheDPCdisputedthesecondapplicant’sstandingintheseproceedings,apoint

which does not need to be addressed for the purpose of this application. He also observed

that TikTok had not set out the jurisdictional basis for this application, an objection not

pursued at the hearing during which the DPC expressly accepted that the court has
jurisdiction to grant a stay, a proposition which could hardly be doubted in light of the

relevant case law.


93. The affidavit then helpfully sets out the DPC’s position in opposing the stay: that the

application should be determined by the test in Zuckerfabrik, that the very large number of

TikTok users whose data was potentially affected was relevant in considering the stay, and
that the fundamental rights of those users in relation to their personal data required a high

level of protection.


94. It noted the duty on a data controller when transferring personal data to a third country.

It noted various acknowledgements by TikTok, including that personal data was being
transferred to and being processed in China, its acceptance that Chinese law did not offer an

equivalent level of protection to that in the EU, and that an equivalent level of protection


                                            33could not be achieved by use of standard contractual clauses (SCCs) alone, since they are

not binding on the Chinese authorities.


95. Theaffidavit explained that a critical aspect ofTikTok’s case related to its interpretation
of Chinese law and, in particular, the territoriality principle which TikTok claimed meant

that Chinese authorities could not compel access to data stored outside China, but

temporarily accessible within China. Mr O’Brien referred to affidavits of Professor
Dongsheng Zang, Professor of Law at the University ofWashington School of Law, Seattle,

and of Dr Paul Hunton, an independent consultant specialising in digital and cyber security,

which disputedTikTok’s interpretation of how the territoriality principle would apply in this

instance.


96. It should be noted that TikTok objected to the admissibility of these affidavits in
circumstances where the DPC had not relied on any evidence from Professor Zang or Dr

Hunton during the course of the inquiry and had, in fact, expressly taken TikTok’s evidence

on Chinese law “at its height”.


97. Mr O’Brien noted that TikTok had not submitted any updated DTA since the one
submitted during the course of the inquiry in July 2024.


98. He noted that it was the DPC’s position that it was required to suspend the transfer of

data in light of its finding that an equivalent level of protection was not assured. He

described the Suspension Order here as “carefully formulated and nuanced”, allowing for

re-consideration in light of new measures and noted that TikTok had had two years to
prepare for it, since the publication of the PDD.


99. Finally, Mr O’Brien highlighted the recent disclosure by TikTok that some personal

data had, in error, been stored on TikTok’s servers in China, in the circumstances described

above.


100.Theaffidavit highlights theduties onadata controllerand the connection between those
duties and the protection of fundamental rights, while acknowledging that these are

                                           34principally matters forsubmission. MrO’Briendescribes thehistoryoftheinquiry, rejecting

any apparent suggestion byTikTok that theDPC haddelayedorbeen dilatoryin theprogress
of the inquiry.


101.Mr O’Brien addresses TikTok’s reliance on Project Clover. He says that Project Clover

was “carefully considered” in the Decision.


102.Mr O’Brien then makes some observation on TikTok’s appeal, contesting the merits of

the appeal, before considering the application for a stay. In relation to the stay, the affidavit
asserts that the damage alleged to be suffered by TikTok is purely pecuniary which cannot

constitute serious and irreparable harm save in exceptional circumstances. In relation to the

financial harm which may potentially be suffered by TikTok, he refers to the affidavit of

Kieran Wallace, Managing Partner of Interpath (Ireland) Limited and its Global Head of
Restructuring, which contends that even on the applicant’s case the damage suffered could

not be regarded as serious and irreparable. Mr Wallace also challenges the nature of the

exercise conducted by Paul Jacobs in calculating potential losses.


103.Mr O’Brien then sets out the DPC’s position that, even if serious and irreparable harm
had been established, a stay would be inconsistent with EU law. He notes that the precise

nature and scale of the risks to EEA users is unknown, referring to various aspects of the

Decision.


104.Anu Talus, Chairperson of the EDPB, also swore an affidavit in support of the DPC’s

position opposing the stay. She does not state on whose behalf she has sworn the affidavit:
she does not, in particular, state that she makes the affidavit on the EDPB’s behalf. She

describes the consistency mechanism at Article 60 of the GDPR. Much of her affidavit is a

statement of the legal position, or legal submission, and not, therefore, admissible evidence.


105.She refers to the receipt by the SACs of the draft decision. She says that “all of the
[SACs] accepted, without objection, the infringement findings made by the DPC…. They

also endorsed the corrective measures proposed by the DPC.” During the hearing, counsel


                                            35clarified that Ms Talus meant that the SACs had “endorsed” the corrective measures by not

submitting reasoned objections to them.


106.She then sets out her views as to why the stay should be refused. These mirror, to a
large extent, what is said in Mr O’Brien’s affidavit.


107.The additional affidavits filed by the DPC have been referred to above.


108.Dr Paul Hunton swore an affidavit, exhibiting his report,, within which he addresses

specific questions posed of him by the DPC. In effect, he was asked by the DPC whether, in

light of the DTA and Jiang Ye’s affidavit evidence, data transferred to China temporarily –
bybeing remotely accessedthere – could be accessedand processedin China.TikTokobject

to the admissibility of this affidavit (and that of Professor Dongsheng Zang) on the basis

that it was not evidence before the DPC when it made its decision.


109.Dr Hunton contends in his report that TikTok have not provided enough detailed
information to enable him to assess the risks. He highlights the risks of persons gaining

malicious or unauthorised access to a device connected to TikTok’s operation network in

China, although this had not formed any part of the DPC’s consideration in arriving at the

Decision. He notes that he cannot rule out the risks from Chinese state-actors, which are the
risks with which the DPC was concerned.


110.Professor Zang concluded in his report, which was exhibited to his affidavit, that he

disagrees with theTikTok’s positionin relation to Chineselawandtheterritoriality principle

and that “[n]either the territoriality principle, nor the concept of “overseas data” as
contended for byTikTok Ireland, prevents theexercisebypublicauthoritiesof their statutory

powers to procure (or compel) access to the data in the way that it is claimed.”


111.Kieran Wallace’s affidavit and report review the evidence contained in the Jacobs

Report. Mr Wallace raises various issues regarding the robustness of the analysis, including

the fact that there has been no benchmarking of the data against others in the industry. He


                                            36also notes that even on TikTok’s figures, the extent of losses predicted, while “material” are

unlikely to pose a threat to the Group’s financial stability or disrupt its ongoing operations.


112.TikTok filed further affidavits in reply.

113.In summary, Ms Huang provided a further affidavit in which she contested the DPC’s

position that TikTok’s loss would be purely pecuniary. She contends that the changes to

TikTok’s workforce if the Suspension Solution is implemented would result in the loss of

valuable skill and knowledge, which will have a negative impact on its employees and their
families, including those who may be made redundant. She again describes the difficulty

“or impossibility” of reversing changes made. She also rejects an apparent suggestion in the

DPC’s affidavits that the Suspension Solution may not be the least costly means by which

TikTok can implement the Suspension Order.As counsel put it, TikTok is motivated to find
the least expensive and least disruptive means of meeting the requirements of the

Suspension Order.


114.Jianye Ye and Stephen Bailey both swore further affidavits in response to Dr Hunton,

disputing the validity of his conclusions. Mr Bailey’s affidavit (in fact, the further report he
exhibits) also addresses some of the hypothetical scenarios postulated by Professor Zang in

his report and concludes that identification of users would not be possible in the scenarios

identified by Professor Zang.


115.Professor Pietzuch also swore a further affidavit exhibiting a second report in which he

disputes Dr Hunton’s criticisms of the level of detail contained in the documentation
supplied by TikTok, confirming that in his view the information provided is in line with

industry best practice. He also addresses Mr Wallace’s criticism that Mr Jacobs’ financial

assessment had not been bench-marked. He says that he is not aware of any instance where
the restriction on access to data required by the Decision has occurred and, in those

circumstances, expressed the view that benchmarking data is unlikely to exist. Mr Jacobs

and Mr Xu also prepared reports and affidavits in response to Mr Wallace and Mr O’Brien

in which they stand over their initial assessments.

                                           37   116. TikTok also rely on two affidavits from Chinese law experts Professor Ke Xu, and Yi

   Zhang, Partner of Fangda Partners, Shanghai, both of whom had provided advice relied on

   by TikTok during the Inquiry. Both dispute Professor Zang’s interpretation of Chinese law
   as it applies to the data the subject of the Decision.


   117.Theonly further reply filed by theDPC was an affidavit from ProfessorZang exhibiting

   a second report in which he concludes that the reports of Professor Xu and Mr Zhang did

   not cause him to change his opinion.


   118.The final volley of affidavits from TikTok consisted of two further affidavits exhibiting
   further reports from Professor Xu and Mr Zhang. Unsurprisingly, they continue to dispute

   Professor Zang’s interpretation of Chinese law insofar as it applies to these proceedings.


   119.The foregoing sets out the factual and legislative background against which to consider

   TikTok’s application for a stay. It will be necessary to consider the admissibility of various
   of the affidavits, and the relevance of the recent disclosure regarding personal data being

   stored in China, before applying the relevant test. Before doing any of that, it is necessary

   to determine what the relevant test is.



Case law on threshold applicable

        i.     Union law



   120.There was some suggestion in the DPC’s affidavits and legal submissions that the court

   mayhave no jurisdiction to grant interim measures in cases concerning cross-border transfer
   of data in breach of the GDPR. In particular, it was suggested, by reference to the following

   conclusion in Schrems II, that the transfer of data must be suspended:


        112.    Although the supervisory authority must determine which action is appropriate

        and necessary and take into consideration all the circumstances of the transfer of


                                               38     personal data in question in that determination, the supervisory authority is

     nevertheless required to execute its responsibility for ensuring that the GDPR is fully
     enforced with all due diligence.



     113.    In that regard, as the Advocate General also stated in point 148 of his Opinion,
     the supervisory authority is required, under Article 58(2)(f) and (j) of that regulation,

     to suspend or prohibit a transfer of personal data to a third country if, in its view, in the

     light of all the circumstances of that transfer, the standard data protection clauses are

     not or cannot be complied with in that third country and the protection of the data
     transferred that is required by EU law cannot be ensured by other means, where the

     controller or a processor has not itself suspended or put an end to the transfer.



121.These observations are, of course, addressed to a supervisory authority which has
carried out an investigation and reached conclusions that data transferred to a third country

is not subject to an equivalent level of protection, rather than to a court dealing with an

application for interim measures. At the hearing, the DPC made clear that it accepted that
there was a jurisdiction to grant interim measures, in this case a stay, but it argued that the

relevant threshold was that applied in joined Cases C-143/88 and C-92/89, Zuckerfabrik

Suderdithmarschen v Hauptzollamt Itzehoe and Zuckerfabrik Soest GmbH v Hauptzollamt

Paderborn (“Zuckerfabrik”) and not that set out in Okunade v Minister for Justice [2003] 3
IR 153, [2002] IESC 49, the latter being the relevant ‘national procedural law’ in this

context.


122.The Zuckerfabrik proceedings concerned a preliminary reference in proceedings

challenging the imposition of a levy by the Italian authorities on the basis of a special

elimination levy on sugar introduced by a European Community (EC) Regulation. In the

proceedings, Zuckerfabrik challenged the national authorities’ decision to impose the levy
on the basis that the EC Regulation was invalid. There was thus a direct challenge to an EC

measure, which could only be determined by the Court of Justice.



                                            39123.TheItalian courtreferred questions onthevalidity oftheRegulation – as it was required

to do – but also referred questions on the jurisdiction to suspend the implementation of the
national measure, and the conditions under which the national court may so suspend.


124.The court made clear that the national courts must have a jurisdiction to suspend:


     16.     It should first be emphasized that the provisions of the second paragraph of

     Article 189 of the Treaty cannot constitute an obstacle to the legal protection which

     Community law confers on individuals. In cases where national authorities are
     responsible for the administrative implementation of Community regulations, the legal

     protection guaranteed by Community law includes the right of individuals to challenge,

     as a preliminary issue, the legality of such regulations before national courts and to

     induce those courts to refer questions to the Court of Justice for a preliminary ruling.


     17.     That right would be compromised if, pending delivery of a judgment of the

     Court, which alone has jurisdiction to declare that a Community regulation is invalid
     (see judgment in Case 314/85 Foto-Frost v Hauptzollamt Luebeck-Ost [1987] ECR

     4199, at paragraph 20), individuals were not in a position, where certain conditions

     are satisfied, to obtain a decision granting suspension of enforcement which would

     make it possible for the effects of the disputed regulation to be rendered for the time
     being inoperative as regards them.



     18.     As the Court pointed out in its judgment in Foto-Frost, cited above, (at
     paragraph 16), requests for preliminary rulings which seek to ascertain the validity of

     a measure, like actions for annulment, constitute means for reviewing the legality of

     acts of the Community institutions. In the context of actions for annulment, Article 185

     of the EEC Treaty enables applicants to request suspension of the enforcement of the
     contested act and empowers the Court to order such suspension. The coherence of the

     system of interim legal protection therefore requires that national courts should also be

     able to order suspension of enforcement of a national administrative measure based on

     a Community regulation, the legality of which is contested.
                                            40     …


     20.     The interim legal protection which Community law ensures for individuals

     before national courts must remain the same, irrespective of whether they contest the

     compatibility of national legal provisions with Community law or the validity of
     secondary Community law, in view of the fact that the dispute in both cases is based on

     Community law itself.”



125.The Court then considered that conditions which should apply to such a grant. Having
concluded that a suspension could only be granted where there was “serious doubt as to the

validity of the Community regulation” and any suspension must retain its interim character,

the court observed:


     25.     As regards the other conditions concerning the suspension of enforcement of

     administrative measures, it must be observed that the rules of procedure of the courts

     are determined by national law and that those conditions differ according to the
     national law governing them, which may jeopardize the uniform application of

     Community law.



     26.     Such uniform application is a fundamental requirement of the Community legal
     order. It therefore follows that the suspension of enforcement of administrative

     measures based on a Community regulation, whilst it is governed by national

     procedural law, in particular as regards themakingandexaminationof the application,
     must in all the Member States be subject, at the very least, to conditions which are

     uniform so far as the granting of such relief is concerned.



     27.     Since the power of national courts to grant such a suspension corresponds to
     the jurisdiction reserved to the Court of Justice by Article 185 in the context of actions

     brought under Article 173, those courts may grant such relief only on the conditions



                                           41     which must be satisfied for the Court of Justice to allow an application to it for interim

     measures.


     28.     In this regard, the Court has consistently held that measures suspending the

     operation of a contested act maybegrantedonlyintheevent of urgency,in otherwords,
     if it is necessary for them to be adopted and to take effect before the decision on the

     substance of a case, in order to avoid serious and irreparable damage to the party

     seeking them.


     29.     With regard to the question of urgency, it should be pointed out that damage

     invoked by the applicant must be liable to materialize before the Court of Justice has

     been able to rule on the validity of the contested Community measure. With regard to

     the nature of the damage, purely financial damage cannot, as the Court has held on
     numerous occasions, be regarded in principle as irreparable. However, it is for the

     national court hearing the application for interim relief to examine the circumstances

     particular to the case before it. It must in this connection consider whether immediate
     enforcement of the measure which is the subject of the application for interim relief

     would be likely to result in irreversible damage to the applicant which could not be

     made good if the Community act were to be declared invalid.




126.There is considerable case law of the CJEU regarding the application of this test to
which I will refer, as necessary, below.



127.Zuckerfabrik involved a preliminary reference in which a national measure was
challenged on the basis that the underlying EU measure on which the national measure was

based was invalid. In Case C-432/05, Unibet (London) Ltd v Justitiekanslern, the

proceedings concerned whether a national measure was consistent with EU law, i.e. there

was no challengeto any EUmeasure.Thequestion was whetherthesameconditions applied
to the grant of interim measures in such circumstances. TheAdvocate General and the Court


                                           42both concluded that they did not, and that any such application should be decided in

accordance with national procedural rules in accordance with the principle of procedural
autonomy.


128.In her opinion, theAdvocate General observed:


     “93.   It is true that in Zuckerfabrik and Atlanta the Court laid down Community law

     conditions for the grant of interim relief by national courts, including the suspension of

     a national measure based on a Community measure. Those cases concerned the alleged
     invalidity of the underlying Community legislation. In such cases, of course, only the

     Court has jurisdiction to declare the Community measure invalid. In such a context

     there is a clear Community interest in having uniform strict criteria. In contrast, the

     present case is concerned with the validity of a national measure which by definition
     applies in only one Member State. In such a case, I see no reason to depart from the

     general rule of procedural autonomy. Indeed it would seem more logical for the

     procedure governing interim suspension of a national law on grounds of alleged
     incompatibility with Community law to be the same as that governing interim

     suspension of a national law on other, purely domestic, grounds (in application of the

     principle of equivalence), provided always that the principle of effectiveness is also

     satisfied.


     94.    Moreover in Zuckerfabrik the Court observed that the power of the national

     courts to grant the suspension of a Community measure corresponds to the jurisdiction
     reserved to the Court of JusticebyArticle 242EC. Itaccordinglyruledthat thenational

     courts could grant such relief only on the same conditions as must be satisfied for the

     Court of Justice to grant an application for interim measures. That approach ensures

     consistency in the rules governing the grant of interim relief, irrespective of whether a
     challenge is brought under Article 230 or by wayof Article 234 EC. In the present case,

     in contrast, there is no such analogy with the jurisdiction of the Court. As the United

     Kingdom submits, the closest parallel lies in the power of the courts of the Member


                                           43    States to determine substantive questions of incompatibility. There, procedure is

    governed by national rules, subject to the principles of equivalence and effectiveness.


    95.    I do of course bear in mind that the Court stated in Zuckerfabrik that the

    “interim legal protection which Community law ensures for individuals before national
    courts must remain the same, irrespective of whether they contest the compatibility of

    national legal provisions with Community law or the validity of secondary Community

    law, in view of the fact that the dispute in both cases is based on Community law

    itself”. That dictum does not, in my view, decide the issue raised by the third question
    in the present case. In Zuckerfabrik, the issue before the Court was whether interim

    relief – which, in accordance with Factortame I, a national court must be able to grant

    pending a ruling by the Court on the question of compatibility – should be available

    where the validity of a Community regulation underlying a national measure was being
    challenged. The Court was not however asked to determine the criteria for the grant of

    interim relief by a national court in proceedings concerning a national measure

    allegedly incompatible with Community law.”


129.The Court agreed:



    79.     It is clear from established case-law that the suspension of enforcement of a
    national provision based on a Community regulation in proceedings pending before a

    national court, whilst it is governed by national procedural law, is in all Member States

    subject to conditions which are uniform and analagous with the conditions for an
    application for interim relief brought before the Community Court (Joined Cases C-

    143/88 and C-92/89 Zuckerfabrik Süderdithmarschen and Zuckerfabrik Soest [1991]

    ECR       I-415,    paragraphs      26     and     27;     Case     C-465/93 Atlanta

    Fruchthandelsgesellschaft [1995] ECR I-3761, paragraph 39; and Joined Cases C-
    453/03, C-11/04, C-12/04 and C-194/04 ABNA and Others [2005] ECR I-10423,

    paragraph 104). However, the case in the main proceedings is different from those

    giving rise to those judgments in that Unibet’s application for interim relief does not

                                          44     seek to suspend the effects of a national provision adopted in accordance with a

     Community regulation where the legality of that regulation is contested, but rather the
     effects of national legislation where the compatibility of that legislation with

     Community law is contested.


     80.    Therefore, in the absence of Community rules governing the matter, it is for the

     domestic legal system of each Member State to determine the conditions under which

     interim relief is to be granted for safeguarding an individual’s rights under Community

     law.”



     ii. National law



130.In Dowling v Minister for Finance [2013] 4 IR 576, the Supreme Court confirmed that

the domestic law test for the grant of an injunction (or stay), as set out in Okunade, satisfied
therequirements of equivalence andeffectiveness.TheCourtobservedas follows in relation

to Unibet (at p. 617):


     “86.    Equally, it is clear from Unibet (London) Ltd. and Unibet (International) Ltd.

     v. Justitiekanslern (Case C-432/05)[2007] E.C.R. I-2271 that, where there is a

     challenge to a national measure, national procedural rules are to apply subject to the

     principles of equivalence and effectiveness. It follows that it is possible that different
     results might arise in different member states, in the event of a challenge to similar

     national measures, because of the applicability of different procedural regimes,

     provided always that each such regime must provide an effective remedy.”


131.Thetest in Okunadehas been appliedconsistently bytheIrish courts to decisions giving

effect to EU law, including in recent decision in Aer Lingus Limited v Irish Aviation

Authority and Ors [2024] IEHC 625, a case in which there was also a debate about which
test applied. However, the decision in Eircom v Commission for Communications


                                           45Regulation [2022] IEHC 165 suggests that cases where the Zuckerfabrik test applies to the

grant of interim measures are not confined to challenges to EU measures. In that case, the
High Court (MacDonald J) concluded that the appropriate test for the grant of a stay in the

context of an appeal under the European Communities (Electronic Communications

Networks and Services) (Framework) Regulations 2011 (“the Framework Regulations”)
was that set out in Zuckerfabrik. He did so, having regard to the fact that the Framework

Regulations give effect to Directive 2001/02/EC (“the Framework Directive”) and he

interpreted the Directive as requiring harmonisation of the test for interim measures.


132.The Zuckerfabrik test was also applied in an application for a stay in an appeal under

the Framework Regulations in Three Ireland (Hutchison) Limited v Commission for

Communications Regulation [2022] IECA 300. In the High Court, the applicant accepted

that that was the appropriate test, but sought to argue otherwise in the Court ofAppeal. The
Court concluded that it was impermissible to argue for a different test in the Court ofAppeal

having accepted that Zuckerfabrik was the test in the High Court. The court (Collins J)

nonetheless made the following observations, which both parties in these proceedings
accepted were clearly obiter:


     “95.   If it had been open to Three to advance that argument, and in the event that it

            appeared that the outcome of the appeal might turn on the issue of the

            applicable test, the Court might have had to give consideration to making a

            reference to the CJEU pursuant to Article 267 TFEU. So far as the researches
            of the parties could ascertain, this aspect of Article 4(1) of the Framework

            Directive (now Article 31(1) of the Recast Directive) has never been considered

            by the Court of Justice. There can be little doubt that, as the Judge concluded
            in Eircom and as Counsel for Three accepted in argument here, the language of

            the relevant recitals appears clearly to point to the application of the

            Zuckerfabrik test. But recitals are not operative legislative provisions. Recitals

            may, of course, be relied on to resolve ambiguity in related legislative
            provisions. However, a notable feature of the relevant legislative provision here


                                           46        is that it expressly refers to the granting of interim measures “in accordance

        with national law” (my emphasis). That language was introduced by the Better
        Regulation Directive and has been retained in the Recast Directive. On their

        face, the recitals and the operative legislative provision appear to be in tension

        and there may be scope for argument that the recitals must yield to the terms of
        Article 4(1) in those circumstances. There are, of course, other factors to be

        considered also in this context, including the legal basis of the functions being

        carried out by ComReg and in particular the legal and regulatory rules for the

        spectrum allocation function being exercised here (the ultimate source of which
        is, according to Three, the Framework Directive). The fact that Three’s right of

        appeal, and its entitlement to seek a stay on ComReg’s Decision, ultimately

        derive from EU legislation are also very relevant considerations in this context.

        All these considerations might appear to indicate that the position here is closer
        to Zuckerfabrik than to Okunade or Dowling (or Unibet).



96.     With becoming frankness, Mr Kennelly argues that it should be easier to obtain
        interim relief when one is challenging a domestic measure and not impugning

        an EU measure. But that argument begs the question as to the appropriate

        characterisation of the impugned measure here. It seems wholly implausible to

        suggest that theDecision, madebytheIrish NRAwithin a regulatoryframework
        governed by EU law, can properly be characterised as a purely domestic law

        measure, such as was at issue in Dowling. Any such suggestion appears wholly

        at odds with Three’s acknowledgment that the ultimate source of ComReg’s
        decision-making competence here was the Framework Directive and that any

        claimfor damages that Threemight seekto makeagainst ComRegin connection

        with the functions at issue is governed by Francovich principles. If the

        availability of a restrictive claim for non-contractual damages against the EU
        under the Treaties is, in general, an answer to an application for interim

        measures against the EU, why as a matter of principle should not the



                                       47            availability of a similar claim not be an answer to an application for interim

            measures against a national body exercising EU law functions?


133.The reference to Francovich principles is of some significance. The CJEU has made

clear that wholly financial loss can rarely meet the threshold of irreparable harm because of
the availability of Francovich damages in the event that an EU measure is found to be

unlawful. In Dowling, the Supreme Court noted similarities between the Zuckerfabrik and

Okunade thresholds, regarding the adequacy of damages.As Collins J observed (at [87]) in

Three Ireland, the court did not, however, advert to the fact that, when applying
Zuckerfabrik, “financial loss might be regarded as reparable even though the prospect of

actually recovering monetary compensation was limited by reason of the restrictive rules

governing the non-contractual liability of the Union and its institutions…” since the

evidence in Dowling was that full reparation would be made.


134.TheCourtofAppealmadeclear,inpublicprocurementproceedings, thatthedifficulties

in recovering Francovich damages is relevant when considering the adequacy of damages
as a remedy. In Word Perfect Translation Services Limited v Minister for Public Expenditure

and Reform [2018] IECA 35, a public procurement case, Hogan J considered that, in those

proceedings, damages could not be regarded as an adequate remedy for the purpose of the

test in Okunade:


     “58.   It would have to be accepted, therefore, that a claimant such as Word Perfect
            would not find recovery of damages straightforward, even if, following a full

            hearing, a material breach of the procurement rules were actually to be

            established.


     59.    What implications does this conclusion have insofar as the present case is

            concerned? As the Supreme Court stressed in Okunade v. Minister for Justice

            [2002] IESC 49, [2003] 3 I.R. 153, the task of the Court in the context of an
            interlocutory application such as this is to assess the facts and apply legal


                                           48               principles designed to ensure the minimum possible injustice to the parties

               pending the outcome of the main action. If, however, the ability of Word Perfect
               to recover damages is highly restrained this clearly impacts on the manner in

               which these factors should be weighed and balanced.”




       iii.    Other jurisdictions


   135.TikTok also relies on the decision of the Administrative Court of Luxembourg in

   Amazon Europe Core SARL v Commission Nationale pour La Protection des Données, Case

   46630, dated 17 December 2021. In that case, the supervising authority in Luxembourg, the
   CNPD, had issued a decision which requiredAmazon to take corrective measures.Amazon

   appealed the decision and sought a stay on the corrective order pending determination of

   that appeal on grounds similar to those advanced by TikTok in this case, i.e. it would
   irreversibly impact on the company and adversely affect the experience of its users. The

   court granted the stay in that case. It is clear from the court’s ruling that in so doing, it

   decided the question of a stay by reference to national procedural law – there was no

   reference to Zuckerfabrik.


   136.It must be noted, however, that there does not appear to have been any discussion

   regarding the applicable threshold.Apoint not argued is a point not decided. Moreover, the

   applicable national procedural law in that case had, in any event, some similarity to the
   Zuckerfabrik test. In the absence of any evidence regarding Luxembourg law, this is merely

   an observation, rather than a conclusion. The case is thus of interest, but hardly

   determinative.



Arguments



   137.In brief terms, TikTok argues that in the absence of harmonisation, the applicable

   threshold for the grant of an interim remedy is a matter for the national courts, to be
                                              49determined in accordance with national law. It argues that this is the default position, and it

is only where the measure being impugned is an EU measure, that is, a decision of an EU
body, that the case law of the CJEU indicates that the same minimum standards must apply

across the EU.


138.It contends that the decision impugned here is a national law measure. It is a decision

of the DPC, a body established by Irish law. Its status as a national law measure is not

affected by the fact that before the Decision was made, the DPC was required to consult

with other SACs in accordance with Article 60, or by the fact that the DPC could not have
finalised the decision in the event of a reasoned objection by any SAC without reaching

agreement on that reasoned objection, or a referral of any dispute to the EDPB.


139.TikTok contends that its argument that the criteria for a stay on a decision of a

supervising authority is governed by national procedural law is supported by the wording of
the GDPR and by the case law discussed above.


140.The DPC argues that its decision cannot be regarded simply as a national law measure,

and characterise a decision of a supervising authority following theArticle 60 co-operation

procedure as a decision adopted or agreed by all supervising authorities, a characterisation

it argues is supported by the wording of the GDPR, referring, in particular, to Recital 126,
which refers to decisions being “agreed jointly”, and by the case law. It places significant

emphasis on its contention that a decision made following the completion of theArticle 60

procedure is a decision “with binding effect in all Member States”. It argues that the crucial
consideration in deciding whether an application to stay a decision made under the GDPR

is governed by national procedural law or whether it must be determined by reference to the

same standard as a challenge to an EU law measure is the effect of the decision. Given that

decisions of a supervising authority can have binding effect across the EU, similar to an EU
law measure, they should be subjected to the same standard.


141.It argues that a requirement that an application for a stay be determined by reference to

thecriteria required when seeking astayonanEU measuredoes not involveadisapplication

                                            50   of national procedural law, or a departure from, what it accepts is, the default position that

   in the absence of harmonisation, national procedural rules apply. In this regard, it draws a
   comparison with the requirement for a uniform approach in relation to damages per Cases

   C-6/90 and C-9/90, Francovich v Italian Republic.


   142.The DPC points to the inconsistencies which might arise were such applications

   governed by national procedural law in each jurisdiction. It refers to the decisions in Case
   C-132/31, BE in which the court emphasised that member states must ensure that their

   procedural rules ensure a consistent and homogenous application of the GDPR. It also refers

   to Case C-645/19, Facebook Ireland Limited, in which the court suggested that ineffective

   application of the GDPR by supervising authorities could result in “forum shopping”.


Discussion on applicable threshold



   143.The DPC argues convincingly that a decision of a supervising authority made in

   accordance with Article 60 of the GDPR cannot simply be characterised as a national law
   rather than an EU law measure. This echoes the observation of Collins J in Three Ireland

   that it was “wholly implausible” to describe a decision under the Framework Regulation as

   a “purely domestic law measure”.


   144.By the same token, the DPC appears to accept that such a decision cannot be

   characterised as an EU law measure, or as a decision of an EU body. If this were not in any

   event obvious, it is made abundantly clear by the GDPR itself, which expressly establishes
   the EDPB as a Union body, but makes no such provision in relation to supervising

   authorities.


   145.The decision-making procedure created by the GDPR appears to be novel; neither of

   the parties were able to identify an analogous process, or at least not one which had been
   the subject of consideration by the courts in the context of an application for interim

   measures. In those circumstances, the identification of whether this application is governed


                                              51by national procedural law or by the criteria governing an application to stay an EU measure

cannot solely be resolved by reference to the distinctions drawn in Zuckerfabrik or Unibet.
Rather, the answer must be found in the terms of the GDPR itself, and then a consideration

of how the principles identified in the case law can be applied to this novel process.


146. The DPC lay emphasis on the repeated references in the recitals to the GDPR to the

co-operative nature of the decision-making under the Article 60 procedure, to the
requirement for agreement before a decision can be reached, and the binding nature of the

decision. It refers to the decision in Case C-645/19, Facebook, and the emphasis by the

Advocate General on the “one stop shop” decision-making process and the necessity for

agreement and consensus.


147.It must first be observed that in describing the process in Facebook, the court was not
at all concerned with the question at issue here, the applicable test for interim measures, but

was rather considering the question of whether a supervising authority could bring

proceedings in relation to an infringement of the GDPR in relation to cross-border
processing if it was not the lead supervising authority in respect of that processing.


148.Second, the DPC may have somewhat overstated the binding effect of decisions of a

supervising authority. As appears from Article 60(6), a decision of a supervising authority

is only binding on the supervising authorities concerned, as defined in Article 4(22) of the

GDPR. However, it is clear that where, as here, the transfers in issue are occurring across
the EEA, the Decision will have binding effect on most, if not all, supervising authorities.


149.Of greater significance, perhaps, is what ‘binding’means in this context.Anational law

measure will be binding on the party to whom it is directed. Where the State has jurisdiction

to regulate the activities of a data controller whose main establishment is in the State, the
fact that a decision binds that data controller within the EU does not appear to me to be a

sufficient point of distinction from any other decision by a national regulator made pursuant

to EU law to warrant the disapplication of national procedural autonomy in proceedings

before a national court.

                                             52150.What is novel about the GDPR regime – other than the consistency mechanism itself –
is that the decision binds other supervising authorities concerned. But this must, I think, be

understood as a manifestation of the ‘one-stop shop’ regime, which was described as the

purpose of the consistency mechanism in the GDPR in Case C-645/19, Facebook. There is
nosuggestion,forinstance,andtheDPCdidnotcontend,thatdecisionsofaleadsupervising

authority are binding as to the interpretation of the GDPR. They plainly are not, and could

not be, that.


151.The binding nature of decisions do not, therefore, reflect an attempt to elevate decisions

of lead supervising authorities to quasi-EU law measures. Rather, the purpose is to ensure

the integrity of the one-stop shop mechanism and enable data subjects and data controllers

to deal with a single supervising authority in respect of any given issue (save in the
circumstances provided for inArticle 58(5) of the GDPR).


152.It is true that the GDPR emphasises the necessity for co-operation and that decisions

cannot be finalised without consensus between lead supervising authorities and the

supervising authorities concerned (or a ruling from the EDPB) and that has some
significance in consideration of the threshold applicable. Of far greater significance, in my

view, are two factors.


153.Firstly, the GDPR clearly provides that a decision of a supervising authority is a

decision of that body, carrying with it the important legal consequence that a challenge to
that decision must be brought in the court’s of the member state in which that supervising

authority is established. There is no suggestion, for instance, that it should be regarded as

the decision of all supervising authorities, or even all supervising authorities concerned,

such that it becomes possible to challenge a decision in the courts where any other
supervising authority is established.


154.In fact, as the DPC highlighted during its submissions, Article 60(9) of the GDPR

provides for split decisions, where parts of a complaint are upheld and parts rejected. In

                                            53such cases, the lead supervising authority adopts the part of the decision upholding the

complaint, whereas the supervising authority in which the complaint was made adopts the
part of the decision rejecting the complaint. This procedure is reflected in section 114 of the

2018 Act, requiring the DPC to adopt decisions of lead supervising authorities dismissing

complaints where the DPC is the supervising authorities. This facilitates complainants in
bringing proceedings in their own member state. The implication of this provision is not that

decisions made pursuant to Article 60 should be regarded as joint decisions, but rather that

the GDPR attaches importance to identifying by who a decision is made, and the

consequences thereof.


155.Secondly, and perhaps decisively, the GDPR, unlike the Framework Directive (where
there were conflicting provisions) makes no provision for harmonisation of procedural rules

for challenges to decisions made under the Regulation, something the legislature could

clearly have done had it so wished. Recital 143 of the Regulation expressly provides that
“proceedings should be conducted in accordance with that Member State’s procedural law”.

This, as the DPC accepts, is the default position and there is nothing in the provisions of the

GDPR which suggest thatthedefault positionis displaced.Quitethecontrary,theconferring

of jurisdictions on national courts and the express invocation of national procedural law
strongly indicate otherwise and must be regarded as a deliberate choice by the legislature.

It is true that the GDPR seeks to ensure consistency in decision making by supervisory

authorities, by requiring that they co-operate with each other. By contrast, however, it

confers jurisdiction on national courts to provide effective remedies in relation to such
decisions, with no reference to co-operation or harmonisation. If, as the DPC in effect

contends, the GDPR does require harmonisation, at least in relation to applications for

interim measures, this is a surprising omission.


156.If national procedural law applies, an apparent anomaly could be said to arise insofar
as some decisions of supervising authorities may be made without reference to the EDPB,

but others may require that the EDPB issue a ruling in the event of a dispute, which ruling

will be binding on the lead supervising authority.Although there was no intervention by the

EDPB in this case, it seemed to me, and the parties accepted, that the question of the
                                           54applicable threshold could not turn on whether or not the dispute resolution mechanism had,

in fact, been engaged (or on how many SACs there were). The fact that it was capable of
being engaged is what is relevant.


157.Since the EDPB is an EU body, established under the GDPR, it seems that the

Zuckerfabrik criteria would likely apply if there were a challenge to a decision of that body.

AlthoughthequestionofwhetheritispermissibletochallengeadecisionoftheEDPB under
the consistency mechanism at all is the subject of the pending WhatsApp proceedings, and

it may be that if the view of the General Court prevails, no anomaly arises, even if the

Advocate General’s view is adopted by the court, it seems to me that this complexity is one

recognised by the GDPR itself and does not affect the determination of whether the GDPR
requires harmonisation of procedural rules in relation to interim applications.


158.In fact, any anomaly is more apparent than real. If a lead supervising authority adopts

a decision on the basis of a EDPB ruling pursuant to the consistency mechanism, any

challenge to that decision must still be brought in the courts of the member state of that lead
supervising authority. However, those courts are obliged to refer any question as to the

lawfulness of the EDPB ruling to the CJEU, and will thus not decide on that application. If,

as appears to be the case, the national court is required to apply the Zuckerfabrik criteria

when considering an application for interim measures in such a case, this reflects the fact
that that the legal issues arising in the challenge are ones which must be determined by the

CJEU and not the national court. The application of different criteria in such a case to one

which can be decided by the national court is, therefore, unsurprising and reflects the
distinction drawn in Unibet.


159.This is expressly reflected in Recital 143, which acknowledges the consequence of

conferringjurisdictiononnationalcourtstodeterminechallengestodecisionsofsupervising

authorities. It provides that where the validity of a decision of the EDPB is at issue in such

a challenge, a national court must refer that question to the CJEU for determination. In
circumstances where the GDPR expressly recognised that the validity of decisions of

supervising authorities and of the EDPB must be determined in different fora, there is

                                           55nothing anomalous about different criteria applying in relation to decisions the validity of

which must be challenged before national courts, and those the validity of which must be
challenged beforetheCJEU.TheDPC arguethatit would be“perverse, or at least illogical”

if the more restrictive Zuckerfabrik criteria applied in the case of disagreement, but the more

permissive Okunade principles applied where there was none. That is, of course, to ignore
the fact that, in the former scenario, any dispute would have been resolved by an EU body,

the EDPB.


160.In response to the clear statement in Recital 143 regarding national procedural law, the

DPC inventively sought to argue that the application of the Zuckerfabrik criteria would not,

in fact, involve a disapplication of national procedural rules at all, but rather, would impose
a requirement that national procedural rules meet certain minimum thresholds. This is

difficult to accept. Of course, national procedural rules must respect the principles of

equivalence and effectiveness, as the Supreme Court has determined the Okunade test does
in Dowling, but it would bea curious form of autonomy which requiredthat different criteria

apply even where the procedural rules satisfy those requirements. Moreover, all of the

relevant case law is based on the proposition that either national procedural rules apply or

the Zuckerfabrik criteria apply. This reflects the reality; if a national court were required to
apply the Zuckerfabrik criteria to a stay application, this would involve a departure from

procedural autonomy, insofar as those criteria differ from those applicable to stay

applications in that jurisdiction.


161.The DPC suggested that its interpretation of the Zuckerfabrik criteria, in effect, as a
graft on to national procedural rules such that procedural autonomy was respected, is what

occurred in Francovich. I do not think that this is correct. Francovich identified a

substantive obligation on member states to make good loss and damage caused by a breach

of EU law. However, it clearly provided that it was for the “internal legal order” of the
member states to lay down the procedural rules for safeguarding that right (see [42]).






                                            56162.The GDPR, therefore, has not harmonised, and does not require the harmonisation of,

national procedural rules. In light of Recital 143, andArticle 78 of the Regulation, this can
only be understood as a deliberate legislative choice.


163.In circumstances where interpretation of the GDPR strongly suggests that national

procedural autonomy should apply to applications for a stay on decisions of supervisory

authorities, is there anything in the case law of the CJEU or the national courts which
suggests to the contrary? In my view, there is not.


164.The DPC place significant emphasis on the possibility of divergent or conflicting

decisions should each jurisdiction apply its national procedural rules when hearing

challenges to decisions under the GDPR. That, of course, is an argument which proves too

much. If procedural autonomy is to be permitted at all in challenges to decisions giving
effect to EU law – which the DPC accepts is the default position – then the possibility of

divergence always arises and is an accepted part of the EU regime, as noted by the Supreme

Court in Dowling.


165.Moreover, the risk of conflicting decisions is virtually eliminated by the one-stop shop
mechanism created under the GDPR. There is no real possibility of a conflicting decision

arising on the issues the subject matter of the decision in these proceedings, whether due to

divergence in procedural rules or otherwise, because the decision of the DPC is binding on

the supervising authorities concerned.


166.Furthermore, what is at issue in this application are the procedural rules applicable to a
preliminary application, an application for a stay, not the substance of the proceedings and

not, therefore, the interpretation of the GDPR (other than as it relates to the procedure which

applies to this application). Thus, the real concern where there is a lack of harmonisation,
the possibility of differing interpretations or applications of EU law, does not arise. The

possible concern about forum shopping which was raised in Case C-645/19, Facebook, was

in the context of supervising authorities and the risk that data controllers might favour

jurisdictions in which supervising authorities failed to discharge their obligations under the

                                            57GDPR. The DPC did not direct me to any authority for the proposition that procedural

autonomy should be disapplied for this reason, nor is there any evidence to support the
underlying assumption in that argument, that the State’s procedural rules are, in this

instance, more permissive than those of other EU member states. The Supreme Court has

concluded in Dowling that the national law procedure in relation to the granting of interim
measures respects the principles of equivalence and effectiveness. It is difficult to accept,

therefore, the proposition that those rules should be disapplied or varied lest data controllers

select the states in which they establish by reference to the procedural rules which might

apply in the event that at some future point they are required to seek a stay on a decision of
a supervising authority.



167.Turning to the relevant case law, Zuckerfabrik and Unibet remain the two cases which

identify the demarcation point for the purposes of determining this question. In
Zuckerfabrik, the challenge was to a national law measure but on the basis of the invalidity

of an EU measure. The ratio of the Court’s decision was that the EU measure could have

been challenged by an annulment action and, although it was permissible to challenge the
EU measure in a preliminary reference, the same criteria had to apply to both types of

challenge. Thus, the national court had to apply the EU standard when considering an

application for a stay in the context of a preliminary reference.


168.No such consideration arises here. Pursuant to the GDPR, TikTok could not have

challenged the DPC’s decision in an annulment action. No one suggested otherwise. No
question of aligning the criteria for a challenge with those applicable to annulment actions

arises.


169.In these proceedings, not only is there no challenge to an EU measure, but a significant

partofthechallengeisadvancedonwhatmightberegarded aspurelydomesticlawgrounds.
In particular, TikTok’s claims of breach of fair procedures appear referable not to provisions

of the GDPR but to domestic law requirements of natural and constitutional justice. The

DPC certainly did not suggest that TikTok was confined to complaints based on EU law. It


                                           58   is certainly conceivable that a decision of the DPC could be successfully challenged on

   purely domestic law grounds.


   170.Although decisions of the DPC are capable of having EU-wide effect, that effect is
   confined to the decision concerned and, in substance, the affected parties. There is, in truth,

   nothing surprising about a decision having such an effective scope, nor does that scope

   require that the procedural autonomy of the courts of a member state conferred with
   jurisdiction be displaced.



   171.Accordingly, this application falls to be considered in accordance with the principles

   set out in Okunade. However, I will, for completeness, reference the Zuckerfabrik criteria
   when carrying out my assessment.



Arguments



   172.Rather than detail exhaustively the arguments of the parties, I propose to provide a
   headline summary here and then address them in more detail in assessing the application of

   the Okunade test.


   173.In circumstances where the DPC submissions were directed in the main to the

   Zuckerfabrik criteria, as were much of TikTok’s, it is worth comparing the two tests to see

   how the Okunade principles “map” on to those in Zuckerfabrik.


   174.Okunade involved judicial review proceedings, and a very different type of decision

   than that at issue here, a deportation order. However, the DPC did not suggest that the
   principles identified in Okunade would not apply with equal force in the context of a

   statutory appeal: indeed, the decision the subject of these proceedings has also been

   challenged in judicial review proceedings, and, as the DPC accepted, the stay could just as
   easily have been sought in those proceedings.




                                              59175.In Okunade, the Court carried out a very detailed review of the principles which apply

to an application to stay an administrative decision or measure, including a consideration of
the analogous principles which apply in the case of an application for an interlocutory

injunction. Ultimately, the Court concluded (at p. 193):


     “[104] As to the overall test I am of the view, therefore, that in considering whether to

     grant a stay or an interlocutory injunction in the context of judicial review proceedings
     the court should apply the following considerations:-

            (a) the court should first determine whether the applicant has established an

            arguable case; if not the application must be refused, but if so then;

            (b) the court should consider where the greatest risk of injustice would lie. But
            in doing so the court should:-

                    (i)giveallappropriateweighttotheorderlyimplementationofmeasures

                    which are prima facie valid;
                    (ii)givesuch weight as maybeappropriate(if any) to anypublicinterest

                    in the orderly operation of the particular scheme in which the measure

                    under challenge was made; and,

                    (iii) give appropriate weight (if any) to any additional factors arising on
                    the facts of the individual case which would heighten the risk to the

                    public interest of the specific measure under challenge not being

                    implemented pending resolution of the proceedings;

                    but also,
                    (iv) give all due weight to the consequences for the applicant of being

                    required to comply with the measure under challenge in circumstances

                    where that measure may be found to be unlawful.
            (c) in addition the court should, in those limited cases where it may be relevant,

            have regard to whether damages are available and would be an adequate

            remedy and also whether damages could be an adequate remedy arising from

            an undertaking as to damages; and,



                                            60            (d) in addition, and subject to the issues arising on the judicial review not

            involving detailed investigation of fact or complex questions of law, the court
            can place all due weight on the strength or weakness of the applicant's case.”




176.The overriding consideration, once a serious issue to be tried has been established, is

how to ensure the least risk of injustice.


177.The Zuckerfabrik test is summarised by the DPC in its submissions (at [159]) in the

following way:


     “An applicant must therefore:

            (a) Establish “serious doubts” as to the validity of the EU measure (the “merits
                test”);

            (b) Establish urgency by demonstrating, as a matter of probability, that the

                interim relief is necessary to avoid serious and irreparable damage prior to

                the resolution of the proceedings (the “urgency test”); and
            (c) Take account of the interests of the EU, and demonstrate that the urgency

                identified outweighs those interests and any other interests arising (the

                “European interests test”).” [Emphasis in original]


178.In very broad terms, the merits test seems to be “substantially the same” as the
requirement that there be a serious issue to be tried, as suggested by McDonald J in Eircom

(at [31]), the urgency test encompasses considerations which arise in considering the

adequacy of damages, and the European interests test requires a balancing exercise,

balancing the potential harm if a measure is implemented but ultimately determined to be
invalid, against the harm of delaying the implementation of a measure which is

presumptively valid, as does the least risk of injustice analysis. Accordingly, arguments

advanced by both parties by reference to the criteria in Zuckerfabrik, can be read across to
the application of the Okunade test.



                                            61179. As noted above, the DPC has accepted for the purpose of this application that TikTok

has raised serious doubts as to the validity of the Decision, i.e. has identified a serious issue
to be tried.


180.TikTok argues that if it is required to implement the Suspension Order pending

determination of its appeal, it will suffer serious and irremediable damage. It argues that

once it puts in place the Suspension Solution, that cannot readily be undone – or at least that
undoing the steps it proposes to take will be as disruptive as putting them in place in the first

instance. It argues that damages are not an adequate remedy for the damage it will suffer. In

this regard, it contends that its losses will not merely be financial, that any financial damage

it suffers will be exceptionally difficult to quantify, and that there is a serious question of
whetherit could recover damages, whetheronthe basis of Francovich orotherwise.Itrelies,

in this last respect, on the decision of the Court of Appeal in Word Perfect Translation

Services. It notes that the DPC enjoys an immunity from suit pursuant to section 154 of the
2018Act.


181. The DPC rejects the contention that damages are not an adequate remedy. It queries

the extent of the loss which TikTok claims it will suffer, but contends, in any event, that

TikTok’s purported loss is entirely financial. It argues that it is apparent from TikTok’s

evidence that any such loss will not threaten the viability of TikTok and, accordingly, the
evidence does not establish that this is one of the exceptional cases where the availability of

Francovich damages is not a full answer to a claim for interim measures.


182.In relation to the least risk of injustice, TikTok does not dispute that the court must give

all due weight to the Decision, but contends that in the particular circumstances of this case,
the balance falls in its favour. In this regard, it argues that having regard to the steps it has

put in place since the temporal scope of the Inquiry expired, there is no real risk that EEA

user data will be processed in China in breach of the GDPR and therefore, there is no

significant EU interest at stake which requires to be balanced against its undoubted interest
in not having to comply with the Decision pending the determination of its appeal. It places

reliance on the fact that the DPC has made a ‘negative’finding, thatTikTok has not satisfied

                                             62   the requirement to show that an equivalent level of protection is available, rather than a

   ‘positive’finding, that there is not, in fact, an equivalent level of protection. It also relies on
   the fact that the finding of a breach of Article 46 is, in effect, historic, since the temporal

   scope of the Inquiry was fixed as ending in May 2023, and cannot be relied on by the DPC

   as evidence of a current risk in light of the significant changes made by TikTok, by its
   implementation of Project Clover, since then.


   183.The DPC argues that the EU interests in this case involve fundamental rights and

   therefore must weigh very heavily against any delay in implementing the Decision. It

   contends that TikTok is impermissibly inviting the court to look behind its decision when

   contending that there is no real risk of a breach of the GDPR. It contends that it considered
   in detail the Project Clover measures when making the Suspension Order, and accordingly,

   it is impermissible for TikTok to rely on those measures now as ‘changed’ circumstances

   since the making of that order. It notes that TikTok has not submitted a revised DTA since
   July 2024.


   184.Both parties agree that the court should not ordinarily consider the merits of the

   underlying proceedings, but both, nonetheless made submissions on the merits. To be fair

   to the DPC, its oral submissions on the merits were largely in response to those advanced

   on behalf of TikTok who argued that its appeal on, in particular, fair procedures grounds is
   “indisputable” (Transcript Day 1, p. 61).



Admissibility




   185.Despite the objections to the admission of various affidavits, in particular, by the DPC,
   the parties did not delay unduly in raising these objections, and so I will deal relatively

   briefly with the issues here.



   186.Mirroring TikTok’s objections to the admissibility of the affidavits from Ms Talus, Dr
   Hunton and Professor Zang, and the evidence regarding the ‘OnCall’ platform, the DPC

                                               63objects to TikTok relying on evidence that there is, in fact, no risk of personal data breaches

in the circumstances of this case, which it argues is an impermissible attempt by TikTok to
‘look behind’the Decision in this case.


187.I agree with the DPC’s position up to a point. It is only permissible in the context of a

stay applications to invite the court to consider the merits of a decision-maker’s decision

where there are no disputed issues of fact, or the issues of law are straightforward. So, where
a decision is manifestly unlawful, it might be possible to argue that, just as an injunction

will be granted as of right where there is no defence to the proceedings in which the

injunction is sought, a stay may be granted where there is no defence to the challenge to the

lawfulness of an administrative decision.


188.Although TikTok argued that some aspects of its appeal were very strong, indeed,

indisputable, it suffices to say that I do not accept that TikTok has established at this stage
that there is no answer to its claim, or that the complex issues of fact and law to which these

proceedings give rise are capable of being resolved in an interlocutory application. It is

impermissible, therefore, for TikTok to invite the court to reach conclusions on the question

of the least risk of injustice which are at odds with the findings of the DPC.


189.It is, however, permissible for TikTok to adduce evidence which addresses matters
which it argues, are not encompassed by the DPC’s decision. In this regard, it is notable that

TikTok did not seek to adduce additional Chinese law evidence, save in response to that led

by the DPC. It did, however, seek to lead evidence regarding the actual level of risk caused
by the data transfers in China in circumstances where, it argues, the DPC has only assessed

that there is a risk – because TikTok hasn’t established that there is an equivalent level of

protection to that in the EU – not what that risk is.AsTikTok notes, the DPC’s own affidavit

evidence is that the level of risk is unknown.


190.Similarly, I think it is permissible for the DPC to adduce evidence regarding the level
of risk involved in granting a stay – it would be unfairly hamstrung if TikTok were so

permitted, but it could not. That is the apparent purpose of Professor Zang’s affidavit and

                                             64the evidence regarding the ‘OnCall’ platform. There is nothing inconsistent about that

evidence and the Decision. I stress, however, that entirely different considerations may arise
if the DPC sought to adduce the same evidence in order to defend the lawfulness of the

Decision. That is a matter for another day.


191.I can, therefore, have regard to Professor Zang’s affidavits, and, necessarily, the

affidavit delivered by TikTok in reply to him.


192.Different considerations arise in relation to Dr Hunton’s affidavit and that of Ms Talus.
Although the opinion of Ms Talus, as chairperson of the EDPB, is clearly worthy of respect,

it is not clear what evidential weight it purports to have. Her affidavit consists largely of

legal submission and her opinion that the stay should be refused. There is very limited

factual information in the affidavit, and nothing which adds to the information in the
Decision. I cannot see that it adds anything to the DPC’s case. I note that the Decision was

circulated to all the SACs in the EEA and none raised a reasoned objection. Although not

determinative of the legal test which should apply to this application, it is a factor which can
be weighed in the balance in considering the interests of justice. Ms Talus’s affidavit does

not add to that weight.


193.Nor is Dr Hunton’s evidence admissible. Dr Hunton relies on matters not relied on by

the DPC in making its decision. It is inconsistent with the DPC’s decision, or at least seeks

to advance entirely different reasons on which the Decision might have been based, e.g.
inadequacy of information, and the risks from malicious actors. The DPC is not permitted

to argue for the immediate enforcement of the Decision, i.e. the refusal of a stay, on grounds

that it could have, but did not, rely on when making the Decision. That would not involve
giving all appropriate weight to a decision which is presumptively valid, or having regard

to the EU interests arising: the Decision had little to do with the issues raised by Dr Hunton

at all.






                                             65Assessment



   194.As is clear, there is no dispute that there is a fair issue to be tried. The DPC accepts, for

   the purpose of this application at least, that TikTok’s appeal has identified serious doubts as
   to validity of the Decision, and that the first threshold of the Zuckerfabrik test is met. There

   was no dispute that this also meant that the Okunade threshold of a serious issue to be tried

   was met. It is on the other limbs of each test where the battle lines were drawn.


        Adequacy of damages / Serious risk of irremediable damage



   195.TikTok has presented comprehensive evidence of the financial costs or losses it will
   likely incur if required to implement the Suspension Solution. First, it has explained the

   necessity for the Suspension Solution. It has then explained the likely consequences of

   implementing that solution. Finally, it has sought to estimate the costs of implementing the

   solution. The figures presented are, on any view, very significant.


   196.The DPC has queried whether the Suspension Solution is the best means of meeting the

   Suspension Order. It has not queried the purported impacts the Suspension Solution will
   have on TikTok’s critical business processes if fully implemented, but has queried whether,

   in fact, full implementation would be required if, for instance, the appeal was determined in

   TikTok’s favour before the end of the Suspension Period. It has, through Mr Wallace’s

   affidavit, queried the calculation of estimated losses/costs. In oral submissions, it was also
   suggested that the any cost that TikTok might incur in implementing the Suspension

   Solution might be offset by savings in further implementation of Project Clover measures,

   the estimated cost of which dwarfs even the cost of the Suspension Solution.


   197.It is worth observing that conflicting evidence has been presented by the parties in this
   case. The DPC has not sought to cross-examine TikTok’s witnesses (nor has TikTok sought

   to cross-examine the DPC’s). In light of the decision in RAS Medical Ltd v The Royal

   College of Surgeons in Ireland [2019] 1 IR 63, [2019] IESC 4, a question arises as to how

                                               66the court should approach the evidence. As McDonald J noted in the Eircom case, the

Supreme Court has determined that cross-examination, save in exceptional cases, is not
appropriate in an interlocutory application (see, IBB Internet Services v Motorola [2013]

IESC 53). McDonald J concluded, therefore, that:


     “41. I must, therefore, do the best I can on the basis of the affidavits presented. And I

     must, for example, reach a conclusion as to whether Eircom has established on the
     evidence that it will be exposed to serious and irreparable harm if a stay is not granted.

     Since that is an issue that I am required to consider and since the onus of proof lies on

     Eircom in this regard, I believe that ComReg and the Notice Parties must be entitled to

     comment adversely on the quality of the evidence put forward by Eircom. In my view,
     they do not have to seek to cross-examine in order to do so. That said, the fact that

     cross-examination is not available at this interlocutory stage means that they cannot

     readily undermine evidence which is plausible on its face.”


198.Accordingly, I must likewise do the best I can on the basis of the affidavit evidence

presented.


199.Notwithstanding the queries raised by the DPC, I am satisfied that TikTok has

established a probability that it will incur very significant costs if required to implement the
Suspension Solution. The evidence presented is robust. On the technical front, the in-house

evidence of Ms Huang is supported by the expert evidence of Professor Pietzuch and

Professor Todri. Mr Xu’s financial projections are endorsed in Mr Jacobs’s Report. Though
Mr Wallace has queried some of the methodology, TikTok has sought to address his queries

in its replying affidavits. Mr Wallace’s analysis does not, therefore, serve to undermine the

detailed evidence of TikTok.


200.Nor have the doubts expressed by the DPC, regarding the extent to which the

Suspension Solution may have to be implemented pending the hearing of TikTok’s appeal,
or any potential savings which might be achieved in the implementation of Project Clover,

been sufficiently explored by theDPC in its evidenceto lead me to rejectTikTok’s evidence.

                                            67201.Intruth, theDPC’s mainargumentwas not thatTikTok would not incursignificant costs

– though the precise scale of those costs was disputed – rather, it argued that any loss

suffered was purely financial, and, therefore, compensatable in damages. TikTok’s evidence
was significantly more detailed than, for instance, the evidence relied on in Case C-639/23

P(R) Amazon Services Europe Sàrl v European Commission, a decision discussed below in

more detail, which did not prevent a finding of irreparable harm in that case (though the stay
was refused on other grounds). I am satisfied, therefore, that TikTok has established to the

requisite standard that it will suffer significant financial loss if required to give effect to the

Suspension Order pending the hearing of its appeal.


202. Is there any loss which it will suffer which is not financial? TikTok, in particular in Ms

Huang’s affidavit, identifies certain non-pecuniary loss which she says TikTok will suffer.
These include loss of institutional knowledge and expertise, irreversible harm to CGE

personnel and their families, whether by their relocation or being made redundant. Mr

Jacobs refers to loss of goodwill and market value.


203.Regarding the impact on CGE personnel and their families, this cannot be regarded as
a loss to TikTok for the purpose of considering whether it will suffer harm. It may, however,

be relevant in the balancing of interests.


204.The loss of institutional knowledge and expertise is undoubtedly a loss to TikTok, but

in my view, it should properly be regarded as a pecuniary loss, since its impact is on the

value of TikTok’s business. Similarly, other purportedly non-pecuniary losses, including
damage to TikTok’s brand, or its competitiveness must also be regarded as financial or

pecuniary.


205.However, the classification of these losses as financial or pecuniary does not mean that

damages are an adequate remedy, or that the losses should not be regarded as serious and
irreparable.




                                            68206.First, a question arises as to whether damages would be recoverable at all if TikTok

incurred losses and ultimately succeeded in its appeal. Although the DPC argue that
Francovich damages are recoverable, the reality of that as a proposition must be open to

doubt for a variety of reasons.


207.TikTok refers to the fact that the DPC has immunity from suit, per section 154 of the

2018 Act, and argues that damages are, therefore, not available. Without determining the
issue, there must be a question over whether an emanation of the State could rely on a

statutory immunity to defeat a claim for Francovich damages.Accordingly, I don’t propose

treatingtheremedyasunavailablebyreferenceto section154.This does,however, highlight

one hurdle which any party would have to overcome if seeking to recover damages in the
event of a successful appeal against a decision of the DPC. In circumstances whereTikTok’s

appeal is not confined to EU law issues, it is entirely possible that Francovich damages

would not, in any event, be available if it succeeds in its appeal: it may depend on which
grounds of appeal prove successful.


208.Difficulty in recovering Francovich damages has been recognised by the Court of

Appeal, in Word Perfect Translation Services, as a basis for concluding that Francovich

damages are not an adequate remedy. Given the scale of the potential losses which may be

suffered by TikTok, I am quite satisfied that a hypothetical remedy in damages is not an
adequate remedy for TikTok in this instance.


209.That conclusion can be reached even without considering the difficulty which would

likely arise in seeking to calculate TikTok’s losses. In Curust Financial Services Ltd v

Loewe-Lack-Werk [1994] 1 IR 450, the Supreme Court (Finlay CJ), concluded in relation to
the adequacy of damages (at p. 469):


     “Difficulty, as distinct from complete impossibility, in the assessment of such damages

     should not, in my view, be a ground for characterising the awarding of damages as an

     inadequate remedy.”



                                           69210. The Court referred to there being no “insuperable difficulties” in calculating damages,

characterising it as a matter of calculating the value of market share in a “stable and well-
established” market, the sale and distribution of rust primers. In this case, the calculation of

damage which might be suffered by TikTok across a whole range of categories not

encompassed by their calculations of projected losses, would face such insuperable
difficulties that it must be regarded as virtually impossible. In Mr Wallace’s affidavit, he

refers to the lack of benchmarking ofTikTok’s estimated losses, and Mr Jacobs explains that

there is no benchmarking because the type of disruption envisaged has never occurred

within the industry. This serves to highlight the impossibility of capturing all the losses
which TikTok might suffer in an entirely dynamic market, as far removed from the rust

primer market at issue in Curust as it is possible to conceive.



211.For completeness, it seems to me that in light of the decision in the Amazon case
referred to above, the same difficulty in calculating damages would lead to a conclusion that

TikTok would suffer serious and irreparable harm, i.e. the urgency test would be met.


212.At issue in Amazon was the designation of Amazon as a very large online platform

pursuant to Regulation (EU) 2022/2065 (the Digital Services Act). Such a designation
imposed an obligation onAmazon to provide an “opt out” (Article 38), and an obligation to

make publicly available, through a reliable and searchable tool, a repository containing

detailed information regarding all advertisements on the platform (Article 39). Amazon

challenged its designation as a very large online platform and sought a stay on the
obligations imposed on it by that designation.


213.There were obvious similarities to the instant case. The scale of losses predicted was of

a similar order, although the evidence substantiating that loss seems to have been

considerably weaker than here. As here, it was not suggested that Amazon’s financial
viability would be imperilled. Nonetheless, the Court was satisfied that the damage to

Amazon, if it were required to comply with the requirements of Article 39, constituted

serious and irremediable harm such as to satisfy the urgency test:


                                          70“132    As regards the irreparable nature of that damage, it should be borne in mind

that, admittedly, damage of a financial nature cannot, otherwise than in exceptional
circumstances, be regarded as irreparable since, as a general rule, pecuniary

compensationiscapable ofrestoringtheaggrievedpersontothesituationthatobtained

before he, she or it suffered the damage. That is however not the case, and such damage
can then be deemed to be irreparable, if it cannot be quantified (order of the Vice-

President of the Court of Justice of 2 March 2016, Evonik Degussa v Commission,

C-162/15 P-R, EU:C:2016:142, paragraph 92 and the case-law cited).


133   However, the uncertainty linked to reparation for harm of a pecuniary nature in

a possible action for damages cannot be regarded, in itself, as a circumstance capable

of establishing that such a harm is irreparable, for the purposes of the case-law of the

Court. At the stage of seeking interim relief, the possibility of subsequently obtaining
compensation for pecuniary damage, if an action for damages is brought following

annulment of the contested measure, is necessarily uncertain. Interlocutory

proceedings are not intended to act as a substitute for an action for damages in order
to removethat uncertainty, sincetheir purposeis onlyto guaranteethefull effectiveness

of the final future decision that will be made in the main action, in this case an action

for annulment, to whichtheinterlocutoryproceedings areanadjunct(see,tothat effect,

order of the Vice-President of the Court of Justice of 2 March 2016, Evonik
Degussa v Commission, C-162/15 P-R, EU:C:2016:142, paragraph 93 and the case-

law cited).


134     On the other hand, the situation is different where it is already clear, when the

assessment is carried out by the judge hearing the application for interim measures,

that, in view of its nature and the manner in which it will foreseeably occur, the harm

alleged, should it occur, may not be adequately identified or quantified and that, in
practice, it will not therefore be possible to make good that harm by bringing an action

for damages. That may be the case, inter alia, in a situation involving the publication

of specific and confidential commercial information (see, to that effect, order of the

                                       71        Vice-President    of    the    Court    of    Justice    of   2 March     2016, Evonik

        Degussa v Commission, C-162/15 P-R, EU:C:2016:142, paragraph 94 and the case-
        law cited).”



   214.The uncertainty was sufficient to demonstrate to the court that the pecuniary damage
   alleged is irreparable.



   215.Although the uncertainty arises for different reasons here, the quantification of damage

   is no more straightforward, for the reasons outlined above. Accordingly, even if the
   applicablethreshold were arisk ofseriousandirremediableharm,onthe evidence available,

   that threshold would be met.



Least risk of injustice /EU Interests test



   216.It bears emphasising that no injustice will have been done to TikTok by reason of it

   having to implement the Decision, and in particular, the Suspension Order pending the
   determination of its appeal, if the appeal ultimately fails. TikTok made various arguments

   about the unfairness of it being subject to restrictions which have not been applied to its

   competitors, but no weight can be attached to those concerns. All data controllers are
   required to comply with the same rules, TikTok cannot be heard to complain if those rules

   have a more significant impact on it, because of the manner in which its business is

   structured, than on its competitors. Orrather,its complaint must bepursued in the legislative

   rather than the judicial sphere.


   217.The potential injustice which must be weighed in the balance, is the potential injustice

   ofbeing required to comply with adecisionwhich is subsequently provedinvalid.This must
   be weighed against the injustice which might result if TikTok avoided, or delayed,

   complying with a decision, whose validity is upheld.




                                               72218.In Okunade, the Supreme Court indicated that all appropriate weight should be given

to the importance of decisions which are presumptively valid being implemented. In Krikke
v Barranafaddock Sustainability Electricity Limited [2020] IESC 42, the Court again

emphasised the importance of giving appropriate weight to valid measures. In that case,

what was at issue was the orderly operation of the planning code, described by O’Donnell J
(as he then was) as being “of high public importance”.


219.That requirement is of particular significance in this case where, what is at issue is a

risk to fundamental rights. This consideration must, accordingly, be given very considerable

weight, indeed, the DPC argues that it is decisive. In this regard, as noted above, the DPC

refers to Schrems II and the CJEU’s conclusion that a supervisory authority must suspend
transfers where it determines that there has been a breach of GDPR.


220.Notwithstanding the cogent arguments by the DPC that, in effect, the risk to

fundamental rights trumps any risk of injustice to TikTok, this application cannot simply be

resolved by an invocation of such rights. Were it the case that the engagement of
fundamental rights by a decision necessarily defeated any private interest which might be

asserted, and was treated as decisive in all cases, this would negate the balancing exercise

mandated by national, and indeed Union law, rendering a stay unavailable, undermining the

potential effectiveness of remedy.


221.There are a variety of factors in this case which point to a conclusion that the least risk
of injustice would be served by a limited stay on the Suspension Order, subject to certain

conditions.


222.The first consideration is the length of stay which is required to avoid the most

immediate risk of injustice. The Decision provides a period of six months before the
Suspension Order comes into effect. As a consequence of the temporary stay which was

granted when these proceedings were entered into the Commercial List, that period would

expire towards the end of March 2026 if I refused to continue the stay. However, the parties

have advised that the substantive proceedings should be in a position to be heard in March

                                            73of next year, subject perhaps to developments in other proceedings. This can certainly be

accommodated by the court, indeed an earlier hearing might be possible. In other words, the
appeal could well have been heard before the Suspension Order takes effect. If this

application were framed as an application for a stay pending the delivery of judgment in the

appeal, could it seriously be doubted that the least risk of injustice would require refusal of
the stay? I think not.


223.Of course, matters are not so straightforward. There may be delays in getting the matter

to hearing, and I acknowledge that the DPC has indicated certain concerns in that regard.

TikTok will be required to take steps in advance of the Suspension Order taking effect and

does not, therefore, have the full benefit of that six month implementation period before it
must take potentially irreversible steps. Given the multiplicity of issues raised in the appeal,

a judgment may not immediately be available. Any delay by TikTok could be addressed by

way of conditions attached to a stay, and any judge hearing the appeal will no doubt be
keenly aware of the importance of delivering a timely judgment where there may be an

ongoing risk to fundamental rights, something which they will be in a better position to

assess having heard the appeal. In any event, the timing of this application and of the

Suspension Order suggests that a grant of a stay pending determination of the appeal by this
courtmay result in a very limitedinterference with the orderlyimplementation ofa measure

which is prima facie valid.


224.Arelated consideration is the period of time over which the Inquiry took place, and the

additional time which the Decision afforded TikTok for compliance. Without in any way
wishing to suggest that theDPC delayed in progressing theInquiry,especially having regard

to the number of occasions on which it afforded TikTok an opportunity to provide further

information, it is reasonable to infer that the risks involved were not regarded by the DPC

as requiring greater urgency. The urgency procedure underArticle 66 of the GDPR was not
utilised. It was explained by counsel at the hearing that that procedure is only used in truly

exceptional cases, but, accepting that to be so, it is clear, at least, that this case is not that. It

is reasonable to conclude that a short further delay pending the determination of these


                                            74proceedings does not greatly increase the risk that TikTok’s failure to comply with Article

46 poses.


225.A further consideration is the particular nature of the finding by the DPC in this case.
The DPC has not concluded that the personal data at issue in these proceedings isn’t subject

to equivalent protection in China to that it would enjoy in the EU, rather that TikTok has

failed to discharge its obligations to establish that it is subject to such protections: what I
characterised as a negative rather than a positive finding earlier in the judgment. Moreover,

it is not the case that there are no protections in place, or no effort to afford protections by

TikTok.


226.Relatedly, it is important to note the temporal scope of the Inquiry, as determined by

the DPC. The finding that TikTok has failed to satisfy the requirements of Article 46 is

limited to a period concluding in May 2023.There is no finding that there is a current breach
of Article 46. That is not to suggest that I have concluded that it is impermissible for the

DPC to impose a Suspension Order on the basis of a finding of breach of the GDPR which

has a particular temporal scope. In this regard, I note the DPC’s argument that were it

otherwise, there would be never-ending investigations, with data controllers constantly
being afforded further opportunities to update their evidence to the DPC.


227.In this case, the DPC contends that it had regard to all the information provided by

TikTok about the changes it had made subsequent to the DPC issuing the PDD, i.e. outside

the temporal scope of the Inquiry. The DPC concluded that the Suspension Order was still
necessary. Of course, TikTok has appealed that finding, and its lawfulness, but it remains a

presumptively valid measure to which I must afford all appropriate weight.


228.However, it is, in my view, legitimate to distinguish between the findings made here

and a finding such as that discussed in Schrems II (at [111]), i.e. that the data being

transferred is not afforded an adequate level of protection, in assessing the risk of injustice
which might be occasioned if a stay were granted, that is, the risk of fundamental rights

being harmed.

                                            75229.In that regard, TikTok has provided detailed evidence that there is, in fact, no risk,
having regard to the Project Clover measures put in place, and the type of data involved,

and have adduced evidence from Chinese law experts, seeking to confirm that that is the

case. It has led uncontested evidence that no Chinese authority has ever sought to access
TikTok’s EEAuser data.


230.On the other side, the DPC has adduced its own Chinese law evidence, and has referred

to the ‘OnCall’incident to highlight that its concerns are not merely hypothetical. The DPC

has very fairly acknowledged that there is uncertainty about the risks involved, though it is

clear from the Decision that the risk of concern is of Chinese authorities accessing personal
data remotely accessed by CGE personnel in China, pursuant to the relevant Chinese laws

(what the DPC calls ‘the problematic laws’).


231.It would be inappropriate in the context of an interlocutory application, to express any

viewon theChineselawissue by referenceto affidavits whichmayormaynot beadmissible
in the substantive proceedings. It is possible, however, while giving all due weight to the

decision, to conclude on the basis of the evidence in this application that, even assuming the

validity of the DPC’s decision, the risk to EEA user data during the period of any required

stay does not appear to be significant.


232.A stay poses no risk to the orderly implementation of the GDPR regime, or to the

implementation of the Decision in due course. The main risk in granting a stay is that any
data which is remotely accessed in China may or will not have an equivalent level of

protection to that afforded it in the EU, and, as a consequence, that data may be processed

in breach of the requirements of the GDPR, and fundamental rights will be infringed. As

noted above, this is a weighty consideration.


233.The DPC relies on the decision in Amazon where, notwithstanding a finding of serious
and irreparable harm, the CJEU refused a stay because of the EU interest in giving effect to

the Digital Services Act. Just as the balancing exercise in that case favoured refusal of a

                                            76stay, it argues that a stay should be refused here, whether applying the Zuckerfabrik criteria,

or the test in Okunade.


234.Though Amazon clearly illustrates the weight to be given to EU interests in carrying
out a balancing exercise, in my view, the subject matter of those proceedings and of these

are sufficiently different, such that it would not be appropriate to treat the Amazon decision

as determinative of these proceedings.


235.What was at issue in Amazon was a decision of the European Commission on a central
feature of landmark legislation, the Digital Services Act. A failure to give effect to the

decision would, in the Court’s view “lead to a delay, potentially for several years, in the full

achievement of [the] objectives” of that Act. What is at issue here could not plausibly be

considered to have such a profound effect. There is nothing in these proceedings, or in a
grant of a stay, which would affect the operation of the GDPR generally. It involves a single

decision of a supervising authority. True, it is a decision of which all other SACs have been

notified, because of the scope of TikTok’s cross-border activities, and none have objected.
Thataddssomethingtotheweightwhichitshouldbeafforded. Buthowever theotherSAC’s

acceptance of the DPC’s decision is characterised, it remains a single decision pursuant to

the GDPR, which regulation will remain in full force and effect irrespective of these

proceedings.


236.It is also relevant, in this instance, to consider the persons potentially affected by a stay.
In Amazon, those affected were, in effect, every person affected by the Digital ServicesAct.

In this case, the group effected is confined to TikTok’s users.This, of course, remains a very

significant group, with over159 millionmonthlyusersofTikTok’s platform acrosstheEEA.
Moreover, the evidence is that they are typically younger users, the protection of whose

rights interests requires particular care.


237.TikTok, in fact, argues that the court should have regard to how those users will be

negatively affected if the Suspension Order is put in place, due to the deterioration in the



                                             77service provided by TikTok. Put otherwise, it is in the interests of the very people whose

fundamental rights are at risk if the Suspension Order is stayed that that risk be continued.


238.As appears from the second infringement finding in the Decision, the finding that there

was a failure to notify users of the nature of the transfers up to 1 December 2022, the DPC
was satisfied, by reference to TikTok’s December 2022 EEAPrivacy Policy that, after that

date, TikTok’s users were notified of the data transfers thereafter. As recorded at paragraph

604 of the Decisions:


     “The December 2022 EEA Privacy Policy also informed EEA users that personal data

     was stored on servers in the United States and Singapore, and was the subject of limited
     remote access by entities in TikTok’s corporate group located in Brazil, China,

     Malaysia, Philippines, Singapore and the United States.”


239.That must, I think, have some bearing on the extent to which it is necessary to refuse a

short stay in order to protect the fundamental rights of TikTok’s users.


240.What is not clear, is whether the users have been advised of the DPC’s findings against
TikTok, in particular, that it has not complied with Article 46 in relation to the transfers. I

can find no reference to such a notification in the papers. Of course, mere notification could

not suffice to render lawful a cross-border transfer of personal data which would otherwise

be unlawful. Express and informed consent to the transfer is required, per Article 49(1) of
the GDPR, to achieve that. However, in my view, any concern about the limited short-term

risk to TikTok users’fundamental rights would be somewhat ameliorated if their continued

engagement with the platform was on an informed basis about the issues identified by the
DPC (including the fact that TikTok has appealed the DPC’s findings).


241.In light of all of the above, it seems to me that the grant of a stay on the Suspension

Order, subject to certain conditions discussed below, gives rise to the least risk of injustice

per Okunade.



                                             78   242.Although not strictly necessary for me to decide, I also consider that, though no doubt

   more finely balanced than on an application of the Okunade principles, TikTok would have
   satisfied the EU interests test had it been applicable. TikTok has a much stronger claim for

   interim relief in this instance than didAmazon in its proceedings under the Digital Services

   Act. In that case, the asserted loss was speculative and not substantiated by detailed
   evidence. More importantly, in Amazon, the EU interests ‘in play’ were certain to be

   adversely affected during the period of any stay. Here, the evidence of loss is robust. The

   possibility of harm to fundamental rights is far from certain. Accordingly, the serious and

   irremediable harm which TikTok will suffer if the Decision is ultimately found to be invalid,
   outweighs the limited risk to EU interests if there is a short delay in implementation of the

   Suspension Order, on the basis of the conditions proposed.



Conclusion


   243.The appropriate test in determining whether to grant a stay on the implementation of

   the Suspension Order and the Corrective Order is the test in Okunade.


   244.In circumstances where the DPC accepts that there is a serious issue to be tried, the

   objective of the court is to seek to ensure the least risk of injustice pending the hearing of

   this appeal.


   245.I am satisfied on the evidence that TikTok will suffer significant damage if required to

   implement the Suspension and Corrective Orders in advance of its appeal being heard. I am
   further satisfied that although the damage can, broadly speaking, be characterised as

   pecuniary or financial, having regard to the scale of the damage which it will suffer, the near

   impossibility of quantifying the loss, and the limited prospect of TikTok ever being able to
   recover that loss if successful in its appeal, damages could not be regarded as an adequate

   remedy.





                                                79246.Although any delay in implementing the Decision does carry a risk to fundamental

rights, which weighs heavily in the balance, the evidence suggests that that risk is limited
and will be temporary. There is no risk to the implementation of the GDPR more generally

if a stay is granted.


247.In the circumstances, and subject to the imposition of conditions, the granting of a stay

in this instance creates the least risk of injustice.


248.If, contrary to what I have concluded above, the appropriate threshold for the grant of
astaywas that set out in Zuckerfabrik,thesameresult wouldbeachieved.TikTokwill suffer

serious and irremediable harm if no stay is granted. Although the EU interests engaged

involve a risk to fundamental rights, having regard to the extent of that risk, and the extent

of the possible loss to TikTok, it is appropriate to stay the implementation of the Suspension
and Corrective Orders, subject to conditions.


249.Those conditions flow from what has been discussed previously. First, the stay should

be for the shortest period possible. I therefore propose granting a stay pending the

determination of the appeal in this court on the basis of an undertaking by TikTok to
prosecute its appeal with all reasonable diligence and, in any event, to ensure, insofar as it

is within TikTok’s power to do so, that the appeal is heard not later than March 2026.


250.Second, TikTok will be required, insofar as it has not already done so, to notify, in a

mannertobeagreed,orindefaultasdirectedbythisCourt,allitsusersoftheDPC’sdecision

in clear and easily understood language. Any such notification may also refer to TikTok’s
appeal and to the stay now being granted.


251.Both parties shall have liberty to apply in relation to the continuation of the stay.









                                             80252.As previously indicated, the proceedings will be listed on 14 November 2025 at 11 am

to address any consequential orders.



















































                                           81
</pre>