Meta Platforms Ireland Ltd v DPC - 21 May 2026

• Judgment Date: 21 May 2026
• Year: 2026
• Issuer: High Court

1

THE HIGH COURT

JUDICIAL REVIEW

[2026] IEHC 323

Record No. 2025/1876 JR

BETWEEN

META PLATFORMS IRELAND LIMITED

APPLICANT

-AND-

DATA PROTECTION COMMISSION

RESPONDENT

JUDGMENT of Ms. Justice Siobhán Phelan, delivered on the 21st day of May, 2026

2

TABLE OF CONTENTS

INTRODUCTION ................................................................................................................................. 2

BACKGROUND AND CHRONOLOGY ........................................................................................... 4

PROCEEDINGS ................................................................................................................................. 32

COMMISSION GUIDANCE AND EDPB GUIDELINES .............................................................. 35

LEGAL FRAMEWORK .................................................................................................................... 36

Overview ........................................................................................................................................... 36

Regulation EU 2016/679 - GDPR ..................................................................................................... 37

Data Protection Act, 2018 ................................................................................................................. 48

ANALYSIS AND DECISION............................................................................................................. 56

Prematurity ....................................................................................................................................... 56

Statutory Vires ................................................................................................................................... 60

Fair Procedures ................................................................................................................................ 80

Legitimate Expectations .................................................................................................................... 85

CONCLUSION ................................................................................................................................... 95

INTRODUCTION

1. In these proceedings the Applicant, Meta Platforms Ireland Limited (MPIL)(formerly

Facebook Ireland Limited), seeks to challenge the draft of the Preliminary Draft

Decision (PDD) issued by the Data Protection Commission (the Commission) in its

capacity as Lead Supervisory Authority (LSA) on the 10th of October, 2025, in Inquiry

IN-18-7-1 (“the Inquiry”).

2. The Inquiry began in July, 2018, following a single user complaint (“the Complaint”).

The Complaint concerned access and portability rights under Articles 12, 15 and 20 of

Regulation (EU) 2016/679 of the European Parliament and of the Council of the 27th of

April, 2016, on the protection of natural persons with regard to the processing of

personal data and on the free movement of such data, and repealing Directive 95/46/EC

(General Data Protection Regulation)(GDPR) relating to MPIL’s “Hive” data

warehouse.

3. In the terms of its draft PDD, the Commission signals an intention to make findings of

infringement of Articles 12, 15 and 20 of the GDPR and to direct corrective measures

3

to include a reprimand, a compliance order affecting MPIL’s general data access

practices (not just the Complainant’s data access) and administrative fines totalling

€360–€430 million due to the significant impact of the said practices on millions on

users.

4. The central legal issue arising on the pleadings is the scope of the Commission’s powers

to direct corrective measures and impose administrative fines on foot of a single user

complaint. MPIL’s position is that the Inquiry was expressly complaint-based and

limited to the Complainant’s access and portability request. It maintains that the

Commission has unlawfully expanded the inquiry after the investigation stage

concluded into a systemic, EEA-wide assessment. It is contended that by doing so, the

Commission effectively converted the Inquiry into an “own-volition inquiry”, thereby

acting ultra vires its powers under the GDPR and the Data Protection Act, 2018

(hereinafter “the 2018 Act”). It is further contended that this broadening of scope or

conversion is in breach of the requirements of fair procedures and due process and

MPIL’s legitimate expectations based on the Notice of Commencement, Draft Inquiry

Report and Final Inquiry Report and established practices as evidenced by official

publications and the practice in other cases.

5. While the Commission maintained in pleadings and written submissions that the

proceedings are premature because the PDD is simply a “draft of a draft”, it further

contends that there has been no conversion of the Inquiry and that it has not only a

power but is also obliged to consider systemic effects in the context of deciding on

appropriate corrective measures once a finding of infringement is made.

Notwithstanding its prematurity plea, the Commission now asks the Court to determine

this issue. It relies on its broad discretion to impose effective, proportionate, and

dissuasive corrective measures and fines under Articles 58 and 83 of the GDPR,

whether in complaint-based inquiries or own-volition inquiries.

6. In essence, the question for determination is whether the Commission can, within a

complaint-based GDPR inquiry, impose systemic corrective orders and fines based on

a finding of an infringement which also affects the wider user base, or whether doing

so unlawfully exceeds its powers as the Inquiry’s scope is limited by the terms of the

individual complaint investigated. The determination of this primary vires issue bears