TikTok Technology Limited v DPC - 5 May 2026

• Judgment Date: 05 May 2026
• Year: 2026
• Issuer: Supreme Court

AN CHÚIRT UACHTARACH

THE SUPREME COURT

Supreme Court Appeal Number: S:AP:IE:2025:000148

[2026] IESC 27

O’Donnell C.J.

O’Malley J.

Hogan J.

Murray J.

Collins J.

IN THE MATTER OF SECTION 142 AND SECTION 150 OF THE DATA

PROTECTION ACT 2018

BETWEEN/

TIKTOK TECHNOLOGY LIMITED and TIKTOK INFORMATION

TECHNOLOGIES UK LIMITED

RESPONDENTS

– AND –

DATA PROTECTION COMMISSION

APPELLANT

JUDGMENT of Mr. Justice Brian Murray delivered this 30th day of April 2026

2

This appeal

1. This appeal arises from a decision of the appellant (“the DPC”) of 30 April 2025. There,

the DPC determined that the first-named respondent (“TikTok”) had infringed Articles

46 and 13(1)(f) of Regulation (EU) 2016/679 (“the GDPR”). The findings arose from

the transfer by TikTok of certain personal data of users of its services, to jurisdictions

outside the European Economic Area (“the EEA”). As a result, the DPC directed

TikTok to (a) suspend those transfers of data, (b) bring the processing of the data into

compliance with the GDPR, and (c) pay two administrative fines of €485M and €45M.

TikTok responded by initiating these proceedings, a statutory appeal against the

decision as enabled by ss. 142 and 150 of the Data Protection Act 2018 (“the 2018

Act”).

2. The matter now comes before this court by way of the DPC’s appeal against a decision

of the High Court (Mulcahy J.) granting a stay on the first two parts of this direction

pending the hearing of the full statutory appeal ([2025] IEHC 619). The parties agree

that the effect of the relevant provisions of the 2018 Act is that the obligation to pay the

administrative fines – the third part of the direction – was automatically stayed upon

the commencement of these proceedings.

3. Stays on administrative decisions that are the subject of proceedings by way of judicial

review, are not unusual. The factors to be taken into account in determining whether to

grant such orders have been identified and explained in a decision of this court,

Okunade v. Minister for Justice [2012] IESC 49, [2012] 3 IR 152 (“Okunade”). The

motion in this case, however, differs from most applications of this kind. This is so not

3

only because of the complexity of the legal and factual background to the appeal, and

not only because the application for a stay arises in the context of a statutory appeal

rather than proceedings by way of judicial review. It is also different because a

significant question arises as to whether this application is governed by Okunade at all,

or whether it should be determined by reference to a test developed by the Court of

Justice of the European Union (“the CJEU”) in the context of interim measures pending

a decision as to the validity of a provision of EU law. The DPC says that by reason of

the EU-wide effect of its decision, the test formulated in Okunade does not apply to the

grant or withholding of the stay sought by TikTok. It says that, instead, the application

should be determined using criteria formulated in Joined Cases C-143/88 and C-

92/89, Zuckerfabrik Süderdithmarschen AG v Hauptzollamt Itzehoe and Zuckerfabrik

Soest GmbH v. Hauptzollamt Paderborn (EU:C:1991:65) (“Zuckerfabrik”).

4. Two issues thus arise: which of these tests governs the application for a stay, and how

does that test fall to be applied in this case?

The parties

5. The involved legal and factual background to the impugned decision starts with the

GDPR. This Regulation has as its object the protection of natural persons with regard

to the processing of their personal data. It mandates the establishment in each Member

State of the European Union of one or more independent public authorities – ‘the

supervisory authority’. That authority is responsible for monitoring the application of

the Regulation (Article 51). The DPC is designated by the 2018 Act as ‘the supervisory

authority’ in this jurisdiction for the purposes of the GDPR (s. 11 of the 2018 Act).