Irish Court of Appeal

 

AN CHÚIRT ACHOMHAIRC

THE COURT OF APPEAL

 

APPROVED - NO REDACTION NEEDED

 

Record Numbers: 2024/177 & 2024/178

High Court Record Numbers: 2022 No. 339 MCA & 2023 No. 74 JR

Neutral Citation Number: [2025] IECA 60

 

Meenan J.

McDonald J.

Collins J.

 

BETWEEN/

META PLATFORMS IRELAND LTD

APPLICANT/ RESPONDENT

-AND-

THE DATA PROTECTION COMMISSIONER

RESPONDENT/APPELLANT

 

 

 

 

 

 

JUDGMENT of Mr. Justice Anthony M. Collins delivered on the 13^th day of March, 2025

I.                  Introduction

1.            The adage that too many cooks spoil the broth applies equally to case management. Judges at first instance are familiar with the litigation they are charged with managing. Orders made in that context often contain a discretionary element that make them difficult to challenge. Appeals against such orders do not assist in the timely and smooth determination of the main proceedings. For these reasons, appellate courts are rightly reluctant to disturb such first instance decisions. Case management decisions are, nevertheless, capable of being appealed from, which implies that, in at least certain circumstances, an appellate court may intervene in good conscience. In those instances, are appellate courts limited to considering the options that the parties present to them or can they have recourse to other, perhaps objectively better, solutions?  These issues arise out of litigation pending before both the courts of Ireland and of the European Union, against the backdrop of the operation of the mechanism for the protection of personal data in the European Economic Area ('EEA').

 

II.               Background

A.      The General Data Protection Regulation

2.            Article 16(1) of the Treaty on the Functioning of the European Union ('TFEU') and Art. 8(1) of the Charter of Fundamental Rights of the European Union recognise everyone's right to have their personal data protected.  On the basis of Art. 16(2) TFEU, the European Parliament and the Council enacted Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation (OJEU L 119, p.1, 'GDPR' or, where appropriate 'the Regulation'). Recital 13 to the GDPR states that, "[i]n order to ensure a consistent level of protection for natural persons throughout the Union and to prevent divergences hampering the free movement of personal data within the internal market, a Regulation is necessary to provide legal certainty and transparency for economic operators, ..., and to provide natural persons in all Member States with the same level of legally enforceable rights and obligations and responsibilities for controllers and processors, to ensure consistent monitoring of the processing of personal data, and equivalent sanctions in all Member States as well as effective cooperation between the supervisory authorities of different Member States. ...."

 

3.            Article 51(1) of the Regulation entrusts independent supervisory authorities in the Member States with responsibility for its application. By Art. 55(1) GDPR, each supervisory authority is competent on the territory of that Member State to perform the tasks assigned to, and to exercise the powers conferred upon, it. Article 56(1) GDPR makes the supervisory authority of the main or single establishment of a data controller or processor in the EU the lead supervisory authority for the purposes of cross-border data processing. 

 

4.            Chapter VII of the Regulation promulgates a cooperation and consistency mechanism between supervisory authorities. By Art. 60(1) GDPR, lead supervisory authorities must cooperate with concerned supervisory authorities. Article 60(3) GDPR requires lead supervisory authorities to submit draft decisions to concerned supervisory authorities and to take due account of any views that they may have. Where a concerned supervisory authority makes a relevant and reasoned objection to a draft decision of a lead supervisory authority within four weeks of such consultation, and the latter does not accept that objection, or is of the view that it is not relevant or reasoned, the lead supervisory authority must subject that decision to the consistency mechanism.  By Art. 65 GDPR, the European Data Protection Board ('EDPB') established under Art. 68(1) thereof, may adopt binding decisions to ensure the correct and consistent application of the GDPR in individual cases. Article 60(5) GDPR requires a lead supervisory authority that intends to follow a relevant and reasoned objection to submit a revised draft decision for the opinion of concerned supervisory authorities. Under Art. 60(6) GDPR, where no concerned supervisory authority objects, the draft decision of a lead supervisory authority binds all of them. In that way, lead supervisory authorities can be compelled to exercise their powers in cooperation with concerned supervisory authorities and/or at the EDPB's direction.

 

5.            By Art. 83(1) GDPR, supervisory authorities must ensure that any administrative fines they impose are effective, proportionate and dissuasive. In so doing, they must have due regard to the eleven considerations set out in Art. 83(2) GDPR. These include the nature, gravity and duration of the infringement, taking account of the nature, scope or purpose of the processing concerned, the number of data subjects affected and the level of damage the latter sustained. Article 83(3) GDPR provides that if a controller or processor intentionally or negligently, for the same or linked processing operations, infringes several of its provisions, the total amount of the administrative fine shall not exceed that specified for the gravest infringement. By Art. 83(4)(a) GDPR, infringements of obligations under Art. 25 may be subject to administrative fines of up to €10 million, or in the case of an undertaking, up to 2% of its total worldwide annual turnover in the preceding financial year, whichever is higher.

 

6.            Article 78(1) GDPR affords natural or legal persons a right to an effective judicial remedy against a legally binding decision of a supervisory authority that concerns them. That remedy is to be available before the courts of the Member State where the supervisory authority is established. In accordance with their procedural rules, these courts must have jurisdiction to examine all questions of fact and law relevant to that dispute (see recital 143 and Arts. 78(3) & 83(8) GDPR).

 

B.      The Data Protection Commission's Decision

7.            The Oireachtas enacted the Data Protection Act 2018 to give further effect to the GDPR. Section 11(a) of the Act of 2018 establishes the Data Protection Commission ('DPC') as the supervisory authority in Ireland for the purposes of the GDPR. Section 110(1) of the Act of 2018 grants the DPC power to conduct an enquiry into suspected infringements of the GDPR or of that Act. By s. 111(1)(a) of the Act of 2018, where the DPC conducts an enquiry of its own volition, it shall, if satisfied that a controller or a processor to which that enquiry relates has infringed or is infringing those rules, make a decision to that effect, in which case s. 111(2) of the Act of 2018 requires the DPC to decide whether, and if so, which, corrective power to exercise in respect of that person.

 

8.            On 14 April 2021, the DPC commenced an own volition enquiry into conduct alleged against Meta Platforms Ireland Ltd ('Meta'), the data controller for the Facebook service in the EEA. Facebook Inc., established in the United States of America, processes the personal data of EU users of Facebook services on Meta's behalf. As Meta's main establishment in the European Union is located in Ireland, the DPC is the lead supervisory authority. On 30 September 2022, the DPC circulated a preliminary draft decision to the concerned supervisory authorities - which, given the impact of the breach, consisted of all supervisory authorities in the EEA - seeking their views in accordance with Art. 60(3) GDPR. The supervisory authorities in Belgium, France, the Netherlands and Poland commented upon, but did not object to, the preliminary draft decision. The DPC's final decision of 25 November 2022 ('the Decision') thus binds all of those supervisory authorities.

 

9.            The Decision finds that, between May 2018 and September 2019, third parties 'scraped' personal data from Meta's platforms, including Facebook social media, and made a collated dataset of that data available online. Paragraphs 169 and 182 of the Decision found that Meta had infringed Art. 25(1) and Art. 25(2) GDPR respectively. In accordance with s. 115 of the Act of 2018 and Art. 58(2) GDPR, the DPC exercised the following corrective powers: -

-        an order to Meta pursuant to Art. 58(2)(d) GDPR to bring its processing into compliance therewith in the manner specified in the Decision;

-        a reprimand to Meta pursuant to Art. 58(2)(b) GDPR;

-        an administrative fine of €150 million in respect of Meta's infringement of Art. 25(1) GDPR; and

-        an administrative fine of €115 million in respect of Meta's infringement of Art. 25(2) GDPR.

 

C.      The High Court Proceedings

10.        By originating Notice of Motion issued on 22 December 2022, Meta sought the annulment of the Decision pursuant to s. 142 and/or s.150 of Act of 2018 (High Court Record No. 2022/339 MCA). Meta advances eleven grounds in support of that application. These include a challenge to the Decision's findings that Meta had infringed Art. 25(1) and (2) GDPR; allegations that the DPC breached Art. 83 GDPR, in calculating the fine, and Art. 58(2)(d) GDPR by ordering Meta to bring its processing into compliance; various procedural infringements in the conduct of the inquiry; and discrete errors in the assessment of material facts.

11.        On 27 March 2023, the High Court (Meenan J.) granted Meta leave to commence proceedings by way of judicial review seeking an order of certiorari to quash the Decision on grounds similar to those advanced in the statutory appeal, together with declaratory reliefs as to the validity of ss. 115, 141, 142 and/or 150 of the Act of 2018 having regard to the Constitution of Ireland and/or their compatibility with the State's obligations under the European Convention of Human Rights, notably Art. 6 thereof (High Court Record No. 2023/74 JR).

12.        Meta wrote to the DPC to point out that since there was a degree of overlap, notably as regards the interpretation of Art. 83 GDPR, between the contested issues in the aforementioned proceedings and those in Case T-709/21 WhatsApp Ireland Ltd v. European Data Protection Board ('the WhatsApp proceedings', described at paragraph 15, below), these proceedings ought to be stayed until the latter had been determined. Whilst it opposed that proposal in principle, the DPC was nonetheless prepared to facilitate a trial of the issues in these proceedings that did not touch upon the interpretation of Art. 83 GDPR. Absent agreement as to what questions that trial might resolve, on 10 July 2023, Meta filed motions seeking orders to adjourn and/or stay the within proceedings until the determination of the WhatsApp proceedings.

 

D.      The WhatsApp proceedings

13.        On 24 December 2020, in the context of a different own volition enquiry, the DPC circulated to the concerned supervisory authorities a draft decision which, inter alia, proposed to levy an administrative fine of between €30 million and €50 million on WhatsApp Ireland Ltd ('WhatsApp'). Having received objections to and comments on the draft from eight concerned supervisory authorities, by letter of 2 June 2021 the DPC referred those objections to the EDPB for a determination pursuant to Arts. 60(4) and 65(1)(a) GDPR. Exercising its powers under Art. 65(1)(a) GDPR, on 28 July 2021, the EDPB issued Binding Decision 1/2021 ('the Binding Decision'), which required the DPC to amend the draft decision, inter alia, as regards the calculation of the administrative fine that it had proposed. The EDPB instructed the DPC to take account, in particular, of both the total turnover of all of the component companies of what it considered was a single undertaking, and of other infringements in addition to the gravest.

 

14.        On 20 August 2021, the DPC issued a decision by which it complied with the Binding Decision; found that WhatsApp had infringed Arts. 5, 12, 13 and 14 GDPR, issued a reprimand pursuant to Art. 58(2)(b) GDPR, ordered WhatsApp to bring its processing operations into compliance pursuant to Art. 58(2)(d) GDPR, and imposed four administrative fines totalling €225 million.

 

15.        WhatsApp commenced proceedings under both ss. 142 and 150 of the Act of 2018 and by way of an application for judicial review to challenge the DPC's decision of 20 August 2021. Those proceedings are stayed pending the outcome of a parallel action that WhatsApp commenced to annul the Binding Decision: Case T-709/21, WhatsApp Ireland Ltd v. European Data Protection Board ('the WhatsApp proceedings'). In that action, WhatsApp asserts that the EDPB erred, inter alia, in its interpretation of Art. 83 GDPR and, by so doing, miscalculated the size of the administrative fine the DPC had levied on it. By Order of 7 December 2022 (EU:T:2022:783), the General Court declared Case T-709/21 inadmissible on the grounds that WhatsApp is not directly concerned by the Binding Decision for the purposes of Art. 263 TFEU (Order, paragraphs 50 to 61) and that such inadmissibility is consistent with the system of judicial remedies in the European Union (Order, paragraphs 66 to 72). On 17 February 2023, WhatsApp appealed that Order to the Court of Justice of the European Union ('Court of Justice') (Case C-97/23P). The Grand Chamber of that Court heard the appeal on 26 November 2024 and it is anticipated Advocate General Čapeta will deliver her Opinion on 27 March 2025.

 

E.      The High Court Judgment  

16.        The motions referenced at paragraph 12, above, came on for hearing before the High Court (Simons J.) on 11 April 2024. He reserved judgment, which he delivered on 10 May 2024 ([2024]] IEHC 264). At paragraph 3 the learned High Court judge stated that Meta and the DPC were "in broad agreement" that the hearing and determination of at least part of the proceedings before the High Court must be deferred to await the outcome of the WhatsApp proceedings. He proceeded to observe that they disagreed as to whether it would be appropriate to direct a modular trial in respect of such issues as arose before the High Court that were not directly affected by the outcome of the WhatsApp proceedings, as the DPC contended for, or to adjourn the proceedings before him pending judgment in the WhatsApp proceedings, as Meta submitted.

 

17.        After a description of the procedural history, Simons J. made three observations on the status of the Decision. First, Meta had complied with the corrective measures, inasmuch as the criticised conduct had ceased. Second Meta was not, as a matter of law, required to pay the fines that had been imposed upon it until the determination of these proceedings. Third, the DPC had accepted that those aspects of the proceedings that directly related to the interpretation of Art. 83 GDPR should not be determined until the WhatsApp proceedings had concluded.

 

18.        The High Court (Simons J.) cited O'Leary v. An Bord Pleanála [2008] IESC 55 to the effect that the courts enjoy a general discretion to adjourn proceedings for any reason in the interests of justice should one or more of the parties so require. He considered the impact of an adjournment of the proceedings upon the implementation of the Decision in the light of both the statutory appeal mechanism and the particular circumstances of the case. Simons J. observed that the Decision is subject to a statutory right of appeal, which procedure must afford an effective judicial remedy to facilitate the determination of any issues of fact and law relevant to a dispute. Holding that "the overall decision-making in relation to the GDPR, as reflected under the Data Protection Act 2018, does not achieve finality until such time as any appeal has been heard and determined.", Simons J. concluded that the Decision could not be treated as "presumptively valid". For that reason, the DPC's reliance on the case law on stays on the application of decisions of public bodies in the context of judicial review applications was misplaced. He also distinguished the judgment of the Court of Justice in Joined Cases C-143/88 & C-92/89 Zuckerfabrik Süderdithmarschen AG v. Hauptzollamt Itzehoe and Zuckerfabrik Soest GmbH v Hauptzollamt Paderborn (EU:C:1991:65), on which the DPC had also relied, since that case involved the suspension of a national measure pending the outcome of a challenge to the validity of the EU legislation upon which the former measure depended for its authority. Simons J. also regarded the adjournment of these proceedings to await the outcome of the WhatsApp proceedings as a facet of the effective judicial remedy that Art. 78 GDPR requires. By awaiting the conclusion of the WhatsApp proceedings, the High Court would be in a position to apply the Court of Justice's interpretation of Art. 83 GDPR in these proceedings, and thus avoid any risk of conflicting rulings.

 

19.        Since the DPC conceded that consideration of at least some of the issues in the High Court proceedings had to be deferred, the High Court (Simons J.) treated the applications before him as requests for a modular trial. After examining the judgments of Charleton J. in McCann v. Desmond [2010] IEHC 164; [2010] 4 IR 554 and of Clarke J. in Cork Plastics (Manufacturing) v. Ineos Compound UK Ltd [2008] IEHC 93, Simons J. held that the principal factor in deciding upon the availability of a modular trial is whether a court can be satisfied that the issues it is sought to separate out can properly be heard and decided in isolation from other issues in the proceedings. As justifications for not directing a modular trial he identified, inter alia, that liability and sanction were inextricably linked and that the challenge to the constitutionality of the Act of 2018 could not be determined until the Court of Justice had interpreted Art. 83 GDPR. He accordingly adjourned the proceedings in their entirety to await the outcome of the WhatsApp proceedings. Simons J. added that the adjournment was likely to be brief since there was a reasonable prospect that the WhatsApp proceedings would be disposed of in a relatively short period of time.

 

 

III.    Analysis

20.        Appellate courts wisely refrain from entertaining appeals from case management orders and orders to adjourn one set of proceedings pending the determination of others are no exception. As in P.J. Carroll & Co. Ltd. v. Minister for Health and Children [2005] 1 IR 294 Geoghegan J. observed at p. 314 that: -

"Most orders by way of case management in the Commercial Court are, to some extent, of a discretionary nature and in practice most of them would be unappealable. I would take the view that as a general rule this court should be slow to interfere with case management type orders in the Commercial Court unless there is a clear error of law involved or the managing judge has clearly not exercised his or her discretion correctly."

 

21.        At paragraph 19 of his judgment in Weavering Macro Fixed Income Fund Ltd. v. PNC Global Investment Servicing [2012] IESC 60; [2012] 4 I.R. 681, Clarke J. (as he then was: McKechnie and MacMenamin JJ. conc.) quoted from paragraph 3.5 of his judgment in Dowling v. Minister for Finance [2012] IESC 32 to the effect that appeal courts should intervene only where it is shown that a High Court case management order causes "irremediable prejudice". Clarke J. was, nonetheless, of the view that the Supreme Court could properly take into account the extent to which such an order might have "a potentially fundamental impact on the proceedings.". He observed at paragraph 5.4 that: -

"The range of orders which can be made in a case management process varies significantly. Orders can, at one end of the spectrum, involve the imposition of time limits for taking steps, or purely procedural directions as to how a trial is to be conducted. At the other end of the spectrum there can be decisions which have the potential to have a very significant impact on how litigation is to progress. There will, of course, be many types of orders which fall somewhere between those two extremes. Following on from the principles identified in Dowling [...] it seems to me that it is unlikely that this court would consider it appropriate to interfere save in cases which are at the end of the spectrum where the consequences of the case management order under appeal have the potential to significantly affect the litigation. It is difficult to see how, except in very unusual circumstances, case management orders which did not have consequences of such a nature could be said to be irremediable."

 

22.        In managing cases at first instance, courts are not limited to a choice between the solutions that parties propose for adoption. As McKechnie J. (MacMenamin, Laffoy, Dunne, Charleton JJ. conc.) observed at paragraph 42 of his judgment in Ryanair Ltd v. Bravofly Ltd [2016] IESC 53: -

 

"It has often been said that the underlying purpose of the commercial rules is to implement three imperatives in respect of actions admitted to that list. Firstly, that the parties should engage in a fair trial of the issues so identified; secondly, that such issues should be dealt with and disposed of with reasonable expedition; and, thirdly, that costs should be reduced so far as possible in such litigation (O. 63A, r. 5 & 14(7) R.S.C.). I agree with this particular classification and would only add a general observation, even if trite, namely that justice is the ultimate objective of case management. This may suggest an inter partes evaluation only, but that is not the case: the administrative system is an integral part of the justice objective and its functional operability is a real factor for consideration on an application such as that moved before the trial court."

 

23.        There appears to be no obvious reason why that citation from a Supreme Court judgment ought not to apply equally to a court hearing an appeal from a case management order made at first instance.

 

24.        The exercise of public power impacts upon both the general interest of the community and the individual interests of the persons who compose it. The administration of justice by the courts established under the Constitution must therefore always take the public interest into account. Interest reipublicae ut sit finis litium requires that persons who invoke the publicly accessible system for dispute resolution prosecute their claims with economy and celerity. As Murray C.J. (Denham, Hardiman, Geoghegan, Fennelly JJ. conc.) observed in O'Leary & Ors. v. An Bord Pleanála:

"... [I]t is in the general interest of the administration of justice both at national and community level, that proceedings are heard and determined with reasonable expedition. These proceedings concern not only the rights of the appellants but also the rights of the respondents and notice parties."

 

25.        That obligation bites particularly hard in the context of challenges to the validity of measures that bodies vested with responsibility to exercise public power make, where legal certainty has a critical function. As Clarke J. (Denham C.J, Hardiman, Fennelly and O'Donnell JJ. conc.) held at paragraph 92 of his judgment in Okunade v. Minister for Justice, Equality & Law Reform [2012] I.R. 152:

"The entitlement of those who are given statutory or other power and authority so as to conduct specified types of legally binding decision-making or action taking is an important part of the structure of a legal order based on the rule of law. Recognising the entitlement of such persons or bodies to carry out their remit without undue interference is an important feature of any balancing exercise. It seems to me to follow that significant weight needs to be placed into the balance on the side of permitting measures which are prima facie valid to be carried out in a regular and orderly way. Regulators are entitled to regulate. Lower courts are entitled to decide. Ministers are entitled to exercise powers lawfully conferred by the Oireachtas. The list can go on. All due weight needs to be accorded to allowing the systems and processes by which lawful power is to be exercised to operate in an orderly fashion"

 

26.        These considerations are reflected both in the statutes and in the rules of court that govern challenges to the validity of such measures. In the context of proceedings that engage the application and the enforcement of the GDPR throughout the EEA, the interest of an even wider public is to be given appropriate weight. The judgment under appeal falls to be analysed in the light of these principles.

 

27.        A party that brings motions to adjourn proceedings it has commenced must furnish good reasons in support thereof. As Murray C.J. also stated in O'Leary & Ors. v. An Bord Pleanála, in cases where a national court is asked to adjourn proceedings on the ground that a decision it may give could occasion a substantial or material risk of a conflict with a decision of the Court of Justice, which is the case here, the onus lies on the moving party to demonstrate the presence of that risk.

 

28.        In its responses to pre-litigation correspondence, the DPC was equivocal, if not confused. It seems to have led the parties to represent jointly to the learned High Court Judge that at least some of the issues raised "cannot be determined ... until such time as the WhatsApp proceedings have been resolved one way or the other" (paragraph 20 of the judgment). That representation was, and is, incorrect, and undoubtedly led the High Court to reach the decision it did. By virtue of Art. 267 TFEU, the High Court has direct access to the Court of Justice where, in order to determine proceedings pending before it, it asks questions going to the interpretation and/or the validity of European Union measures. The invocation of that mechanism is independent of the existence, or the outcome, of proceedings before other courts. Whilst it is understandable, in the light of the line of case-law beginning with Case C-188/92 TWD Textilwerke Deggendorf (EU:C:1994:90), that WhatsApp may have felt compelled to commence an action to annul the EDPB's Binding Decision, that aspect is entirely absent in these proceedings. The DPC made the Decision after consultation with its counterparts across the EEA. The GDPR requires that any challenge to the Decision's validity be brought before the courts of Ireland. The exclusive mechanism to resolve any doubts as to the interpretation of the GDPR in the context of these proceedings is thus by way of a reference for a preliminary ruling under Art. 267 TFEU.

 

29.        As a consequence of the orders under appeal, these proceedings have been adjourned for ten months. It is in those circumstances that this Court is called upon to decide how best to progress these proceedings with the requisite economy and celerity. Accepting that the parties are correct in their submissions that certain issues between them will require some form of ruling from the Court of Justice, there appears to be no good reason why these proceedings ought not now to proceed to a stage at which the High Court can usefully request such a ruling. The Annual Report of the Court of Justice discloses that, in 2023, the average time to answer a reference for preliminary ruling was 16.8 months. Given the novelty and the importance of the questions that are likely to be referred, that period of time is probably the minimum the High Court could envisage within which to receive a response from the Court of Justice.

 

30.        By reference to the duration of appeals heard before the Grand Chamber of the Court of Justice that raise issues going to the admissibility of direct actions (see, for example, Case C-284/21 P Commission v. Braesch (EU:C:2023:58)), it is reasonable to anticipate that judgment may be delivered in the WhatsApp proceedings on or about the end of this calendar year. Awaiting delivery of that judgment will add at least ten more months to date of the conclusion of these proceedings. Nor is that the last of the anticipated delays, since upon delivery of judgment in the WhatsApp proceedings one of two scenarios will present itself.

 

31.        The first scenario is that the Court of Justice upholds the General Court's order and brings the WhatsApp proceedings to an end. In that event, the contentious issues of EU law that the parties to these proceedings have agreed the High Court cannot decide will remain unresolved. Those issues may then be determined by way of a reference for a preliminary ruling in the context of the proceedings that WhatsApp has brought which stand adjourned before the courts of Ireland. On the premise that the time required to answer such questions would be the same as that required in these proceedings - which is not guaranteed - these proceedings would have to await the High Court's disposal of the WhatsApp litigation. It is not unreasonable to estimate the length of time that process would take as being in the region of an additional twenty-four months.

 

32.        The second scenario is that the Court of Justice allows the appeal, which outcome cannot be excluded given that it is pending before its Grand Chamber, which has, moreover, convened a hearing and sought an Advocate General's Opinion. If the appeal is allowed, the substantive issues of law that arise in the WhatsApp proceedings will be sent back to the General Court for it to rule upon, with the possibility of a further appeal to the Court of Justice against the General Court's decision. The Annual Report of the Court of Justice for 2023 represents that the average time for the General Court to deliver judgment in a case in the category into which the WhatsApp proceedings fall (Other Direct Actions) was 22.9 months, to which a period of at least fourteen months could be added should there be a further appeal against the General Court's judgment. In this second scenario the conclusion of these proceedings could easily be delayed for a further forty months.

 

33.        Were the High Court to refer questions for a preliminary ruling in these proceedings that raised issues of interpretation similar to those the General Court might rule upon in the second scenario, it would be open to Meta and/or the DPC to apply to the Court of Justice and/or the General Court under Art. 54, third paragraph of the Statute of the Court of Justice and the rules of procedure adopted thereunder (Rules of Procedure of the Court of Justice, Art. 55; Rules of Procedure of the General Court, Art. 69), to have the WhatsApp proceedings stayed pending the decision of the Court of Justice in such a reference. Both Courts regularly accede to applications of that nature to expedite the resolution of contested issues of EU law in an expeditious and orderly fashion. The risk of conflicting rulings, upon which Meta and, it appears, the trial judge, relies, thus disappears.

 

34.        The High Court also appears to have taken into consideration a number of matters which impacted upon the reasons for the judgment under appeal and must consequently be considered in this judgment.

 

35.        Meta never applied to the High Court to stay the operation of the Decision. It appears that was because there was nothing to stay, it being common case that Meta had brought its data processing operations into compliance with the Decision to the DPC's satisfaction and that the combined operation of the GDPR and ss. 141 to 143 of the Act of 2018 was to suspend the payment of the administrative fines until the determination of these proceedings. Those circumstances do not, however, justify the conclusion that the learned High Court Judge appears to have reached at paragraph 28 of his judgment, whereby decision-making under the Regulation, as reflected in the Act of 2018, "does not achieve finality until such time as any appeal has been heard and determined." Neither the GDPR, nor the Act of 2018, provide that an appeal against a decision of a supervisory authority has suspensory effect, save as regards the payment of administrative fines, an element of those decisions that bears principally upon the addressee as distinct from having consequences for regulators, competitors or the public in general. The Decision constitutes the DPC's determination on the existence of the contested infringements and the exercise of its corrective powers. Whilst it may ultimately be impugned successfully, a decision of a supervisory authority for the purposes of the GDPR is not a "first instance decision", as paragraph 28 of the High Court judgment appears to represent. The Decision is to be presumed valid in the same manner as the various decisions that Clarke J. gave as examples of the exercise of lawful power at paragraph 92 of his judgment in Okunade v. Minister for Justice and Equality, cited at paragraph 25, above. It follows that the effective remedy to which Art. 78 GDPR refers does not require the adjournment of these proceedings. That the GDPR does not automatically suspend the operation of a decision of a supervisory authority in the event of legal challenge demonstrates, if anything, that the expeditious progress and determination of proceedings seeking to challenge the validity of such decisions is a key component of that effective remedy.

 

36.        The absence of any application for a stay upon the operation of the Decision also absolves this Court from having to adjudicate upon the various issues the parties canvassed as to the application of the judgment of the Court of Justice in Joined Cases C-143/88 & C-92/89 Zuckerfabrik Süderdithmarschen AG v. Hauptzollamt Itzehoe and Zuckerfabrik Soest GmbH v Hauptzollamt Paderborn. It is difficult to reconcile the DPC's view that the Decision is presumed valid unless and until a court annuls it, with its submission that the adjournment of the proceedings has consequences for the validity, as distinct from the enforcement, of the Decision, which latter issue is not present here. Zuckerfabrik arose in the context of applications to stay the operation of a law that enjoyed the presumption of regularity, thus engaging issues that touch upon the separation of powers and the harmonious relationship that ought to exist between the respective arms of government. Such an exercise is far removed from a Court ruling upon applications to adjourn proceedings lawfully before it, a quintessentially judicial exercise to be carried out with due consideration of the requirements of justice and the orderly exercise of public power.

 

IV.    Conclusion

37.        In the light of this analysis, the decision to adjourn these proceedings can be said to have a significant impact upon their progress, such that the threshold for intervention by an appellate court described in Weavering Macro Fixed Income Fund Ltd. v. PNC Global Investment Servicing has been reached.  Meta has not shown a substantial or material risk of conflict in the event that this Court were to allow these appeals, thus facilitating the resumption of these proceedings. The delays consequent upon a further adjournment to await the outcome of the WhatsApp proceedings are clearly inimical to the economical and expeditious determination of these challenges to the validity of the Decision, thereby depriving the parties of the effective remedy that Art. 78 GDPR requires.

 

38.        Having reached that conclusion, there is no need for this Court to rule on the High Court's assessment of the DPC's submissions as constituting an application for a modular trial and the decision it reached in that regard.

 

39.        I therefore propose that this Court allows the DPC's appeals from the judgment and orders of the High Court, sets aside the orders that Court made on 30 May 2024 and dismisses the applications for the relief sought in the respective Notices of Motion.

 

40.        The default position under s. 169 of the Legal Service Regulation Act 2015 and R.S.C. O. 99, r. 2 is that the Court should determine the costs of interlocutory applications at the time that it rules upon them, and that the successful party is normally entitled to those costs. The DPC having succeeded in these appeals, I take the provisional view that it is entitled to the costs of the motions both in this Court and in the High Court. Should Meta disagree with that proposed order, it should file and serve a written submission of not more than 2,000 words within 14 days of the delivery of this judgment, after which the DPC will have a further 14 days in which to respond by the lodgment and service of a reply of similar length.

 

41.        Since this judgment is delivered electronically, I am authorised by Meenan and McDonald JJ. to state that they agree with it and the orders proposed therein.

Result    DPC successful in the appeal

 

 

 

Appearances:

For the Appellant/Respondent, Meta Platforms Ireland Ltd.: Andrew Fitzpatrick SC, Caren Geoghegan SC, Andrea Mulligan and Colm Ó Néill, instructed by A&L Goodbody LLP

For the Respondent/Appellant: Catherine Donnelly SC and Mark Murphy, instructed by Philip Lee LLP