Data Protection Commission (DPC) – Court Ruling (Ireland, 2026)

On 25 May 2018, Michael Veale, the data subject, submitted an access and data portability request to Meta Platforms Ireland Limited (MPIL) (then Facebook Ireland Limited), the controller. He requested access to all personal data concerning him stored in the controller's internal "Hive" data warehouse under Article 15 GDPR, including the data in raw form and information on its processing. He also requested relevant personal data in a structured, commonly used and machine-readable format under Article 20 GDPR. On 19 July 2018, the controller refused to provide the raw Hive data. Among other grounds, it relied on Article 12(5) GDPR, Article 15(4) GDPR and Article 20(4) GDPR. The data subject subsequently lodged a complaint with the Data the DPA arguing that the controller had failed to comply with his rights under Articles 15 and 20 GDPR and had unjustifiably relied on restrictions to those rights. On 27 July 2018, the DPA opened a complaint-based inquiry under [https://www.legislation.gov.uk/ukpga/2018/12/contents Section 110(1) Data Protection Act 2018]. The inquiry examined the controller's compliance with its obligations concerning the data subject's request. During the investigation, the controller explained that its approach to Hive data was generally applicable to its users and argued, inter alia, that extracting user-specific log-level data from Hive was computationally unfeasible. In August 2023, the DPA issued its Final Inquiry Report. The investigator considered that the controller had failed to provide the data subject with information required under Article 15(1)(a), (d) and (g) GDPR. On 10 October 2025, the DPA issued a preliminary draft decision (PDD). It provisionally found that the controller had infringed Article 15(1) and (3) GDPR by refusing access to and a copy of relevant personal data; Article 15(1)(a), (d) and (g) GDPR by providing inadequate information; Article 20(1) GDPR by refusing to provide relevant portable data; and Article 12(3) and (4) GDPR by failing to comply with the applicable time limits. The DPA also proposed a reprimand, a compliance order concerning the controller's general access and portability practices and administrative fines totalling between €360 million and €430 million. In determining the proposed corrective measures, the DPA took into account that the practices identified through the individual complaint potentially affected millions of users. The controller challenged the PDD before the High Court. It argued that the DPA had unlawfully transformed an inquiry concerning a single complaint into a systemic, EEA-wide own-volition inquiry. According to the controller, the DPA acted ultra vires by proposing systemic corrective measures and fines based on broader effects on other users. It also alleged breaches of fair procedures and legitimate expectations. The High Court dismissed the controller's action. The Court held that neither the GDPR nor the Data Protection Act 2018 establishes the limitation alleged by the controller. Although a complaint under Article 77 GDPR must concern an alleged infringement of the complainant's personal data rights, this does not prevent the complaint from raising systemic issues where the complainant is personally affected. The Court distinguished the origin and scope of an inquiry from the corrective powers available to the DPA. A complaint-based inquiry is defined by the subject matter of the complaint, whereas an own-volition inquiry is defined by the DPA itself. However, this procedural distinction does not limit the corrective powers available once an infringement within the scope of the complaint has been identified. Consequently, the fact that an inquiry originated from an individual complaint did not require the DPA to disregard broader or systemic implications of the infringement. Addressing such implications did not convert the proceedings into an own-volition inquiry. Systemic corrective measures and administrative fines The Court noted that Articles 57 and 58 GDPR confer broad enforcement powers on supervisory authorities and do not distinguish between complaint-based and own-volition inquiries regarding the corrective measures available. Where an infringement is established, Article 58(2) GDPR requires the DPA to consider appropriate corrective measures. These may include orders bringing processing operations into compliance and administrative fines under Article 83 GDPR. Such measures are not necessarily confined to restoring the individual complainant's position and may address systemic deficiencies identified through the inquiry. In particular, the Court considered that Article 83 GDPR itself requires factors such as the nature, gravity and duration of the infringement and the number of affected data subjects to be considered when determining an administrative fine. Therefore, the broader impact of an infringement may legitimately influence a fine even when the underlying inquiry originated from one individual complaint. The Court consequently held that a complaint-based inquiry may result in system-wide corrective measures and administrative fines informed by systemic considerations, provided that these measures arise from infringements established within the subject matter of the complaint. The Court did not, however, determine whether the controller had actually infringed Articles 12, 15 or 20 GDPR or whether the proposed €360–€430 million fine was appropriate. Those findings and measures remained provisional within the DPA's ongoing decision-making procedure. Fair procedures The Court also rejected the controller's argument that the DPA had breached its right to fair procedures by expanding the inquiry after the investigative stage. The controller had been informed from the beginning that findings of infringement could result in the exercise of the DPA's corrective powers under Article 58 GDPR, including administrative fines. Moreover, throughout the inquiry, the controller had itself addressed the operation of Hive and its general approach to access requests across its user base. The systemic implications were therefore inherent in the issues under examination rather than introduced as a new subject matter at the decision-making stage. The Court further noted that the regulatory procedure had not yet concluded. The controller retained the opportunity to make submissions on the PDD before the Article 60 GDPR cooperation procedure and could subsequently challenge any legally binding final decision. Consequently, no procedural unfairness warranting judicial review had been established. Legitimate expectations The Court equally rejected the controller's claim that it had a legitimate expectation that any corrective measures would be confined to the individual data subject. Neither the DPA's guidance, its previous practices nor its correspondence with the controller contained a sufficiently precise and unconditional assurance that systemic corrective measures could only be adopted through an own-volition inquiry. On the contrary, the controller had repeatedly been informed that the DPA retained its corrective powers under Articles 58 and 83 GDPR. The Court therefore held that no legitimate expectation arose that the consequences of a complaint-based inquiry would be restricted to an individual remedy for the complainant. Accordingly, the Court found no unlawful expansion of the inquiry, breach of fair procedures or violation of legitimate expectations and dismissed the judicial-review proceedings.