High Court - IEHC 235

Summary

The Irish High Court addressed LinkedIn's appeal against a €310 million GDPR fine imposed by the Irish Data Protection Commission (DPC). The court clarified that appeals against fines fall under Section 142 of the Data Protection Act 2018, while other findings must be challenged under Section 150.

Full text

Help High Court - IEHC 235: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Revision as of 10:52, 22 May 2026 view sourceBms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators49 edits Tag: submission [1.0] Latest revision as of 11:40, 22 May 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators49 editsTag: Visual edit Line 66: Line 66: }}}} LinkedIn sought to appeal the DPC’s entire decision under section 142 DPA 2018, but the High Court held that this route covered only the fine, with the remaining findings falling under section 150.LinkedIn sought to appeal the DPA entire decision under section 142 DPA 2018, but the High Court held that this route covered only the fine, with the remaining findings falling under section 150. == English Summary ==== English Summary == === Facts ====== Facts === The case arose from LinkedIn’s appeal against a decision of the Irish Data Protection Commission (“DPC”) dated 22 October 2024. In that decision, the DPC found that LinkedIn had infringed GDPR Articles 5(1)(a), 6(1), 13(1)(c) and 14(1)(c). The DPC imposed a reprimand, an order requiring LinkedIn to bring processing into compliance, and three administrative fines totalling €310 million.The case arose from LinkedIn’s appeal against a decision of the Irish Data Protection Commission, the DPA, dated 22 October 2024. In that decision, the DPA found that LinkedIn had infringed GDPR [[Article 5 GDPR|Articles 5(1)(a)]], [[Article 6 GDPR|6(1)]], [[Article 13 GDPR|13(1)(c)]] and [[Article 14 GDPR|14(1)(c)]]. The DPA imposed a reprimand, an order requiring LinkedIn to bring processing into compliance, and three administrative fines totalling €310 million. The underlying DPC inquiry followed a complaint lodged by La Quadrature du Net with the French supervisory authority, CNIL, on behalf of 8,540 LinkedIn users in France. The complaint concerned LinkedIn’s processing of personal data for behavioural analysis and targeted advertising. CNIL referred the matter to the DPC because LinkedIn Ireland was subject to the Irish supervisory authority in the context of cross-border processing.The underlying DPA inquiry followed a complaint lodged by La Quadrature du Net with the French supervisory authority, CNIL, on behalf of 8,540 LinkedIn users in France. The complaint concerned LinkedIn’s processing of personal data for behavioural analysis and targeted advertising. CNIL referred the matter to the DPA because LinkedIn Ireland was subject to the Irish supervisory authority in the context of cross-border processing. The DPC investigation lasted more than six years. The DPC first notified LinkedIn of the inquiry on 20 August 2018. After several requests for information, submissions, a preliminary draft decision, a draft decision under [[Article 60 GDPR|Article 60 GDPR]] and comments from concerned supervisory authorities, the DPC adopted its final decision on 22 October 2024.The DPA investigation lasted more than six years. The DPA first notified LinkedIn of the inquiry on 20 August 2018. After several requests for information, submissions, a preliminary draft decision, a draft decision under [[Article 60 GDPR]] and comments from concerned supervisory authorities, the DPA adopted its final decision on 22 October 2024. LinkedIn then brought a statutory appeal under sections 142 and 150 of the Data Protection Act 2018. It also issued judicial review proceedings challenging aspects of the statutory scheme under the Constitution, the Charter and the ECHR. The High Court judgment did not decide the merits of the DPC’s GDPR findings. Instead, it dealt with four preliminary issues about the structure and standard of appeal.LinkedIn then brought a statutory appeal under [https://www.irishstatutebook.ie/eli/2018/act/7/enacted/en/print sections 142 and 150 of the Data Protection Act 2018]. It also issued judicial review proceedings challenging aspects of the statutory scheme under the Constitution, the Charter and the ECHR. The High Court judgment did not decide the merits of the DPA’s GDPR findings. Instead, it dealt with four preliminary issues about the structure and standard of appeal. The key dispute was whether LinkedIn could challenge the entire DPC decision under section 142, because that decision included a fine, or whether section 142 was limited to the fine only. LinkedIn argued for a broader, unitary appeal. The DPC and the State argued that section 142 applied only to the administrative fine, while infringement findings and non-fine corrective measures had to be challenged under section 150.The key dispute was whether LinkedIn could challenge the entire DPA decision under section 142, because that decision included a fine, or whether section 142 was limited to the fine only. LinkedIn argued for a broader, unitary appeal. The DPA and the State argued that section 142 applied only to the administrative fine, while infringement findings and non-fine corrective measures had to be challenged under section 150. === Holding ====== Holding === The High Court held that section 142 of the Data Protection Act 2018 only provides for an appeal against the DPC’s decision to impose an administrative fine. It does not allow LinkedIn to appeal the DPC’s infringement findings or the exercise of other corrective powers, such as a reprimand or compliance order, under that section. Those parts of the DPC decision must instead be appealed under section 150.The High Court held that [https://www.irishstatutebook.ie/eli/2018/act/7/enacted/en/print section 142 of the Data Protection Act 2018] only provides for an appeal against the DPA’s decision to impose an administrative fine. It does not allow LinkedIn to appeal the DPA’s infringement findings or the exercise of other corrective powers, such as a reprimand or compliance order, under that section. Those parts of the DPA decision must instead be appealed under [https://www.irishstatutebook.ie/eli/2018/act/7/enacted/en/print section 150]. The Court reasoned that the statutory scheme distinguishes between a decision on infringement and a further decision on corrective powers. In particular, sections 111, 112 and 113 require the DPC first to decide whether there was an infringement and then, “in addition”, decide whether to exercise corrective powers. Section 115 separately identifies the power to impose an administrative fine and makes that decision subject to Chapter 6 of the 2018 Act.The court reasoned that the statutory scheme distinguishes between a decision on infringement and a further decision on corrective powers. In particular, sections [https://www.irishstatutebook.ie/eli/2018/act/7/enacted/en/print 111], [https://www.irishstatutebook.ie/eli/2018/act/7/enacted/en/print 112] and [https://www.irishstatutebook.ie/eli/2018/act/7/enacted/en/print 113] require the DPA first to decide whether there was an infringement and then, “in addition”, decide whether to exercise corrective powers. [https://www.irishstatutebook.ie/eli/2018/act/7/enacted/en/print Section 115] separately identifies the power to impose an administrative fine and makes that decision subject to Chapter 6 of the 2018 Act. The Court also held that appeals under section 142 are appeals “on the record”, but with the possibility that new evidence or new arguments may be admitted. The same standard applies to appeals under section 150. However, the Court accepted that deference may be appropriate where the issue falls within the DPC’s technical expertise.The court also held that appeals under [https://www.irishstatutebook.ie/eli/2018/act/7/enacted/en/print section 142] are appeals “on the record”, but with the possibility that new evidence or new arguments may be admitted. The same standard applies to appeals under section 150. However, the Court accepted that deference may be appropriate where the issue falls within the DPA’s technical expertise. Final

Entities