High Court grants stay of GDPR enforcement orders pending appeal due to disproportionate financial harm to TikTok.

APPROVED [2025] IEHC 619

THE HIGH COURT

COMMERCIAL

Record No.: 2025/248 MCA

IN THE MATTER OF SECTION 142 AND SECTION 150

OF THE DATA PROTECTION ACT 2018

Between:

TIKTOK TECHNOLOGY LIMITED and TIKTOK INFORMATION TECHNOLOGIES UK LIMITED

Applicants

And

DATA PROTECTION COMMISSION

Respondent

JUDGMENT of Mr Justice Rory Mulcahy delivered on 13 November 2025

Introduction

1. On 14 September 2021, the respondent (“the DPC”) commenced an inquiry (“the Inquiry”) into the first applicant (“TikTok”) in accordance with section 110 of the Data Protection Act 2018 (“the Act”) regarding the transfer by TikTok of its users’ personal data to China. The DPC is the State’s supervisory authority for the purpose of the General Data Protection Regulation, Regulation 2016/679 (“the GDPR”).

2. Following a detailed investigation, and having consulted with other supervisory authorities in accordance with Article 60 of the GDPR, the DPC issued its decision on 30 April 2025 (“the Decision”). The Decision defined the temporal scope of the Inquiry as relating to data transfers taking place from 29 July 2020 until 17 May 2023. In the Decision,

NO REDACTION REQUIRED the DPC found that TikTok had infringed Article 46(1) the GDPR by failing to ensure that personal data of its users within the European Economic Area (“EEA Users”) which was transferred outside the EEA, in this case by being made available by remote access to personnel based in China (“the data transfers”), was afforded a level of protection essentially equivalent to that provided within the European Union (“EU”) during the Inquiry’s temporal scope. The Decision also found a breach of Article 13(1)(f) of the GDPR, that TikTok had failed to provide required information on the data transfers to data subjects from 29 July 2020 to 1 December 2022.

3. As part of the Decision, the respondent imposed administrative fines totalling €530 million. The second applicant (“TikTok UK”) has been joined to these proceedings on the basis that it is the entity which will ultimately be responsible for paying any such administrative fines. The DPC disputes its standing as a party in these proceedings, but that issue does not require to be resolved at this time.

4. In addition to the administrative fines, the DPC made an order pursuant to Article 58(2)(j) of the GDPR requiring TikTok to suspend the data transfers (“the Suspension Order”) and an order pursuant to Article 58(2)(d) requiring TikTok to bring its processing into compliance with the GDPR (“the Corrective Order”). These orders were to take effect six months after the date of the Decision.

5. By originating notice of motion issued on 27 May 2025, TikTok appealed the Decision pursuant to sections 142 and 150 of the Act. TikTok pleads errors of law and fact on the part of the DPC. It contends that the data transfers, by virtue of its standard contractual clauses (SCCs) and, inter alia, additional measures put in place by TikTok pursuant to what it calls “Project Clover”, are afforded an equivalent level of protection to that provided within the EU. In addition, TikTok contends that the Decision was reached in breach of fair procedures. TikTok also claims that the DPC has erred in its interpretation of relevant Chinese laws.

6. By operation of section 142 of the Act, the appeal operates as a stay on the requirement to pay the administrative fines. However, there is no automatic stay on the Suspension Order or Corrective Order (for convenience, any further reference to the Suspension Order can be read as referring to both orders). This judgment concerns TikTok’s application to stay those orders. In short, TikTok claims that the steps it will be necessary to take in order to comply with the Suspension Order will require it to incur billions of euros expenditure, will be disruptive of its business and of its workforce, and will diminish its stakeholders’ experience. It contends that most of this loss cannot be made good if it ultimately succeeds in its appeal. In order to provide it with an effective remedy, TikTok argues, the Suspension Order must be stayed pending the determination of its appeal.

7. The DPC opposes the stay. It contends that the fundamental rights of TikTok’s 159 million monthly EEA users are at risk if the data transfers continue.

8. The proceedings were entered in the Commercial List of the High Court on 5 June 2025. TikTok applied for a stay on the Decision at that time, on the basis of the affidavits grounding the entry application. The stay application was opposed by the DPC. The court granted a temporary stay up to the hearing of this application, which was listed for 7 October 2025. The stay application was heard over four days from 7 to 10 October 2025. When the hearing commenced, the DPC did not oppose a continuation of the stay pending the determination of this application.

9. As will be seen, much of the debate between the parties concerned the test which should be applied to an application for a stay on a decision of the DPC. The DPC argues that, having regard to particular features of the decision challenged, a decision made in accordance with the GDPR, in consultation with other EU supervisory authorities, and with their consent or agreement, the appropriate threshold is that applied by the CJEU in an application for interim measures, referred to below as the Zuckerfabrik test. TikTok contends that the

Decision should be treated in the same way as any other national law measure made in purported compliance with EU law, and that the relevant threshold is the well-established test applied to such national law measures, the Okunade test.

10. Section 149(5) of the Data Protection Act 2018 (“the 2018 Act”) provides that the DPC, when publishing its decision following an investigation “shall ensure” that the decision is published in a manner which doesn’t disclose a person’s commercially sensitive information. Section 156 of the 2018 Act confers an express power on the court to hear some or all of proceedings under the Act otherwise than in public. At the outset of the hearing, TikTok applied for an order that its commercially sensitive information referred to in the affidavits and exhibits grounding the stay application be treated as not having been referred to in open court, and not published or disclosed to any third party, in order to protect its confidential nature.

11. It is clear from the decision in Gilchrist and Rogers v Sunday Newspapers [2017] IESC 18, [2017] 2 IR 284, that even where an express power to hear proceedings otherwise than in public exists, the court is obliged to consider whether the interests of justice requires a restriction on the public’s access to the hearing, and, if so, whether there are any less restrictive measures than a hearing in camera which would ensures that justice is done.

12. In circumstances where the statute expressly confers protection on commercially sensitive information by section 149(5) of the 2018 Act when the DPC publishes a decision, it would wholly undermine that protection, or the effectiveness of any remedy provided by the GDPR and the 2018 Act, if a person was required to forego that protection in order to challenge that decision in accordance with the 2018 Act. In those circumstances, I was satisfied that the order sought – which fell well short of an in camera hearing – was the least restrictive means of preserving the interests protected by the statute. Accordingly, I agreed to make an order pursuant to section 156 of the 2018 Act.

13. Of course, the only information which should be protected by an order made pursuant to section 156 is the information which the DPC was under a duty to protect when publishing a decision pursuant to section 149(5), unless TikTok wish to advance some additional ground justifying its protection. For the purposes of the stay hearing, there was no real debate about the extent of the information which TikTok claimed should fall within the scope of the section 156 order, though the DPC reserved its entitlement to contest whether particular information fell to be protected in the future. For the purpose of the stay hearing only, therefore, all the information which was highlighted by TikTok as being commercially sensitive was treated as falling within the scope of the order made pursuant to section 156 of the Act.

The General Data Protection Regulation

14. The GDPR is the centrepiece of the reform of the EU regulatory framework for protection of personal data (see, generally, Kuner, Bygrave and Docksey, The EU General Data Protection Regulation (Oxford University Press, 2020)). It is a Regulation of some complexity and its interpretation will, no doubt, play a significant role in the resolution of TikTok’s appeal. However, for the purposes of resolving this stay application, two related issues are relevant. First, what is the nature of the decision by a supervising authority such as the one the subject of this appeal. And second, does the GDPR provide any indication of the threshold which should be applied by a court when considering an application for a stay, or interim measures, in respect of such a decision.

15. Briefly, TikTok’s position is that that the GDPR makes clear that a decision of a supervising authority is a decision of that supervising authority alone, and is therefore a national law measure, subject to challenge on the basis of a member state’s procedural law in accordance with the principle of procedural autonomy. It argues that national procedural autonomy is the default in the absence of express harmonisation, and that the GDPR makes clear that the default position applies where a challenge is, as here, to a decision of a supervising authority. It argues, therefore, that this application should be decided by reference to national procedural law.

16. The DPC accepts that procedural autonomy is the default position and that the threshold for the grant of a stay on a measure giving effect to EU law would ordinarily be subject to national procedural rules. However, it contends that the decision of a supervising authority is, because of the mandatory co-operation procedures in Article 60 of the GDPR, in effect a joint decision of all supervising authorities which is binding across the EU (in fact, the entire EEA on account of its incorporation into the EEA Agreement). This effect of a supervising authority’s decision means, argues the DPC, that the procedural autonomy afforded to the member states in relation to legal proceedings challenging a decision of a supervisory authority must be subject to a requirement that the same standard is applied as applies to the assessment of applications for interim measures when an EU measure is challenged. It contends that this is consistent with an interpretation of the GDPR as a whole and the case law of the CJEU.

17. Recital 1 of the GDPR recognises that the protection of natural persons in relation to the processing of personal data is a fundamental right and references Article 8(1) of the Charter of Fundamental Rights of the European Union (the Charter) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU), each of which provides that everyone has the right to the protection of personal data concerning him or her.

18. Recital 4 provides that:

The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity.

19. Recital 11 relates to harmonisation:

Effective protection of personal data throughout the Union requires the strengthening and setting out in detail of the rights of data subjects and the obligations of those who process and determine the processing of personal data, as well as equivalent powers for monitoring and ensuring compliance with the rules for the protection of personal data and equivalent sanctions for infringements in the Member States.

20. Recital 101 concerns the transfer of data outside EU:

Flows of personal data to and from countries outside the Union and international organisations are necessary for the expansion of international trade and international cooperation. The increase in such flows has raised new challenges and concerns with regard to the protection of personal data. However, when personal data are transferred from the Union to controllers, processors or other recipients in third countries or to international organisations, the level of protection of natural persons ensured in the Union by this Regulation should not be undermined, including in cases of onward transfers of personal data from the third country or international organisation to controllers, processors in the same or another third country or international organisation. In any event, transfers to third countries and international organisations may only be carried out in full compliance with this Regulation. 5A transfer could take place only if, subject to the other provisions of this Regulation, the conditions laid down in the provisions of this Regulation relating to the transfer of personal data to third countries or international organisations are complied with by the controller or processor.

21. Recitals 124 to 126 discuss the role of supervising authorities and the competence of lead supervising authorities. Recital 126 refers to decision-making by supervisory authorities:

The decision should be agreed jointly by the lead supervisory authority and the supervisory authorities concerned and should be directed towards the main or single establishment of the controller or processor and be binding on the controller and processor. The controller or processor should take the necessary measures to ensure compliance with this Regulation and the implementation of the decision notified by the lead supervisory authority to the main establishment of the controller or processor as regards the processing activities in the Union.

22. Recital 143 refers to the entitlement to a judicial remedy. It distinguishes between the remedy available where a challenge is to a decision of a supervising authority, and where the challenge is to a decision of the European Data Protection Board (EDPB).

Any natural or legal person has the right to bring an action for annulment of decisions of the Board before the Court of Justice under the conditions provided for in Article

263 TFEU. As addressees of such decisions, the supervisory authorities concerned which wish to challenge them have to bring action within two months of being notified of them, in accordance with Article 263 TFEU. Where decisions of the Board are of direct and individual concern to a controller, processor or complainant, the latter may bring an action for annulment against those decisions within two months of their publication on the website of the Board, in accordance with Article 263 TFEU. Without prejudice to this right under Article 263 TFEU, each natural or legal person should have an effective judicial remedy before the competent national court against a decision of a supervisory authority which produces legal effects concerning that person. Such a

decision concerns in particular the exercise of investigative, corrective and authorisation powers by the supervisory authority or the dismissal or rejection of complaints. However, the right to an effective judicial remedy does not encompass measures taken by supervisory authorities which are not legally binding, such as opinions issued by or advice provided by the supervisory authority. Proceedings against a supervisory authority should be brought before the courts of the Member State where the supervisory authority is established and should be conducted in accordance with that Member State’s procedural law. Those courts should exercise full jurisdiction, which should include jurisdiction to examine all questions of fact and law relevant to the dispute before them.

Where a complaint has been rejected or dismissed by a supervisory authority, the complainant may bring proceedings before the courts in the same Member State. In the context of judicial remedies relating to the application of this Regulation, national courts which consider a decision on the question necessary to enable them to give judgment, may, or in the case provided for in Article 267 TFEU, must, request the Court of Justice to give a preliminary ruling on the interpretation of Union law, including this Regulation. Furthermore, where a decision of a supervisory authority implementing a

decision of the Board is challenged before a national court and the validity of the

decision of the Board is at issue, that national court does not have the power to declare the Board’s decision invalid but must refer the question of validity to the Court of Justice in accordance with Article 267 TFEU as interpreted by the Court of Justice, where it considers the decision invalid. However, a national court may not refer a question on the validity of the decision of the Board at the request of a natural or legal person which had the opportunity to bring an action for annulment of that decision, in particular if it was directly and individually concerned by that decision, but had not done so within the period laid down in Article 263 TFEU.

23. Article 4(21) and 4(22) of the Regulation define “supervising authority” and “supervising authority concerned”.

(21) ‘supervisory authority’ means an independent public authority which is established by a Member State pursuant to Article 51;

(22) ‘supervisory authority concerned’ means a supervisory authority which is concerned by the processing of personal data because:

a. the controller or processor is established on the territory of the Member State of that supervisory authority;

b. data subjects residing in the Member State of that supervisory authority are substantially affected or likely to be substantially affected by the processing;

or

c. a complaint has been lodged with that supervisory authority…

24. Chapter V relates to the cross border transfer of data, that is transfers outside the EU/EEA. The overriding requirement is that the rights guaranteed by the GDPR are not compromised by any such transfer of personal data, that data is afforded an equivalent level of protection in a third country as it would be within the EU. Article 44 provides:

Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined

25. Articles 45 and 46 provide alternative mechanisms for ensuring equivalent protection. Article 45 provides for the making of adequacy decisions by the European Commission. Where the Commission has determined that adequate protection is provided in a third country, it can issue a decision to that effect. Any transfers to that country consistent with the adequacy decision do not require further authorisation. Adequacy decisions were the subject of the leading cases, Case C-362/14, Schrems v Data Protection Commissioner (“Schrems I”) and Case C-311/18, Data Protection Commissioner v Facebook Ireland Ltd and Schrems (“Schrems II”).

26. Where, as here, there is no adequacy decision, transfers are still permitted without specific authorisation where the data processor satisfies the requirements of Article 46:

1. In the absence of a decision pursuant to Article 45(3), a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.

2. The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by:

a) a legally binding and enforceable instrument between public authorities or bodies;

b) binding corporate rules in accordance with Article 47;

c) standard data protection clauses adopted by the Commission in accordance with the examination procedure referred to in Article 93(2);

d) standard data protection clauses adopted by a supervisory authority and approved by the Commission pursuant to the examination procedure referred to in Article 93(2);

e) an approved code of conduct pursuant to Article 40 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects’ rights; or

f) an approved certification mechanism pursuant to Article 42 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects’ rights.

27. The decision in these proceedings was that TikTok had failed to satisfy the DPC that the transfer by it of personal data to China was in accordance with Article 46(1).

28. Article 49 provides for derogations from the requirements of Articles 45 and 46. These are available, inter alia, where:

(a) the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards…

29. Chapter VI of the GDPR deals, inter alia, with the decision-making functions of supervisory authorities. Pursuant to Article 51, each member state is required to designate at least one supervisory authority responsible for monitoring the application of the GDPR. Article 56 sets out the competencies of a supervisory authority. During the course of the hearing, I was informed that there are a total of 47 supervisory authorities within the EEA, as some states, notably Germany, have more than one supervisory authority.

30. Article 56(1) provides:

Without prejudice to Article 55, the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60.

31. Article 58(1) of the GDPR sets out the investigative powers a supervisory authority shall have, Article 58(2) its corrective powers.

32. Article 60 sets out the co-operation procedure between supervising authorities when, inter alia, investigating a complaint. Sub-articles 1 to 3 concern obligations in relation to the sharing of information. These include, at sub-article 3, an obligation on a lead supervising authority (“LSA”) to provide draft decisions to other supervisory authorities concerned (“SACs”) for their opinion and to “take account of their views”. Other SACs may provide reasoned objections to the draft decision. If agreement cannot be reached on those objections, a consistency mechanism is provided, whereby any disagreement can be referred to the EDPB for resolution. A decision of the EDPB pursuant to Article 65 of the GDPR is binding upon the supervisory authorities. The EDPB is established by Article 68(1) of the GDPR as a union body with legal personality. It is comprised of the heads of at least one supervisory authority from each member state.

33. Two further articles merit attention. Article 66(1) provides for an accelerated procedure in cases of urgency:

In exceptional circumstances, where a supervisory authority concerned considers that there is an urgent need to act in order to protect the rights and freedoms of data subjects, it may, by way of derogation from the consistency mechanism referred to in Articles 63, 64 and 65 or the procedure referred to in Article 60, immediately adopt provisional measures intended to produce legal effects on its own territory with a specified period of validity which shall not exceed three months. The supervisory authority shall, without delay, communicate those measures and the reasons for adopting them to the other supervisory authorities concerned, to the Board and to the Commission.

34. Finally, Article 78 of the GDPR requires that member states provide effective remedies regarding decisions of supervisory authorities:

1. Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.

2. Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to an effective judicial remedy where the supervisory authority which is competent pursuant to Articles 55 and 56 does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77.

3. Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.

4. Where proceedings are brought against a decision of a supervisory authority which was preceded by an opinion or a decision of the Board in the consistency mechanism, the supervisory authority shall forward that opinion or decision to the court.

35. The decision-making process and consistency mechanism have been analysed by the CJEU in a number of cases. The DPC referred, in particular, to the Opinion of the Advocate General, in Case C-645/19, Facebook Ireland Inc and Ors v Gegevensbeschermingsautoriteit (“Facebook”), in which the question referred was whether a supervisory authority in one member state could bring proceedings before the court of that state with regard to cross-border processing, where it was not the LSA for that processing.

36. In concluding that it was permissible to do so only in the particular circumstances provided in the GDPR (in Article 58(5)), the Advocate General considered the legislative history of the GDPR and described the approach ultimately adopted in the GDPR as a “onestop shop” mechanism, language repeated in the court’s judgment. He considered the respective roles of LSAs and other supervisory authorities:

85. Second, the Council intended to mitigate the role and competence of the LSA, by making the procedure more inclusive. The text of the Commission’s Proposal was considered to be somewhat ambiguous on the point, and possibly giving rise to an exclusive competence of the LSA over cross-border data processing. A number of corrections were made to the text in order to enhance the ‘proximity’ between data subjects and the supervisory authorities. Inter alia, the involvement of other supervisory authorities in the decision-making process was significantly increased.

86. For its part, the European Parliament also supported the creation of the onestop-shop mechanism, with an enhanced role for the LSA, but proposed to strengthen the system of cooperation among the supervisory authorities. Both the Explanatory

Statement to the Draft Report of the Parliament and the European Parliament legislative resolution of 12 March 2014 are rather clear in that regard.

87. In essence, with the Council’s and the Parliament’s intervention, the one-stopshop mechanism, previously heavily leaning towards the LSA, was turned into a more balanced two-pillar mechanism: the leading role of the LSA with regard to cross-border processing is preserved, but it is now accompanied by an enhanced role for the other supervisory authorities which actively participate in the process through the cooperation and consistency mechanisms, with the Board given the role of referee and guide in the event of disagreement.

37. At [111] the Advocate General described the LSA as a “primus inter partes…. Only able to act with the consent of the SACs”.

38. The CJEU in agreeing with the Advocate General’s conclusions used similar language regarding co-operation and consensus.

39. Both parties also referenced Case C-97/23P, WhatsApp Ireland Ltd v EDPB. In those proceedings, WhatsApp challenged a decision of the EDPB made pursuant to the consistency mechanism. The application was dismissed by the General Court as inadmissible. An appeal to the CJEU is pending, but the Advocate General’s opinion, delivered on 27 March 2025, is that the proceedings are admissible, and that a decision of the EDPB under the consistency mechanism is a “challengeable act” for the purpose of Article 263 TFEU. The Advocate General provides a helpful summary of the consistency mechanism:

“10. The task of monitoring and enforcing the rules of the GDPR is entrusted to the various supervising authorities of the Member States within their respective territories.

11. To tackle the possible fragmentation in the implementation of data protection rules across the European Union that may result from such a ‘decentralised’ system, the GDPR provides for cooperation between national supervisory authorities.

12. When a data processing operation has a cross-border dimension, the authority in charge of the processor or controller at issue – the lead supervisory authority (LSA)

– must circulate its draft decision enforcing the rules of the GDPR against the processor or controller under its competence to the concerned supervisory authorities of other Member States.

13. If those other authorities agree with the interpretation of the GDPR and with the enforcement measures proposed by the LSA, the latter may adopt its final decision, which is binding on the controller or processor at issue.

14. However, if those other supervisory authorities express relevant and reasoned objections with which the LSA disagrees or considers them not to be relevant or reasoned, the LSA must submit the matter to the EDPB for the latter to take a decision.

15. The EDPB adjudicates the dispute between the national supervisory authorities involved and resolves that individual case by means of a binding decision.

16. According to Article 65(2) of the GDPR, that decision is addressed to and binds the LSA and all the other supervisory authorities concerned. The decision is also published on the EDPB’s website.

17. Within prescribed deadlines and on the basis of that binding EDPB decision, the LSA must adopt its final decision, which is then notified to the controller or processor at issue.”

Data Protection Act 2018

40. Part 6 of the 2018 Act concerns enforcement of the GDPR. Sections 108 and 109 of the Act give the DPC power to investigate complaints made to it. Section 110 entitles the Commission to carry out an Inquiry of its own volition:

110. (1) The Commission, whether for the purpose of section 109(5)(e), section 113(2), or of its own volition, may, in order to ascertain whether an infringement has occurred or is occurring, cause such inquiry as it thinks fit to be conducted for that purpose.

41. Where an Inquiry pursuant to section 110 has taken place, section 111 provides that the DPC shall do one of the following:

(1) Where an inquiry has been conducted of the Commission’s own volition, the Commission, having considered the information obtained in the inquiry, shall—

(a) if satisfied that an infringement by the controller or processor to which the inquiry relates has occurred or is occurring, make a decision to that effect, and

(b) if not so satisfied, make a decision to that effect.

42. If the DPC makes a decision that there has been a breach, then section 111(2) requires that it also consider whether to exercise any corrective power and, if so, what corrective power to exercise.

43. Section 154 of the Act provides the DPC with immunity from suit:

Civil or criminal proceedings shall not lie in any court against the Commission, a Commissioner, an authorised officer or a member of the staff of the Commission in respect of anything said or done in good faith by the Commission, Commissioner, authorised officer or member of staff in the course of the performance or purported performance of a function of the Commission, Commissioner, authorised officer or member of staff.

The Inquiry

44. As appears from the Decision, during the course of its supervision interactions with TikTok, the DPC was informed by TikTok that certain personnel located in China accessed personal data of TikTok’s EEA users in order to provide support services in connection with the operation of its platform, including functions related to software engineering, maintenance and development. On 26 March 2021, TikTok provided the DPC with its data transfer assessment (“DTA”) for China, an assessment of the level of protection afforded to data transferred to China, together with supporting documentation.

45. In the Decision, the DPC describes the TikTok platform as follows:

“36. The TikTok platform is a social media service allowing users to create and share short-form videos of up to 10 minutes in length. It is available as an app for Android and iOS, and via the website www.tiktok.com. TikTok accounts can be created by users aged 13 years and over using a phone number and email address. A TikTok profile typically contains a profile photo or video and username. The app shows a personalised ‘For You’ feed of videos for each user, recommended based on factors such as the user’s selected interest categories, device and account settings, and interaction with the app.

Users can create, watch, ‘like’ and comment on videos, ‘follow’ other users’ profiles, and send direct messages to other users.

…

38. TikTok Ireland has stated that the TikTok service is not offered or available in China, where the ByteDance group of companies separately operates “a similar but entirely distinct” video-sharing platform called Douyin…”

46. ByteDance Limited is TikTok’s ultimate parent. Though it is registered in the Cayman Islands, many of the ByteDance group of companies and its employees are based in China.

47. On 7 April 2021, the DPC received a submission from Stichting Onderzoek Marktinformatie, a Dutch non-governmental organisation, raising concerns about the

processing of personal data by TikTok, due to risks for young users and the non-EEA transfer of personal data.

48. On 28 May 2021 and 5 July 2021, the DPC received requests for mutual assistance from the French supervisory authority, Commission Nationale de l’Informatique et des Libertés, requesting that the DPC investigate matters pertaining to TikTok’s transfer of personal data to China.

49. On 14 September 2021, the DPC notified TikTok of the commencement of two inquiries pursuant to section 110 of the Data Protection Act 2018 (so-called “own volition” inquiries), including the inquiry which led to the decision the subject of these proceedings (“the Inquiry”).

50. TikTok responded to the commencement notice on 12 October 2021. The response included an updated DTA. A further updated DTA was provided on 28 January 2022.

51. On 11 May 2022, the DPC requested further information from TikTok. Having sought an extension of time to provide a response, TikTok responded on 20 June 2022.

52. On 7 July 2022, the DPC provided TikTok with a detailed Statement of Issues and invited submissions on same. The issues for determination were summarised as follows:

“(1) The DPC will consider and determine, within the scope of the Inquiry, the relevant facts as to TikTok Ireland’s reliance on the 2010 SCCs in connection with the transfers the subject of the Inquiry involving remote access to personal data of EEA users by the China Group Entities.

(2) The DPC will consider and determine, within the scope of the Inquiry, the relevant facts as to the scope of TikTok Ireland’s reliance, if any, on the derogations set out in Article 49 GDPR, and in particular Article 49(1)(b) GDPR, and, if necessary, review and determine the lawfulness of same in the context of the transfers the subject of the Inquiry.

(3) The DPC will consider and determine within the scope of the Inquiry whether TikTok Ireland can demonstrate that it has complied with its responsibility to assess the level of protection of personal data of EEA users the subject of transfers to the China Group Entities using SCCs under Article 46(2)(c) GDPR for the purpose of Articles 44 and 46(1) GDPR, having regard in particular to TikTok Ireland’s responsibility as a controller in light of Article 5(2) and 24 GDPR. This will include consideration as to whether TikTok Ireland has adequately assessed whether, and the extent to which, there is a risk that the personal data of EEA users remotely accessed by the China Group Entities may be subject to potentially problematic laws and practices in effect in China, and whether, and extent to which, there is a risk that the 2010 SCCs are not being complied with, or cannot be complied with, by the China Group Entities in the context of the transfers the subject of the Inquiry.

(4) The DPC will consider and determine, within the scope of in the Inquiry, whether TikTok Ireland can demonstrate that the supplementary measures implemented by TikTok Ireland and the China Group Entities in respect of the remote access by the China Group Entities to personal data of EEA users are effective, together with the 2010 SCCs, to ensure that EEA users are provided with the appropriate safeguards, enforceable rights and effective legal remedies required by Articles 44, 46(1) and 46(2)(c) GDPR, so that the personal data of EEA users is afforded a level of protection essentially equivalent to that guaranteed within EU by the GDPR.

(5) The DPC will consider and determine whether TikTok Ireland has complied with its obligations under Article 13(1)(f) GDPR with reference to the information it provides to EEA users of the TikTok platform concerning the transfers the subject of the Inquiry.”

53. When furnishing the Statement of Issues, the DPC indicated that in respect of the second issue, it intended having regard to information on government access to personal data in China set out in the “Final Report EDPS/2019/02-13, Legal study on Government access to data in third countries for the EDPB (November 2021)” (“the Milieu Report”). TikTok raised certain queries on the Statement of Issues and responded in substance on 15 September 2022. TikTok notified the DPC of its intention to submit expert evidence in relation to the Milieu Report. It also informed DPC that it was in the process of updating its DTA for China and expected to complete this by 13 October 2022, that it was in the process of updating its EEA privacy policy, and that it would shortly be amending its Intra-Group Agreement for the purpose of transitioning from the 2010 SCCs to the new ones (“the 2021 SCCs”), and that this would be done by 27 December 2022. TikTok also queried the temporal scope of the Inquiry and were advised it was “ongoing”.

54. On 13 October 2022, TikTok provided the DPC with an expert report on Chinese law, addressing the Milieu Report, from Professor Ke Xu, Professor of Law of the Law School, University of International Business and Economics, Beijing. It also provided an update to the DTA (“the October 2022 DTA”). It provided its privacy policy on 22 October 2022, and information on the 2021 SCCs in December 2022.

55. The DPC sent a request for further information on 21 February 2023, raising queries regarding the 2021 SCCs.

56. When responding to this request on 28 March 2023, TikTok provided information on further measures it was putting in place, referred to as Project Clover, to ensure the protection of EEA user data. It advised that implementation had commenced.

57. The DPC raised queries about the turnover of TikTok’s parent company, ByteDance in April 2023. On 17 May 2023, it issued a Preliminary Draft Decision (“the PDD”). The PDD defined the temporal scope of the Inquiry as commencing on 29 July 2020 and ongoing. The provisional findings are summarised in TikTok’s affidavit grounding the appeal as follows:

a) In respect of Issue 1, the DPC set out a summary of the facts it considered to be relevant and necessary to the determination of the issues set out in the PDD in §165.

b) In respect of Issue 2, the DPC provisionally found that, by failing to clarify precisely how the territoriality principle applies in the context of the laws and practices outlined in Section 2.2 of the DTA and the Data Transfers (the regulation of public authority access to personal data in China), TikTok Ireland had failed to comply with its responsibility to adequately assess the level of protection of EEA Users under the Chinese legal framework for the purposes of Articles 44 and 46 GDPR and, further, had failed to demonstrate compliance with Articles 44 and 46 with regard to the processing the subject of the transfers (PDD, §299).

c) In respect of Issue 3, the DPC provisionally found that TikTok Ireland had failed to verify, guarantee and demonstrate that the supplementary measures and the SCCs are effective to ensure that EEA User Data is afforded a level of protection essentially equivalent to that guaranteed in the EU (PDD, §§365 - 371).

Specifically, the DPC expressed the provisional view that TikTok had failed to certify, guarantee and demonstrate that the supplemental measures or the SCCs address the risks associated with the Data Transfers falling subject to the National Intelligence Law, the Counter-Espionage Law, Article 18 of the Anti-Terrorism Law, and the PRC Cybersecurity Law (the Relevant Chinese Laws, described by the DPC as the "Problematic Laws" in the PDD).

d) In respect of issue 4, the DPC expressed the provisional view that TikTok Ireland could not rely on derogations under Article 49 GDPR in respect of the Data Transfers, which are systemic, repetitive and continuous (PDD, §397).

e) In light of its provisional findings in respect of Issues 1 - 4, the DPC made a provisional finding that TikTok Ireland had infringed Article 46(1) GDPR regarding the Data Transfers by failing to verify, guarantee and demonstrate that the supplementary measures and the SCCs are effective to ensure that EEA User

Data is afforded a level of protection essentially equivalent to that guaranteed in the EU (PDD, §398).

f) respect of issue 5, the DPC made a provisional finding TikTok Ireland had infringed Article 13(1)(f) GDPR from 29 July 2020 to December 2022 by failing to provide data subjects with information on its transfers of personal data to China and information as to how the Data Transfers concerned remote access to personal data stored in Singapore and the United States by CGE Personnel based in China (PDD, §432).

g) The DPC provisionally decided (i) to make an order pursuant to Article 58(2)(j)

requiring TikTok Ireland to suspend the Data Transfers, (ii) to make an order pursuant to Article 58(2)(d) GDPR requiring TikTok Ireland to bring the processing into compliance in the manner specified in the PDD, and (iii) to impose two administrative fines pursuant to Article 58(2)(i) GDPR in the ranges of €450 - €500 million and €30 - €50 million respectively.

58. TikTok made submissions on the PDD on 9 September 2023. It provided a second opinion from Professor Xu, reports from two law firms, Fangda and Clifford Chance, a technical report on Project Clover (“the Project Clover Technical Report”) and a report from NCC Group. It subsequently provided a report from Dr Prateek Mittal concerning TikTok’s privacy solution. It provided an updated DTA on 6 October 2023 (“the October 2023 DTA”).

59. On 8 February 2024, the DPC wrote to TikTok seeking clarification on matters arising from TikTok’s response to the PDD, including whether remote access by personnel in China involved storage of EEA user data in China, including temporary storage.

60. Between March and June 2024, TikTok responded to this request and sought confirmation that the DPC would have regard to the materially new information provided by it since the PDD. It requested that the DPC withdraw the PDD and issue a revised PDD in light of the new measures which TikTok had put in place. Although the DPC confirmed that it would have regard to all information provided, it declined to withdraw the PDD, considering it to be unnecessary.

61. On 31 July 2024, TikTok provided the DPC with a further revision to its DTA (“the July 2024 DTA”). This is the most up-to-date DTA so far provided by TikTok.

62. On 6 December 2024, TikTok advised the DPC that it had updated its Intra-Group Agreement to reflect changes in the processing of data in China. On 14 February 2025, it indicated that it intended to provide updates on the further implementation of Project Clover by 10 March 2025.

63. On 21 February 2025, the DPC informed TikTok that it had finalised a draft decision (“the Draft Decision”) and circulated it to the concerned supervisory authorities pursuant to Article 60 of the GDPR. As stated in the Draft Decision at [95]:

“Given that the matters under examination in the inquiry entail cross-border processing across Europe, all other supervisory authorities were engaged as SACs for the purpose of the co-decision-making process outlined in Article 60 of the GDPR.”

64. The DPC provided TikTok with a copy of the Draft Decision. The temporal scope of the Inquiry pursuant to the Draft Decision was stated to be from 29 July 2020 to 17 May 2023.

65. The Draft Decision contained findings on each of the five issues identified in the Statement of Issues. In relation to Issue 2 in the Statement of Issues, it found:

“392. … the DPC finds that TikTok Ireland failed to adequately assess the level of protection of personal data of EEA users the subject of transfers to the China Group Entities using SCCs. While TikTok Ireland acknowledged relevant divergences between the level of protection afforded by the law and practices of China compared with

European Union law, its assessment of the territoriality principle resulted in it concluding that the Data Transfers fell outside the territorial scope of the problematic laws. However, the DPC finds that TikTok Ireland’s assessment of the territoriality principle failed to clarify whether, and the extent to which, such laws may apply in the context of the Data Transfers, and failed to set out in a clear way the deficiencies it acknowledged to exist in the Chinese legal framework. By failing to adequately assess the law and practices in China in the context of the Data Transfers, TikTok Ireland failed to comply with its responsibility to assess the level of protection of personal data of EEA users the subject of transfers to the China Group Entities using SCCs.

393. The DPC also finds that TikTok Ireland’s failure to adequately assess the level of protection provided by Chinese law and practices resulted in it failing to verify, guarantee and demonstrate that that the personal data of EEA Users subject to the Data Transfers was afforded a level of protection essentially equivalent to that guaranteed within the European Union…

399. … [T[his has prevented TikTok Ireland from verifying and guaranteeing that data subjects have enforceable rights and effective legal remedies. Having failed to verify and guarantee that the Data Transfers were afforded a level of protection essentially equivalent to that guaranteed within the European Union, it is clear that TikTok Ireland was also not in a position to demonstrate an essential equivalent level of protection.”

66. In relation to Issue 3, the Draft Decision concluded:

“475. The supplementary measures were not sufficient to prevent the risk of potential application of problematic access by Chinese authorities supported by problematic laws, and, thus, were not sufficient to ensure that the personal data of EEA users was afforded a level of protection essentially equivalent to that guaranteed within the EU.

TikTok Ireland’s assessment of law and practices in China and the supplementary measures implemented based on that assessment have failed to appropriately account for the risk of access supported by problematic laws to EEA User Data that is processed in China. For the reasons set out above, the DPC finds that the supplementary measures implemented by TikTok Ireland were inadequate to compensate in respect of this risk.

Therefore, the DPC finds that TikTok Ireland failed to verify that EEA User Data subject to the Data Transfers would be afforded a level of protection essentially equivalent to that guaranteed within the European Union in circumstances where TikTok Ireland failed to verify that problematic laws could not be applied to EEA User Data processed in China. The DPC also finds that TikTok Ireland failed to implement appropriate safeguards and supplemental measures to guarantee that EEA User Data subject to the Data Transfers would be afforded a level of protection essentially equivalent to that guaranteed within the European Union.

476. Accordingly, the DPC finds that TikTok Ireland failed to verify, guarantee and demonstrate that the supplementary measures implemented by TikTok Ireland and the China Group Entities in respect of the Data Transfers were effective, together with the 2010 SCCs and the 2021 SCCs, to ensure that EEA users were provided with the appropriate safeguards, enforceable rights and effective legal remedies required by Articles 44, 46(1) and 46(2)(c) GDPR, so that the personal data of EEA users was afforded a level of protection essentially equivalent to that guaranteed within EU by the GDPR.”

67. The DPC made the following finding of infringement:

“544. In light of the foregoing, as set out in Issues 1 – 4, the DPC finds that TikTok Ireland infringed Article 46(1) GDPR regarding the Data Transfers. As set out above, TikTok Ireland failed to adequately assess the level of protection provided by Chinese law and practices to the personal data of EEA Users the subject of transfers to the China Group Entities using SCCs. It failed to verify, guarantee and demonstrate that the supplementary measures and the SCCs were effective to ensure that the personal data of EEA Users is afforded a level of protection essentially equivalent to that guaranteed within the EU. TikTok Ireland did not, and could not, rely on the derogations under Article 49 GDPR in respect of the Data Transfers made during the temporal scope. Consequently, TikTok Ireland transferred EEA User Data to China without complying with the conditions laid down by Chapter V of the GDPR and did not identify a valid lawful basis for the Data Transfers.

545. Accordingly, during the temporal scope of the Inquiry, from 29 July 2020 to 17 May 2023, TikTok Ireland infringed Article 46(1) GDPR by carrying out the Data Transfers while failing to verify, guarantee and demonstrate that that the personal data of EEA Users subject to the Data Transfers was afforded a level of protection essentially equivalent to that guaranteed within the European Union.”

68. Having regard to the fact that the temporal scope of the Inquiry ended on the date the PDD was provided to TikTok, the DPC separately considered the changes made by TikTok since that date when considering whether to make any suspension or correction order. The Draft Decision records that:

“665. The DPC has carefully considered all of the additional supplementary measures implemented by TikTok Ireland after the temporal scope of the Inquiry. The additional supplementary measures do not address the risk of Chinese authorities accessing the personal data that is accessed by employees of the China Group Entities in plain text.

The DPC finds that TikTok Ireland has not demonstrated that EEA User Data subject to the Data Transfers cannot be subject to problematic access by Chinese public authorities. TikTok Ireland’s ongoing failure to adequately assess the level of protection provided by Chinese law and practices to the personal data of EEA users the subject of transfers interferes with its ability on an ongoing basis to select appropriate safeguards and supplementary measures, and prevents it from demonstrating an essentially equivalent level of protection. Therefore, the DPC’s concerns regarding the Data Transfers, as set out at Issues 2 and 3 of this Draft Decision, remain in respect of the ongoing Data Transfers. For that reason, the DPC finds that TikTok Ireland has failed on a continuing basis to demonstrate that the supplementary measures that it has implemented and the SCCs are effective to ensure that the personal data of EEA users is afforded a level of protection essentially equivalent to that guaranteed within the EU.

…

667. In light of the foregoing, the DPC orders TikTok Ireland pursuant to Article 58(2)(j) GDPR to suspend the Data Transfers in accordance with the timeline outlined below.”

69. On 14 March 2025, TikTok requested that the DPC withdraw the Draft Decision, alleging fundamental errors of fact and breaches of fair procedures. On 18 March 2025, it provided a third report from Professor Xu to address a purported gap in TikTok’s assessment of Chinese law identified in the Draft Decision. By letter dated 25 March 2025, the DPC refused the request to withdraw the Draft Decision.

70. Although the DPC received comments on the Draft Decision from three SACs (those of France, Holland and Berlin), it received no reasoned objections. Accordingly, the DPC adopted the Decision with “non-material” amendments from the Draft Decision on 30 April 2025.

Disclosure of issue concerning TikTok’s ‘OnCall’ platform

71. On 21 March 2025, TikTok disclosed to the DPC that, contrary to statements made during the course of the Inquiry that no EEA user personal data was stored in China, it had discovered that some personal data had, in fact, been stored in China. TikTok has an internal helpdesk called ‘OnCall’, which is hosted in China. The platform included a free text field in which the technical issue giving rise to the help request can be described. It emerged that in a limited number of cases, TikTok’s support agents had included personal data in that field rather than simply summarising the technical issue. A small number of those instances related to EEA user data. Upon discovering the issue, TikTok moved the data out of China and further access from China was restricted.

Grounds of appeal

72. TikTok has appealed the Decision on a variety of grounds. For the purpose of this application, the DPC has accepted that TikTok has identified “serious doubts as to the validity of the measure”, the threshold in Zuckerfabrik, or “a fair or bona fide or serious issue to be tried”, the Okunade criteria.

73. TikTok advances various grounds in respect of the fines imposed, including that the DPC incorrectly calculated the fines by reference to the turnover of its parent company, ByteDance Limited.

74. Regarding the findings of a failure to comply with Article 46 of the GDPR, TikTok claims various breaches of fair procedure by the DPC including that it relied on matters raised for the first time in the Draft Decision circulated pursuant to Article 60 of the GDPR and therefore deprived TikTok of an opportunity to address those issues. It claims that the DPC made manifest errors in its assessment of the relevant Chinese laws.

75. As regards the Suspension Order the subject of this application, TikTok argues that the DPC failed to carry out the assessments required by Article 46, as interpreted in Schrems II, and contends that accordingly, the DPC could not properly have made such an order in circumstances where the temporal scope of its inquiry ended on 17 May 2023.

The stay application

76. TikTok applied to enter the proceedings in the Commercial list of the High Court on 5 June 2025. As part of that application, TikTok sought a stay on the operation of the

Suspension Order. The DPC did not oppose the application for entry, but did oppose the stay. The court (Sanfey J) granted an interim stay pending the hearing of a full stay application.

77. TikTok filed a comprehensive suite of affidavits in support of its application for a stay. It initially filed twelve affidavits grounding the application. The DPC filed five affidavits in reply. TikTok filed a further ten affidavits in response. The DPC filed a single further affidavit in reply, and TikTok then filed two more replying affidavits. Fortunately for the court, the contents of TikTok’s first two rounds of affidavits are summarised in affidavits sworn by Elaine Fox, Head of Privacy, Europe and Head of Ireland at TikTok. For the purpose of this judgment, a brief summary of the evidence adduced will suffice at this juncture. Particular details will be discussed as necessary when assessing the application for a stay.

78. TikTok does not dispute that certain data which meets the definition of personal data under the GDPR can be accessed by personnel of certain China Group Entities (CGEs), being a list of identified companies. It calls this allowable data. It explains that the allowable data is stored in data centres outside China, but can be remotely accessed by certain CGE personnel in China. It describes the data which can be remotely accessed as (i) inter-operable data, data needed for the TikTok platform to operate globally; (ii) public data, a type of interoperable data which is publicly available and accessible by anyone on the TikTok platform, and (iii) aggregated data, allowable data which is compiled and expressed in a summary way. It describes the data as the “less confidential data” collected by TikTok about EEA users and Ms Fox avers that all of this data is, in any event, pseudonymised in a manner which prevents the re-identification of EEA users.

79. TikTok’s position is that it will have to put in place the following additional measures to give effect to the Suspension Order. It will have to apply technical measures to anonymise any aggregated data, and it will have to remove access to the remaining EEA user data to CGE personnel. It calls these two steps the Suspension Solution.

80. Eoghan Kerins, TikTok’s Global Head of Digital Rights avers that he is responsible for all data disclosures to authorities for the TikTok website outside of the US. He explains how this process is managed within TikTok. He also avers that there has never been a request for EEA user data by any authority in China from TikTok and he is not aware of any of the CGE or any ByteDance entity in China having received such a request. This is reflected in transparency reports published by TikTok bi-annually.

81. Thomas Wlazik, Head of Europe and Israel and Global Business Solutions and Managing Director of TikTok Germany GmbH provided an affidavit in which he explained the TikTok platform and identified its stakeholders. These include users, advertisers, sellers, businesses, and public organisations and non-profits.

82. Yuquiao Huang, Project Management Office Team Member at TikTok Inc, has sworn an affidavit in which she avers to the effect implementing the Suspension Solution will have. It identifies a number of critical business processes which will be severely impacted if access to the data is removed from CGE personnel. In support of Ms Huang’s analysis, Professor Peter Pietzuch, Professor of Distributed System, Department of Computing at Imperial College London, prepared an expert report, which he exhibits on affidavit. He considers that the analytical framework applied by Ms Huang is appropriate and agrees with her assessment regarding the significant impact on TikTok’s critical business processes.

83. Ms Huang also explains that if the Suspension Solution is implemented, a very significant number of CGE personnel, numbering in the thousands, will have to be transferred and relocated outside China so that TikTok can, in time, return to the same level of operations in its critical business processes. On TikTok’s analysis, full capacity will not be restored until 2029. Ms Huang avers that these measures will be very difficult to reverse, and explains why.

84. He also explains that Suspension Solution will delay the launch of a TikTok service, TikTok Shop, in new countries in the EEA for a short period.

85. Vilma Todri, Associate Professor of Information Systems and Operations Management at Emory University’s Golzueta Business School, Atlanta also prepared a report, verified on affidavit, about the adverse impact the Suspension Solution will have on key stakeholders: users, creators, advertisers and sellers. This will, Professor Todri says, ultimately drive stakeholders to competitor platforms.

86. She also expresses the opinion that the degradation in the stakeholder experience will likely inflict harm on TikTok’s brand perception.

87. Paul Jacobs of Grant Thornton prepared a report on the financial impact of the suspension solution. His report is based on financial analysis provided by Weishu Xu, Investor Relations Team Member at ByteDance Inc who has also sworn an affidavit. Mr Jacob opines that a reasonable estimate of lost profit contribution for TikTok in the EEA is US$1.716 billion in the suspension period, being three years from the date the Suspension Order comes into effect, to include the period before it takes effect.

88. In addition, he estimates that other TikTok group entities, outside the EEA, will incur additional personnel costs of US$3.105 billion. He describes these lost revenues and costs as extremely significant. He also describes the estimates as conservative insofar as they do not take account of other likely losses such as impacts on company/market valuation, and impacts on goodwill/brand.

89. Jianye Ye, Head of Privacy and Security Engineering Department, TikTok Inc swore an affidavit explaining the data controls and protections operated by TikTok, including a detailed description of the measures put in place under Project Clover. He refers to the fact that NCC Group has been appointed as a third-party cybersecurity and privacy engineering provider to review, validate and monitor the protections and assure their continued efficacy. TikTok’s position is that the measures which it has put in place provide equivalent protection to that available within the EEA and that the DPC misunderstood, made errors, or inadequately assessed the measures TikTok has put in place when making the Suspension Order. This, of course, is disputed by the DPC.

90. An affidavit, exhibiting his report, was also filed by Stephen Bailey, Global Director of Privacy at NCC Group, which has been appointed to provide oversight of TikTok’s data controls and protections, which explains the Project Clover controls and NCC’s oversight role. In particular, he describes how the process of pseudonymisation works to prevent attribution of data to an EEA user.

91. In addition, Professor Stefan Schiffner, Professor of IT Security and Computer Networks at Berufliche Hochschule Hamburg, prepared a report, also verified in an affidavit, in which he concludes that the method for testing of the effectiveness of the pseudonymisation by NCC was appropriate and in line with industry good practice.

92. The DPC’s principal replying affidavit was sworn by Cian O’Brien, Deputy Commissioner in the DPC. His affidavit commenced with some preliminary observations, including that the DPC disputed the second applicant’s standing in these proceedings, a point which does not need to be addressed for the purpose of this application. He also observed that TikTok had not set out the jurisdictional basis for this application, an objection not pursued at the hearing during which the DPC expressly accepted that the court has jurisdiction to grant a stay, a proposition which could hardly be doubted in light of the relevant case law.

93. The affidavit then helpfully sets out the DPC’s position in opposing the stay: that the application should be determined by the test in Zuckerfabrik, that the very large number of TikTok users whose data was potentially affected was relevant in considering the stay, and that the fundamental rights of those users in relation to their personal data required a high level of protection.

94. It noted the duty on a data controller when transferring personal data to a third country. It noted various acknowledgements by TikTok, including that personal data was being transferred to and being processed in China, its acceptance that Chinese law did not offer an equivalent level of protection to that in the EU, and that an equivalent level of protection could not be achieved by use of standard contractual clauses (SCCs) alone, since they are not binding on the Chinese authorities.

95. The affidavit explained that a critical aspect of TikTok’s case related to its interpretation of Chinese law and, in particular, the territoriality principle which TikTok claimed meant that Chinese authorities could not compel access to data stored outside China, but temporarily accessible within China. Mr O’Brien referred to affidavits of Professor Dongsheng Zang, Professor of Law at the University of Washington School of Law, Seattle, and of Dr Paul Hunton, an independent consultant specialising in digital and cyber security, which disputed TikTok’s interpretation of how the territoriality principle would apply in this instance.

96. It should be noted that TikTok objected to the admissibility of these affidavits in circumstances where the DPC had not relied on any evidence from Professor Zang or Dr Hunton during the course of the inquiry and had, in fact, expressly taken TikTok’s evidence on Chinese law “at its height”.

97. Mr O’Brien noted that TikTok had not submitted any updated DTA since the one submitted during the course of the inquiry in July 2024.

98. He noted that it was the DPC’s position that it was required to suspend the transfer of data in light of its finding that an equivalent level of protection was not assured. He described the Suspension Order here as “carefully formulated and nuanced”, allowing for re-consideration in light of new measures and noted that TikTok had had two years to prepare for it, since the publication of the PDD.

99. Finally, Mr O’Brien highlighted the recent disclosure by TikTok that some personal data had, in error, been stored on TikTok’s servers in China, in the circumstances described above.

100. The affidavit highlights the duties on a data controller and the connection between those duties and the protection of fundamental rights, while acknowledging that these are principally matters for submission. Mr O’Brien describes the history of the inquiry, rejecting any apparent suggestion by TikTok that the DPC had delayed or been dilatory in the progress of the inquiry.

101. Mr O’Brien addresses TikTok’s reliance on Project Clover. He says that Project Clover was “carefully considered” in the Decision.

102. Mr O’Brien then makes some observation on TikTok’s appeal, contesting the merits of the appeal, before considering the application for a stay. In relation to the stay, the affidavit asserts that the damage alleged to be suffered by TikTok is purely pecuniary which cannot constitute serious and irreparable harm save in exceptional circumstances. In relation to the financial harm which may potentially be suffered by TikTok, he refers to the affidavit of Kieran Wallace, Managing Partner of Interpath (Ireland) Limited and its Global Head of Restructuring, which contends that even on the applicant’s case the damage suffered could not be regarded as serious and irreparable. Mr Wallace also challenges the nature of the exercise conducted by Paul Jacobs in calculating potential losses.

103. Mr O’Brien then sets out the DPC’s position that, even if serious and irreparable harm had been established, a stay would be inconsistent with EU law. He notes that the precise nature and scale of the risks to EEA users is unknown, referring to various aspects of the

Decision.

104. Anu Talus, Chairperson of the EDPB, also swore an affidavit in support of the DPC’s position opposing the stay. She does not state on whose behalf she has sworn the affidavit: she does not, in particular, state that she makes the affidavit on the EDPB’s behalf. She describes the consistency mechanism at Article 60 of the GDPR. Much of her affidavit is a statement of the legal position, or legal submission, and not, therefore, admissible evidence.

105. She refers to the receipt by the SACs of the draft decision. She says that “all of the [SACs] accepted, without objection, the infringement findings made by the DPC…. They also endorsed the corrective measures proposed by the DPC.” During the hearing, counsel clarified that Ms Talus meant that the SACs had “endorsed” the corrective measures by not submitting reasoned objections to them.

106. She then sets out her views as to why the stay should be refused. These mirror, to a large extent, what is said in Mr O’Brien’s affidavit.

107. The additional affidavits filed by the DPC have been referred to above.

108. Dr Paul Hunton swore an affidavit, exhibiting his report,, within which he addresses specific questions posed of him by the DPC. In effect, he was asked by the DPC whether, in light of the DTA and Jiang Ye’s affidavit evidence, data transferred to China temporarily – by being remotely accessed there – could be accessed and processed in China. TikTok object to the admissibility of this affidavit (and that of Professor Dongsheng Zang) on the basis that it was not evidence before the DPC when it made its decision.

109. Dr Hunton contends in his report that TikTok have not provided enough detailed information to enable him to assess the risks. He highlights the risks of persons gaining malicious or unauthorised access to a device connected to TikTok’s operation network in China, although this had not formed any part of the DPC’s consideration in arriving at the

Decision. He notes that he cannot rule out the risks from Chinese state-actors, which are the risks with which the DPC was concerned.

110. Professor Zang concluded in his report, which was exhibited to his affidavit, that he disagrees with the TikTok’s position in relation to Chinese law and the territoriality principle and that “[n]either the territoriality principle, nor the concept of “overseas data” as contended for by TikTok Ireland, prevents the exercise by public authorities of their statutory powers to procure (or compel) access to the data in the way that it is claimed.”

111. Kieran Wallace’s affidavit and report review the evidence contained in the Jacobs Report. Mr Wallace raises various issues regarding the robustness of the analysis, including the fact that there has been no benchmarking of the data against others in the industry. He also notes that even on TikTok’s figures, the extent of losses predicted, while “material” are unlikely to pose a threat to the Group’s financial stability or disrupt its ongoing operations.

112. TikTok filed further affidavits in reply.

113. In summary, Ms Huang provided a further affidavit in which she contested the DPC’s position that TikTok’s loss would be purely pecuniary. She contends that the changes to TikTok’s workforce if the Suspension Solution is implemented would result in the loss of valuable skill and knowledge, which will have a negative impact on its employees and their families, including those who may be made redundant. She again describes the difficulty “or impossibility” of reversing changes made. She also rejects an apparent suggestion in the DPC’s affidavits that the Suspension Solution may not be the least costly means by which TikTok can implement the Suspension Order. As counsel put it, TikTok is motivated to find the least expensive and least disruptive means of meeting the requirements of the Suspension Order.

114. Jianye Ye and Stephen Bailey both swore further affidavits in response to Dr Hunton, disputing the validity of his conclusions. Mr Bailey’s affidavit (in fact, the further report he exhibits) also addresses some of the hypothetical scenarios postulated by Professor Zang in his report and concludes that identification of users would not be possible in the scenarios identified by Professor Zang.

115. Professor Pietzuch also swore a further affidavit exhibiting a second report in which he disputes Dr Hunton’s criticisms of the level of detail contained in the documentation supplied by TikTok, confirming that in his view the information provided is in line with industry best practice. He also addresses Mr Wallace’s criticism that Mr Jacobs’ financial assessment had not been bench-marked. He says that he is not aware of any instance where the restriction on access to data required by the Decision has occurred and, in those circumstances, expressed the view that benchmarking data is unlikely to exist. Mr Jacobs and Mr Xu also prepared reports and affidavits in response to Mr Wallace and Mr O’Brien in which they stand over their initial assessments.

116. TikTok also rely on two affidavits from Chinese law experts Professor Ke Xu, and Yi Zhang, Partner of Fangda Partners, Shanghai, both of whom had provided advice relied on by TikTok during the Inquiry. Both dispute Professor Zang’s interpretation of Chinese law as it applies to the data the subject of the Decision.

117. The only further reply filed by the DPC was an affidavit from Professor Zang exhibiting a second report in which he concludes that the reports of Professor Xu and Mr Zhang did not cause him to change his opinion.

118. The final volley of affidavits from TikTok consisted of two further affidavits exhibiting further reports from Professor Xu and Mr Zhang. Unsurprisingly, they continue to dispute Professor Zang’s interpretation of Chinese law insofar as it applies to these proceedings.

119. The foregoing sets out the factual and legislative background against which to consider TikTok’s application for a stay. It will be necessary to consider the admissibility of various of the affidavits, and the relevance of the recent disclosure regarding personal data being stored in China, before applying the relevant test. Before doing any of that, it is necessary to determine what the relevant test is.

Case law on threshold applicable

i. Union law

120. There was some suggestion in the DPC’s affidavits and legal submissions that the court may have no jurisdiction to grant interim measures in cases concerning cross-border transfer of data in breach of the GDPR. In particular, it was suggested, by reference to the following

conclusion in Schrems II, that the transfer of data must be suspended:

112. Although the supervisory authority must determine which action is appropriate and necessary and take into consideration all the circumstances of the transfer of personal data in question in that determination, the supervisory authority is nevertheless required to execute its responsibility for ensuring that the GDPR is fully enforced with all due diligence.

113. In that regard, as the Advocate General also stated in point 148 of his Opinion, the supervisory authority is required, under Article 58(2)(f) and (j) of that regulation, to suspend or prohibit a transfer of personal data to a third country if, in its view, in the light of all the circumstances of that transfer, the standard data protection clauses are not or cannot be complied with in that third country and the protection of the data transferred that is required by EU law cannot be ensured by other means, where the controller or a processor has not itself suspended or put an end to the transfer.

121. These observations are, of course, addressed to a supervisory authority which has carried out an investigation and reached conclusions that data transferred to a third country is not subject to an equivalent level of protection, rather than to a court dealing with an application for interim measures. At the hearing, the DPC made clear that it accepted that there was a jurisdiction to grant interim measures, in this case a stay, but it argued that the relevant threshold was that applied in joined Cases C-143/88 and C-92/89, Zuckerfabrik Suderdithmarschen v Hauptzollamt Itzehoe and Zuckerfabrik Soest GmbH v Hauptzollamt Paderborn (“Zuckerfabrik”) and not that set out in Okunade v Minister for Justice [2003] 3 IR 153, [2002] IESC 49, the latter being the relevant ‘national procedural law’ in this context.

122. The Zuckerfabrik proceedings concerned a preliminary reference in proceedings challenging the imposition of a levy by the Italian authorities on the basis of a special elimination levy on sugar introduced by a European Community (EC) Regulation. In the proceedings, Zuckerfabrik challenged the national authorities’ decision to impose the levy on the basis that the EC Regulation was invalid. There was thus a direct challenge to an EC measure, which could only be determined by the Court of Justice.

123. The Italian court referred questions on the validity of the Regulation – as it was required to do – but also referred questions on the jurisdiction to suspend the implementation of the national measure, and the conditions under which the national court may so suspend.

124. The court made clear that the national courts must have a jurisdiction to suspend:

16. It should first be emphasized that the provisions of the second paragraph of Article 189 of the Treaty cannot constitute an obstacle to the legal protection which Community law confers on individuals. In cases where national authorities are responsible for the administrative implementation of Community regulations, the legal protection guaranteed by Community law includes the right of individuals to challenge, as a preliminary issue, the legality of such regulations before national courts and to induce those courts to refer questions to the Court of Justice for a preliminary ruling.

17. That right would be compromised if, pending delivery of a judgment of the Court, which alone has jurisdiction to declare that a Community regulation is invalid (see judgment in Case 314/85 Foto-Frost v Hauptzollamt Luebeck-Ost [1987] ECR 4199, at paragraph 20), individuals were not in a position, where certain conditions are satisfied, to obtain a decision granting suspension of enforcement which would make it possible for the effects of the disputed regulation to be rendered for the time being inoperative as regards them.

18. As the Court pointed out in its judgment in Foto-Frost, cited above, (at paragraph 16), requests for preliminary rulings which seek to ascertain the validity of a measure, like actions for annulment, constitute means for reviewing the legality of acts of the Community institutions. In the context of actions for annulment, Article 185 of the EEC Treaty enables applicants to request suspension of the enforcement of the contested act and empowers the Court to order such suspension. The coherence of the system of interim legal protection therefore requires that national courts should also be able to order suspension of enforcement of a national administrative measure based on a Community regulation, the legality of which is contested. …

20. The interim legal protection which Community law ensures for individuals before national courts must remain the same, irrespective of whether they contest the compatibility of national legal provisions with Community law or the validity of secondary Community law, in view of the fact that the dispute in both cases is based on Community law itself.”

125. The Court then considered that conditions which should apply to such a grant. Having concluded that a suspension could only be granted where there was “serious doubt as to the validity of the Community regulation” and any suspension must retain its interim character, the court observed:

25. As regards the other conditions concerning the suspension of enforcement of administrative measures, it must be observed that the rules of procedure of the courts are determined by national law and that those conditions differ according to the national law governing them, which may jeopardize the uniform application of Community law.

26. Such uniform application is a fundamental requirement of the Community legal order. It therefore follows that the suspension of enforcement of administrative measures based on a Community regulation, whilst it is governed by national procedural law, in particular as regards the making and examination of the application, must in all the Member States be subject, at the very least, to conditions which are uniform so far as the granting of such relief is concerned.

27. Since the power of national courts to grant such a suspension corresponds to the jurisdiction reserved to the Court of Justice by Article 185 in the context of actions brought under Article 173, those courts may grant such relief only on the conditions which must be satisfied for the Court of Justice to allow an application to it for interim measures.

28. In this regard, the Court has consistently held that measures suspending the operation of a contested act may be granted only in the event of urgency, in other words, if it is necessary for them to be adopted and to take effect before the decision on the substance of a case, in order to avoid serious and irreparable damage to the party seeking them.

29. With regard to the question of urgency, it should be pointed out that damage invoked by the applicant must be liable to materialize before the Court of Justice has been able to rule on the validity of the contested Community measure. With regard to the nature of the damage, purely financial damage cannot, as the Court has held on numerous occasions, be regarded in principle as irreparable. However, it is for the national court hearing the application for interim relief to examine the circumstances particular to the case before it. It must in this connection consider whether immediate enforcement of the measure which is the subject of the application for interim relief would be likely to result in irreversible damage to the applicant which could not be made good if the Community act were to be declared invalid.

126. There is considerable case law of the CJEU regarding the application of this test to which I will refer, as necessary, below.

127. Zuckerfabrik involved a preliminary reference in which a national measure was challenged on the basis that the underlying EU measure on which the national measure was based was invalid. In Case C-432/05, Unibet (London) Ltd v Justitiekanslern, the proceedings concerned whether a national measure was consistent with EU law, i.e. there was no challenge to any EU measure. The question was whether the same conditions applied to the grant of interim measures in such circumstances. The Advocate General and the Court both concluded that they did not, and that any such application should be decided in accordance with national procedural rules in accordance with the principle of procedural autonomy.

128. In her opinion, the Advocate General observed:

“93. It is true that in Zuckerfabrik and Atlanta the Court laid down Community law conditions for the grant of interim relief by national courts, including the suspension of a national measure based on a Community measure. Those cases concerned the alleged invalidity of the underlying Community legislation. In such cases, of course, only the Court has jurisdiction to declare the Community measure invalid. In such a context there is a clear Community interest in having uniform strict criteria. In contrast, the present case is concerned with the validity of a national measure which by definition applies in only one Member State. In such a case, I see no reason to depart from the general rule of procedural autonomy. Indeed it would seem more logical for the procedure governing interim suspension of a national law on grounds of alleged incompatibility with Community law to be the same as that governing interim suspension of a national law on other, purely domestic, grounds (in application of the principle of equivalence), provided always that the principle of effectiveness is also satisfied.

94. Moreover in Zuckerfabrik the Court observed that the power of the national courts to grant the suspension of a Community measure corresponds to the jurisdiction reserved to the Court of Justice by Article 242 EC. It accordingly ruled that the national courts could grant such relief only on the same conditions as must be satisfied for the Court of Justice to grant an application for interim measures. That approach ensures consistency in the rules governing the grant of interim relief, irrespective of whether a challenge is brought under Article 230 or by way of Article 234 EC. In the present case, in contrast, there is no such analogy with the jurisdiction of the Court. As the United Kingdom submits, the closest parallel lies in the power of the courts of the Member

States to determine substantive questions of incompatibility. There, procedure is governed by national rules, subject to the principles of equivalence and effectiveness.

95. I do of course bear in mind that the Court stated in Zuckerfabrik that the “interim legal protection which Community law ensures for individuals before national courts must remain the same, irrespective of whether they contest the compatibility of national legal provisions with Community law or the validity of secondary Community law, in view of the fact that the dispute in both cases is based on Community law itself”. That dictum does not, in my view, decide the issue raised by the third question in the present case. In Zuckerfabrik, the issue before the Court was whether interim relief – which, in accordance with Factortame I, a national court must be able to grant pending a ruling by the Court on the question of compatibility – should be available where the validity of a Community regulation underlying a national measure was being challenged. The Court was not however asked to determine the criteria for the grant of interim relief by a national court in proceedings concerning a national measure allegedly incompatible with Community law.”

129. The Court agreed:

79. It is clear from established case-law that the suspension of enforcement of a national provision based on a Community regulation in proceedings pending before a national court, whilst it is governed by national procedural law, is in all Member States subject to conditions which are uniform and analagous with the conditions for an application for interim relief brought before the Community Court (Joined Cases C- 143/88 and C-92/89 Zuckerfabrik Süderdithmarschen and Zuckerfabrik Soest [1991] ECR I-415, paragraphs 26 and 27; Case C-465/93 Atlanta Fruchthandelsgesellschaft [1995] ECR I-3761, paragraph 39; and Joined Cases C- 453/03, C-11/04, C-12/04 and C-194/04 ABNA and Others [2005] ECR I-10423, paragraph 104). However, the case in the main proceedings is different from those giving rise to those judgments in that Unibet’s application for interim relief does not seek to suspend the effects of a national provision adopted in accordance with a Community regulation where the legality of that regulation is contested, but rather the effects of national legislation where the compatibility of that legislation with Community law is contested.

80. Therefore, in the absence of Community rules governing the matter, it is for the domestic legal system of each Member State to determine the conditions under which interim relief is to be granted for safeguarding an individual’s rights under Community law.”

ii. National law

130. In Dowling v Minister for Finance [2013] 4 IR 576, the Supreme Court confirmed that the domestic law test for the grant of an injunction (or stay), as set out in Okunade, satisfied the requirements of equivalence and effectiveness. The Court observed as follows in relation to Unibet (at p. 617):

“86. Equally, it is clear from Unibet (London) Ltd. and Unibet (International) Ltd.

v. Justitiekanslern (Case C-432/05)[2007] E.C.R. I-2271 that, where there is a challenge to a national measure, national procedural rules are to apply subject to the principles of equivalence and effectiveness. It follows that it is possible that different results might arise in different member states, in the event of a challenge to similar national measures, because of the applicability of different procedural regimes, provided always that each such regime must provide an effective remedy.”

131. The test in Okunade has been applied consistently by the Irish courts to decisions giving effect to EU law, including in recent decision in Aer Lingus Limited v Irish Aviation Authority and Ors [2024] IEHC 625, a case in which there was also a debate about which test applied. However, the decision in Eircom v Commission for Communications

Regulation [2022] IEHC 165 suggests that cases where the Zuckerfabrik test applies to the grant of interim measures are not confined to challenges to EU measures. In that case, the High Court (MacDonald J) concluded that the appropriate test for the grant of a stay in the context of an appeal under the European Communities (Electronic Communications Networks and Services) (Framework) Regulations 2011 (“the Framework Regulations”) was that set out in Zuckerfabrik. He did so, having regard to the fact that the Framework Regulations give effect to Directive 2001/02/EC (“the Framework Directive”) and he interpreted the Directive as requiring harmonisation of the test for interim measures.

132. The Zuckerfabrik test was also applied in an application for a stay in an appeal under the Framework Regulations in Three Ireland (Hutchison) Limited v Commission for Communications Regulation [2022] IECA 300. In the High Court, the applicant accepted that that was the appropriate test, but sought to argue otherwise in the Court of Appeal. The Court concluded that it was impermissible to argue for a different test in the Court of Appeal having accepted that Zuckerfabrik was the test in the High Court. The court (Collins J) nonetheless made the following observations, which both parties in these proceedings accepted were clearly obiter:

“95. If it had been open to Three to advance that argument, and in the event that it appeared that the outcome of the appeal might turn on the issue of the applicable test, the Court might have had to give consideration to making a reference to the CJEU pursuant to Article 267 TFEU. So far as the researches of the parties could ascertain, this aspect of Article 4(1) of the Framework Directive (now Article 31(1) of the Recast Directive) has never been considered by the Court of Justice. There can be little doubt that, as the Judge concluded in Eircom and as Counsel for Three accepted in argument here, the language of the relevant recitals appears clearly to point to the application of the Zuckerfabrik test. But recitals are not operative legislative provisions. Recitals may, of course, be relied on to resolve ambiguity in related legislative provisions. However, a notable feature of the relevant legislative provision here is that it expressly refers to the granting of interim measures “in accordance with national law” (my emphasis). That language was introduced by the Better Regulation Directive and has been retained in the Recast Directive. On their face, the recitals and the operative legislative provision appear to be in tension and there may be scope for argument that the recitals must yield to the terms of Article 4(1) in those circumstances. There are, of course, other factors to be considered also in this context, including the legal basis of the functions being carried out by ComReg and in particular the legal and regulatory rules for the spectrum allocation function being exercised here (the ultimate source of which is, according to Three, the Framework Directive). The fact that Three’s right of appeal, and its entitlement to seek a stay on ComReg’s Decision, ultimately derive from EU legislation are also very relevant considerations in this context.

All these considerations might appear to indicate that the position here is closer to Zuckerfabrik than to Okunade or Dowling (or Unibet).

96. With becoming frankness, Mr Kennelly argues that it should be easier to obtain interim relief when one is challenging a domestic measure and not impugning an EU measure. But that argument begs the question as to the appropriate characterisation of the impugned measure here. It seems wholly implausible to suggest that the Decision, made by the Irish NRA within a regulatory framework governed by EU law, can properly be characterised as a purely domestic law measure, such as was at issue in Dowling. Any such suggestion appears wholly at odds with Three’s acknowledgment that the ultimate source of ComReg’s

decision-making competence here was the Framework Directive and that any claim for damages that Three might seek to make against ComReg in connection with the functions at issue is governed by Francovich principles. If the availability of a restrictive claim for non-contractual damages against the EU under the Treaties is, in general, an answer to an application for interim measures against the EU, why as a matter of principle should not the availability of a similar claim not be an answer to an application for interim measures against a national body exercising EU law functions?

133. The reference to Francovich principles is of some significance. The CJEU has made clear that wholly financial loss can rarely meet the threshold of irreparable harm because of the availability of Francovich damages in the event that an EU measure is found to be unlawful. In Dowling, the Supreme Court noted similarities between the Zuckerfabrik and Okunade thresholds, regarding the adequacy of damages. As Collins J observed (at [87]) in Three Ireland, the court did not, however, advert to the fact that, when applying Zuckerfabrik, “financial loss might be regarded as reparable even though the prospect of actually recovering monetary compensation was limited by reason of the restrictive rules governing the non-contractual liability of the Union and its institutions…” since the evidence in Dowling was that full reparation would be made.

134. The Court of Appeal made clear, in public procurement proceedings, that the difficulties in recovering Francovich damages is relevant when considering the adequacy of damages as a remedy. In Word Perfect Translation Services Limited v Minister for Public Expenditure and Reform [2018] IECA 35, a public procurement case, Hogan J considered that, in those proceedings, damages could not be regarded as an adequate remedy for the purpose of the test in Okunade:

“58. It would have to be accepted, therefore, that a claimant such as Word Perfect would not find recovery of damages straightforward, even if, following a full hearing, a material breach of the procurement rules were actually to be established.

59. What implications does this conclusion have insofar as the present case is concerned? As the Supreme Court stressed in Okunade v. Minister for Justice [2002] IESC 49, [2003] 3 I.R. 153, the task of the Court in the context of an interlocutory application such as this is to assess the facts and apply legal principles designed to ensure the minimum possible injustice to the parties pending the outcome of the main action. If, however, the ability of Word Perfect to recover damages is highly restrained this clearly impacts on the manner in which these factors should be weighed and balanced.”

iii. Other jurisdictions

135. TikTok also relies on the decision of the Administrative Court of Luxembourg in Amazon Europe Core SARL v Commission Nationale pour La Protection des Données, Case 46630, dated 17 December 2021. In that case, the supervising authority in Luxembourg, the CNPD, had issued a decision which required Amazon to take corrective measures. Amazon appealed the decision and sought a stay on the corrective order pending determination of that appeal on grounds similar to those advanced by TikTok in this case, i.e. it would irreversibly impact on the company and adversely affect the experience of its users. The court granted the stay in that case. It is clear from the court’s ruling that in so doing, it decided the question of a stay by reference to national procedural law – there was no reference to Zuckerfabrik.

136. It must be noted, however, that there does not appear to have been any discussion regarding the applicable threshold. A point not argued is a point not decided. Moreover, the applicable national procedural law in that case had, in any event, some similarity to the Zuckerfabrik test. In the absence of any evidence regarding Luxembourg law, this is merely an observation, rather than a conclusion. The case is thus of interest, but hardly determinative.

Arguments

137. In brief terms, TikTok argues that in the absence of harmonisation, the applicable threshold for the grant of an interim remedy is a matter for the national courts, to be determined in accordance with national law. It argues that this is the default position, and it is only where the measure being impugned is an EU measure, that is, a decision of an EU body, that the case law of the CJEU indicates that the same minimum standards must apply across the EU.

138. It contends that the decision impugned here is a national law measure. It is a decision of the DPC, a body established by Irish law. Its status as a national law measure is not affected by the fact that before the Decision was made, the DPC was required to consult with other SACs in accordance with Article 60, or by the fact that the DPC could not have finalised the decision in the event of a reasoned objection by any SAC without reaching agreement on that reasoned objection, or a referral of any dispute to the EDPB.

139. TikTok contends that its argument that the criteria for a stay on a decision of a supervising authority is governed by national procedural law is supported by the wording of the GDPR and by the case law discussed above.

140. The DPC argues that its decision cannot be regarded simply as a national law measure, and characterise a decision of a supervising authority following the Article 60 co-operation procedure as a decision adopted or agreed by all supervising authorities, a characterisation it argues is supported by the wording of the GDPR, referring, in particular, to Recital 126, which refers to decisions being “agreed jointly”, and by the case law. It places significant emphasis on its contention that a decision made following the completion of the Article 60 procedure is a decision “with binding effect in all Member States”. It argues that the crucial consideration in deciding whether an application to stay a decision made under the GDPR is governed by national procedural law or whether it must be determined by reference to the same standard as a challenge to an EU law measure is the effect of the decision. Given that decisions of a supervising authority can have binding effect across the EU, similar to an EU law measure, they should be subjected to the same standard.

141. It argues that a requirement that an application for a stay be determined by reference to the criteria required when seeking a stay on an EU measure does not involve a disapplication of national procedural law, or a departure from, what it accepts is, the default position that in the absence of harmonisation, national procedural rules apply. In this regard, it draws a comparison with the requirement for a uniform approach in relation to damages per Cases C-6/90 and C-9/90, Francovich v Italian Republic.

142. The DPC points to the inconsistencies which might arise were such applications governed by national procedural law in each jurisdiction. It refers to the decisions in Case C-132/31, BE in which the court emphasised that member states must ensure that their procedural rules ensure a consistent and homogenous application of the GDPR. It also refers to Case C-645/19, Facebook Ireland Limited, in which the court suggested that ineffective application of the GDPR by supervising authorities could result in “forum shopping”.

Discussion on applicable threshold

143. The DPC argues convincingly that a decision of a supervising authority made in accordance with Article 60 of the GDPR cannot simply be characterised as a national law rather than an EU law measure. This echoes the observation of Collins J in Three Ireland that it was “wholly implausible” to describe a decision under the Framework Regulation as a “purely domestic law measure”.

144. By the same token, the DPC appears to accept that such a decision cannot be characterised as an EU law measure, or as a decision of an EU body. If this were not in any event obvious, it is made abundantly clear by the GDPR itself, which expressly establishes the EDPB as a Union body, but makes no such provision in relation to supervising authorities.

145. The decision-making procedure created by the GDPR appears to be novel; neither of the parties were able to identify an analogous process, or at least not one which had been the subject of consideration by the courts in the context of an application for interim measures. In those circumstances, the identification of whether this application is governed by national procedural law or by the criteria governing an application to stay an EU measure cannot solely be resolved by reference to the distinctions drawn in Zuckerfabrik or Unibet. Rather, the answer must be found in the terms of the GDPR itself, and then a consideration of how the principles identified in the case law can be applied to this novel process.

146. The DPC lay emphasis on the repeated references in the recitals to the GDPR to the co-operative nature of the decision-making under the Article 60 procedure, to the requirement for agreement before a decision can be reached, and the binding nature of the

decision. It refers to the decision in Case C-645/19, Facebook, and the emphasis by the Advocate General on the “one stop shop” decision-making process and the necessity for agreement and consensus.

147. It must first be observed that in describing the process in Facebook, the court was not at all concerned with the question at issue here, the applicable test for interim measures, but was rather considering the question of whether a supervising authority could bring proceedings in relation to an infringement of the GDPR in relation to cross-border processing if it was not the lead supervising authority in respect of that processing.

148. Second, the DPC may have somewhat overstated the binding effect of decisions of a supervising authority. As appears from Article 60(6), a decision of a supervising authority is only binding on the supervising authorities concerned, as defined in Article 4(22) of the GDPR. However, it is clear that where, as here, the transfers in issue are occurring across the EEA, the Decision will have binding effect on most, if not all, supervising authorities.

149. Of greater significance, perhaps, is what ‘binding’ means in this context. A national law measure will be binding on the party to whom it is directed. Where the State has jurisdiction to regulate the activities of a data controller whose main establishment is in the State, the fact that a decision binds that data controller within the EU does not appear to me to be a sufficient point of distinction from any other decision by a national regulator made pursuant to EU law to warrant the disapplication of national procedural autonomy in proceedings before a national court.

150. What is novel about the GDPR regime – other than the consistency mechanism itself – is that the decision binds other supervising authorities concerned. But this must, I think, be understood as a manifestation of the ‘one-stop shop’ regime, which was described as the purpose of the consistency mechanism in the GDPR in Case C-645/19, Facebook. There is no suggestion, for instance, and the DPC did not contend, that decisions of a lead supervising authority are binding as to the interpretation of the GDPR. They plainly are not, and could not be, that.

151. The binding nature of decisions do not, therefore, reflect an attempt to elevate decisions of lead supervising authorities to quasi-EU law measures. Rather, the purpose is to ensure the integrity of the one-stop shop mechanism and enable data subjects and data controllers to deal with a single supervising authority in respect of any given issue (save in the circumstances provided for in Article 58(5) of the GDPR).

152. It is true that the GDPR emphasises the necessity for co-operation and that decisions cannot be finalised without consensus between lead supervising authorities and the supervising authorities concerned (or a ruling from the EDPB) and that has some significance in consideration of the threshold applicable. Of far greater significance, in my view, are two factors.

153. Firstly, the GDPR clearly provides that a decision of a supervising authority is a

decision of that body, carrying with it the important legal consequence that a challenge to that decision must be brought in the court’s of the member state in which that supervising authority is established. There is no suggestion, for instance, that it should be regarded as the decision of all supervising authorities, or even all supervising authorities concerned, such that it becomes possible to challenge a decision in the courts where any other supervising authority is established.

154. In fact, as the DPC highlighted during its submissions, Article 60(9) of the GDPR provides for split decisions, where parts of a complaint are upheld and parts rejected. In such cases, the lead supervising authority adopts the part of the decision upholding the complaint, whereas the supervising authority in which the complaint was made adopts the part of the decision rejecting the complaint. This procedure is reflected in section 114 of the 2018 Act, requiring the DPC to adopt decisions of lead supervising authorities dismissing complaints where the DPC is the supervising authorities. This facilitates complainants in bringing proceedings in their own member state. The implication of this provision is not that decisions made pursuant to Article 60 should be regarded as joint decisions, but rather that the GDPR attaches importance to identifying by who a decision is made, and the consequences thereof.

155. Secondly, and perhaps decisively, the GDPR, unlike the Framework Directive (where there were conflicting provisions) makes no provision for harmonisation of procedural rules for challenges to decisions made under the Regulation, something the legislature could clearly have done had it so wished. Recital 143 of the Regulation expressly provides that “proceedings should be conducted in accordance with that Member State’s procedural law”. This, as the DPC accepts, is the default position and there is nothing in the provisions of the GDPR which suggest that the default position is displaced. Quite the contrary, the conferring of jurisdictions on national courts and the express invocation of national procedural law strongly indicate otherwise and must be regarded as a deliberate choice by the legislature. It is true that the GDPR seeks to ensure consistency in decision making by supervisory authorities, by requiring that they co-operate with each other. By contrast, however, it confers jurisdiction on national courts to provide effective remedies in relation to such decisions, with no reference to co-operation or harmonisation. If, as the DPC in effect contends, the GDPR does require harmonisation, at least in relation to applications for interim measures, this is a surprising omission.

156. If national procedural law applies, an apparent anomaly could be said to arise insofar as some decisions of supervising authorities may be made without reference to the EDPB, but others may require that the EDPB issue a ruling in the event of a dispute, which ruling will be binding on the lead supervising authority. Although there was no intervention by the EDPB in this case, it seemed to me, and the parties accepted, that the question of the applicable threshold could not turn on whether or not the dispute resolution mechanism had, in fact, been engaged (or on how many SACs there were). The fact that it was capable of being engaged is what is relevant.

157. Since the EDPB is an EU body, established under the GDPR, it seems that the Zuckerfabrik criteria would likely apply if there were a challenge to a decision of that body. Although the question of whether it is permissible to challenge a decision of the EDPB under the consistency mechanism at all is the subject of the pending WhatsApp proceedings, and it may be that if the view of the General Court prevails, no anomaly arises, even if the Advocate General’s view is adopted by the court, it seems to me that this complexity is one recognised by the GDPR itself and does not affect the determination of whether the GDPR requires harmonisation of procedural rules in relation to interim applications.

158. In fact, any anomaly is more apparent than real. If a lead supervising authority adopts a decision on the basis of a EDPB ruling pursuant to the consistency mechanism, any challenge to that decision must still be brought in the courts of the member state of that lead supervising authority. However, those courts are obliged to refer any question as to the lawfulness of the EDPB ruling to the CJEU, and will thus not decide on that application. If, as appears to be the case, the national court is required to apply the Zuckerfabrik criteria when considering an application for interim measures in such a case, this reflects the fact that that the legal issues arising in the challenge are ones which must be determined by the CJEU and not the national court. The application of different criteria in such a case to one which can be decided by the national court is, therefore, unsurprising and reflects the distinction drawn in Unibet.

159. This is expressly reflected in Recital 143, which acknowledges the consequence of conferring jurisdiction on national courts to determine challenges to decisions of supervising authorities. It provides that where the validity of a decision of the EDPB is at issue in such a challenge, a national court must refer that question to the CJEU for determination. In circumstances where the GDPR expressly recognised that the validity of decisions of supervising authorities and of the EDPB must be determined in different fora, there is nothing anomalous about different criteria applying in relation to decisions the validity of which must be challenged before national courts, and those the validity of which must be challenged before the CJEU. The DPC argue that it would be “perverse, or at least illogical” if the more restrictive Zuckerfabrik criteria applied in the case of disagreement, but the more permissive Okunade principles applied where there was none. That is, of course, to ignore the fact that, in the former scenario, any dispute would have been resolved by an EU body, the EDPB.

160. In response to the clear statement in Recital 143 regarding national procedural law, the DPC inventively sought to argue that the application of the Zuckerfabrik criteria would not, in fact, involve a disapplication of national procedural rules at all, but rather, would impose a requirement that national procedural rules meet certain minimum thresholds. This is difficult to accept. Of course, national procedural rules must respect the principles of equivalence and effectiveness, as the Supreme Court has determined the Okunade test does in Dowling, but it would be a curious form of autonomy which required that different criteria apply even where the procedural rules satisfy those requirements. Moreover, all of the relevant case law is based on the proposition that either national procedural rules apply or the Zuckerfabrik criteria apply. This reflects the reality; if a national court were required to apply the Zuckerfabrik criteria to a stay application, this would involve a departure from procedural autonomy, insofar as those criteria differ from those applicable to stay applications in that jurisdiction.

161. The DPC suggested that its interpretation of the Zuckerfabrik criteria, in effect, as a graft on to national procedural rules such that procedural autonomy was respected, is what occurred in Francovich. I do not think that this is correct. Francovich identified a substantive obligation on member states to make good loss and damage caused by a breach of EU law. However, it clearly provided that it was for the “internal legal order” of the member states to lay down the procedural rules for safeguarding that right (see [42]).

162. The GDPR, therefore, has not harmonised, and does not require the harmonisation of, national procedural rules. In light of Recital 143, and Article 78 of the Regulation, this can only be understood as a deliberate legislative choice.

163. In circumstances where interpretation of the GDPR strongly suggests that national procedural autonomy should apply to applications for a stay on decisions of supervisory authorities, is there anything in the case law of the CJEU or the national courts which suggests to the contrary? In my view, there is not.

164. The DPC place significant emphasis on the possibility of divergent or conflicting decisions should each jurisdiction apply its national procedural rules when hearing challenges to decisions under the GDPR. That, of course, is an argument which proves too much. If procedural autonomy is to be permitted at all in challenges to decisions giving effect to EU law – which the DPC accepts is the default position – then the possibility of divergence always arises and is an accepted part of the EU regime, as noted by the Supreme Court in Dowling.

165. Moreover, the risk of conflicting decisions is virtually eliminated by the one-stop shop mechanism created under the GDPR. There is no real possibility of a conflicting decision arising on the issues the subject matter of the decision in these proceedings, whether due to divergence in procedural rules or otherwise, because the decision of the DPC is binding on the supervising authorities concerned.

166. Furthermore, what is at issue in this application are the procedural rules applicable to a preliminary application, an application for a stay, not the substance of the proceedings and not, therefore, the interpretation of the GDPR (other than as it relates to the procedure which applies to this application). Thus, the real concern where there is a lack of harmonisation, the possibility of differing interpretations or applications of EU law, does not arise. The possible concern about forum shopping which was raised in Case C-645/19, Facebook, was in the context of supervising authorities and the risk that data controllers might favour jurisdictions in which supervising authorities failed to discharge their obligations under the

GDPR. The DPC did not direct me to any authority for the proposition that procedural autonomy should be disapplied for this reason, nor is there any evidence to support the underlying assumption in that argument, that the State’s procedural rules are, in this instance, more permissive than those of other EU member states. The Supreme Court has concluded in Dowling that the national law procedure in relation to the granting of interim measures respects the principles of equivalence and effectiveness. It is difficult to accept, therefore, the proposition that those rules should be disapplied or varied lest data controllers select the states in which they establish by reference to the procedural rules which might apply in the event that at some future point they are required to seek a stay on a decision of a supervising authority.

167. Turning to the relevant case law, Zuckerfabrik and Unibet remain the two cases which identify the demarcation point for the purposes of determining this question. In Zuckerfabrik, the challenge was to a national law measure but on the basis of the invalidity of an EU measure. The ratio of the Court’s decision was that the EU measure could have been challenged by an annulment action and, although it was permissible to challenge the EU measure in a preliminary reference, the same criteria had to apply to both types of challenge. Thus, the national court had to apply the EU standard when considering an application for a stay in the context of a preliminary reference.

168. No such consideration arises here. Pursuant to the GDPR, TikTok could not have challenged the DPC’s decision in an annulment action. No one suggested otherwise. No question of aligning the criteria for a challenge with those applicable to annulment actions arises.

169. In these proceedings, not only is there no challenge to an EU measure, but a significant part of the challenge is advanced on what might be regarded as purely domestic law grounds. In particular, TikTok’s claims of breach of fair procedures appear referable not to provisions of the GDPR but to domestic law requirements of natural and constitutional justice. The DPC certainly did not suggest that TikTok was confined to complaints based on EU law. It is certainly conceivable that a decision of the DPC could be successfully challenged on purely domestic law grounds.

170. Although decisions of the DPC are capable of having EU-wide effect, that effect is confined to the decision concerned and, in substance, the affected parties. There is, in truth, nothing surprising about a decision having such an effective scope, nor does that scope require that the procedural autonomy of the courts of a member state conferred with jurisdiction be displaced.

171. Accordingly, this application falls to be considered in accordance with the principles set out in Okunade. However, I will, for completeness, reference the Zuckerfabrik criteria when carrying out my assessment.

Arguments

172. Rather than detail exhaustively the arguments of the parties, I propose to provide a headline summary here and then address them in more detail in assessing the application of the Okunade test.

173. In circumstances where the DPC submissions were directed in the main to the Zuckerfabrik criteria, as were much of TikTok’s, it is worth comparing the two tests to see how the Okunade principles “map” on to those in Zuckerfabrik.

174. Okunade involved judicial review proceedings, and a very different type of decision than that at issue here, a deportation order. However, the DPC did not suggest that the principles identified in Okunade would not apply with equal force in the context of a statutory appeal: indeed, the decision the subject of these proceedings has also been challenged in judicial review proceedings, and, as the DPC accepted, the stay could just as easily have been sought in those proceedings.

175. In Okunade, the Court carried out a very detailed review of the principles which apply to an application to stay an administrative decision or measure, including a consideration of the analogous principles which apply in the case of an application for an interlocutory injunction. Ultimately, the Court concluded (at p. 193):

“[104] As to the overall test I am of the view, therefore, that in considering whether to grant a stay or an interlocutory injunction in the context of judicial review proceedings the court should apply the following considerations:-

(a) the court should first determine whether the applicant has established an arguable case; if not the application must be refused, but if so then;

(b) the court should consider where the greatest risk of injustice would lie. But in doing so the court should:-

(i) give all appropriate weight to the orderly implementation of measures which are prima facie valid;

(ii) give such weight as may be appropriate (if any) to any public interest in the orderly operation of the particular scheme in which the measure under challenge was made; and,

(iii) give appropriate weight (if any) to any additional factors arising on the facts of the individual case which would heighten the risk to the public interest of the specific measure under challenge not being implemented pending resolution of the proceedings;

but also,

(iv) give all due weight to the consequences for the applicant of being required to comply with the measure under challenge in circumstances where that measure may be found to be unlawful.

(c) in addition the court should, in those limited cases where it may be relevant, have regard to whether damages are available and would be an adequate remedy and also whether damages could be an adequate remedy arising from an undertaking as to damages; and,

(d) in addition, and subject to the issues arising on the judicial review not involving detailed investigation of fact or complex questions of law, the court can place all due weight on the strength or weakness of the applicant's case.”

176. The overriding consideration, once a serious issue to be tried has been established, is how to ensure the least risk of injustice.

177. The Zuckerfabrik test is summarised by the DPC in its submissions (at [159]) in the following way:

“An applicant must therefore:

(a) Establish “serious doubts” as to the validity of the EU measure (the “merits test”);

(b) Establish urgency by demonstrating, as a matter of probability, that the interim relief is necessary to avoid serious and irreparable damage prior to the resolution of the proceedings (the “urgency test”); and

(c) Take account of the interests of the EU, and demonstrate that the urgency identified outweighs those interests and any other interests arising (the “European interests test”).” [Emphasis in original]

178. In very broad terms, the merits test seems to be “substantially the same” as the requirement that there be a serious issue to be tried, as suggested by McDonald J in Eircom (at [31]), the urgency test encompasses considerations which arise in considering the adequacy of damages, and the European interests test requires a balancing exercise, balancing the potential harm if a measure is implemented but ultimately determined to be invalid, against the harm of delaying the implementation of a measure which is presumptively valid, as does the least risk of injustice analysis. Accordingly, arguments advanced by both parties by reference to the criteria in Zuckerfabrik, can be read across to the application of the Okunade test.

179. As noted above, the DPC has accepted for the purpose of this application that TikTok has raised serious doubts as to the validity of the Decision, i.e. has identified a serious issue to be tried.

180. TikTok argues that if it is required to implement the Suspension Order pending determination of its appeal, it will suffer serious and irremediable damage. It argues that once it puts in place the Suspension Solution, that cannot readily be undone – or at least that undoing the steps it proposes to take will be as disruptive as putting them in place in the first instance. It argues that damages are not an adequate remedy for the damage it will suffer. In this regard, it contends that its losses will not merely be financial, that any financial damage it suffers will be exceptionally difficult to quantify, and that there is a serious question of whether it could recover damages, whether on the basis of Francovich or otherwise. It relies, in this last respect, on the decision of the Court of Appeal in Word Perfect Translation Services. It notes that the DPC enjoys an immunity from suit pursuant to section 154 of the 2018 Act.

181. The DPC rejects the contention that damages are not an adequate remedy. It queries the extent of the loss which TikTok claims it will suffer, but contends, in any event, that TikTok’s purported loss is entirely financial. It argues that it is apparent from TikTok’s evidence that any such loss will not threaten the viability of TikTok and, accordingly, the evidence does not establish that this is one of the exceptional cases where the availability of Francovich damages is not a full answer to a claim for interim measures.

182. In relation to the least risk of injustice, TikTok does not dispute that the court must give all due weight to the Decision, but contends that in the particular circumstances of this case, the balance falls in its favour. In this regard, it argues that having regard to the steps it has put in place since the temporal scope of the Inquiry expired, there is no real risk that EEA user data will be processed in China in breach of the GDPR and therefore, there is no significant EU interest at stake which requires to be balanced against its undoubted interest in not having to comply with the Decision pending the determination of its appeal. It places reliance on the fact that the DPC has made a ‘negative’ finding, that TikTok has not satisfied the requirement to show that an equivalent level of protection is available, rather than a ‘positive’ finding, that there is not, in fact, an equivalent level of protection. It also relies on the fact that the finding of a breach of Article 46 is, in effect, historic, since the temporal scope of the Inquiry was fixed as ending in May 2023, and cannot be relied on by the DPC as evidence of a current risk in light of the significant changes made by TikTok, by its implementation of Project Clover, since then.

183. The DPC argues that the EU interests in this case involve fundamental rights and therefore must weigh very heavily against any delay in implementing the Decision. It contends that TikTok is impermissibly inviting the court to look behind its decision when contending that there is no real risk of a breach of the GDPR. It contends that it considered in detail the Project Clover measures when making the Suspension Order, and accordingly, it is impermissible for TikTok to rely on those measures now as ‘changed’ circumstances since the making of that order. It notes that TikTok has not submitted a revised DTA since July 2024.

184. Both parties agree that the court should not ordinarily consider the merits of the underlying proceedings, but both, nonetheless made submissions on the merits. To be fair to the DPC, its oral submissions on the merits were largely in response to those advanced on behalf of TikTok who argued that its appeal on, in particular, fair procedures grounds is “indisputable” (Transcript Day 1, p. 61).

Admissibility

185. Despite the objections to the admission of various affidavits, in particular, by the DPC, the parties did not delay unduly in raising these objections, and so I will deal relatively briefly with the issues here.

186. Mirroring TikTok’s objections to the admissibility of the affidavits from Ms Talus, Dr Hunton and Professor Zang, and the evidence regarding the ‘OnCall’ platform, the DPC objects to TikTok relying on evidence that there is, in fact, no risk of personal data breaches in the circumstances of this case, which it argues is an impermissible attempt by TikTok to ‘look behind’ the Decision in this case.

187. I agree with the DPC’s position up to a point. It is only permissible in the context of a stay applications to invite the court to consider the merits of a decision-maker’s decision where there are no disputed issues of fact, or the issues of law are straightforward. So, where a decision is manifestly unlawful, it might be possible to argue that, just as an injunction will be granted as of right where there is no defence to the proceedings in which the injunction is sought, a stay may be granted where there is no defence to the challenge to the lawfulness of an administrative decision.

188. Although TikTok argued that some aspects of its appeal were very strong, indeed, indisputable, it suffices to say that I do not accept that TikTok has established at this stage that there is no answer to its claim, or that the complex issues of fact and law to which these proceedings give rise are capable of being resolved in an interlocutory application. It is impermissible, therefore, for TikTok to invite the court to reach conclusions on the question of the least risk of injustice which are at odds with the findings of the DPC.

189. It is, however, permissible for TikTok to adduce evidence which addresses matters which it argues, are not encompassed by the DPC’s decision. In this regard, it is notable that TikTok did not seek to adduce additional Chinese law evidence, save in response to that led by the DPC. It did, however, seek to lead evidence regarding the actual level of risk caused by the data transfers in China in circumstances where, it argues, the DPC has only assessed that there is a risk – because TikTok hasn’t established that there is an equivalent level of protection to that in the EU – not what that risk is. As TikTok notes, the DPC’s own affidavit evidence is that the level of risk is unknown.

190. Similarly, I think it is permissible for the DPC to adduce evidence regarding the level of risk involved in granting a stay – it would be unfairly hamstrung if TikTok were so permitted, but it could not. That is the apparent purpose of Professor Zang’s affidavit and the evidence regarding the ‘OnCall’ platform. There is nothing inconsistent about that evidence and the Decision. I stress, however, that entirely different considerations may arise if the DPC sought to adduce the same evidence in order to defend the lawfulness of the

Decision. That is a matter for another day.

191. I can, therefore, have regard to Professor Zang’s affidavits, and, necessarily, the affidavit delivered by TikTok in reply to him.

192. Different considerations arise in relation to Dr Hunton’s affidavit and that of Ms Talus. Although the opinion of Ms Talus, as chairperson of the EDPB, is clearly worthy of respect, it is not clear what evidential weight it purports to have. Her affidavit consists largely of legal submission and her opinion that the stay should be refused. There is very limited factual information in the affidavit, and nothing which adds to the information in the

Decision. I cannot see that it adds anything to the DPC’s case. I note that the Decision was circulated to all the SACs in the EEA and none raised a reasoned objection. Although not determinative of the legal test which should apply to this application, it is a factor which can be weighed in the balance in considering the interests of justice. Ms Talus’s affidavit does not add to that weight.

193. Nor is Dr Hunton’s evidence admissible. Dr Hunton relies on matters not relied on by the DPC in making its decision. It is inconsistent with the DPC’s decision, or at least seeks to advance entirely different reasons on which the Decision might have been based, e.g. inadequacy of information, and the risks from malicious actors. The DPC is not permitted to argue for the immediate enforcement of the Decision, i.e. the refusal of a stay, on grounds that it could have, but did not, rely on when making the Decision. That would not involve giving all appropriate weight to a decision which is presumptively valid, or having regard to the EU interests arising: the Decision had little to do with the issues raised by Dr Hunton at all.

Assessment

194. As is clear, there is no dispute that there is a fair issue to be tried. The DPC accepts, for the purpose of this application at least, that TikTok’s appeal has identified serious doubts as to validity of the Decision, and that the first threshold of the Zuckerfabrik test is met. There was no dispute that this also meant that the Okunade threshold of a serious issue to be tried was met. It is on the other limbs of each test where the battle lines were drawn.

Adequacy of damages / Serious risk of irremediable damage

195. TikTok has presented comprehensive evidence of the financial costs or losses it will likely incur if required to implement the Suspension Solution. First, it has explained the necessity for the Suspension Solution. It has then explained the likely consequences of implementing that solution. Finally, it has sought to estimate the costs of implementing the solution. The figures presented are, on any view, very significant.

196. The DPC has queried whether the Suspension Solution is the best means of meeting the Suspension Order. It has not queried the purported impacts the Suspension Solution will have on TikTok’s critical business processes if fully implemented, but has queried whether, in fact, full implementation would be required if, for instance, the appeal was determined in TikTok’s favour before the end of the Suspension Period. It has, through Mr Wallace’s affidavit, queried the calculation of estimated losses/costs. In oral submissions, it was also suggested that the any cost that TikTok might incur in implementing the Suspension Solution might be offset by savings in further implementation of Project Clover measures, the estimated cost of which dwarfs even the cost of the Suspension Solution.

197. It is worth observing that conflicting evidence has been presented by the parties in this case. The DPC has not sought to cross-examine TikTok’s witnesses (nor has TikTok sought to cross-examine the DPC’s). In light of the decision in RAS Medical Ltd v The Royal College of Surgeons in Ireland [2019] 1 IR 63, [2019] IESC 4, a question arises as to how the court should approach the evidence. As McDonald J noted in the Eircom case, the Supreme Court has determined that cross-examination, save in exceptional cases, is not appropriate in an interlocutory application (see, IBB Internet Services v Motorola [2013] IESC 53). McDonald J concluded, therefore, that:

“41. I must, therefore, do the best I can on the basis of the affidavits presented. And I must, for example, reach a conclusion as to whether Eircom has established on the evidence that it will be exposed to serious and irreparable harm if a stay is not granted.

Since that is an issue that I am required to consider and since the onus of proof lies on Eircom in this regard, I believe that ComReg and the Notice Parties must be entitled to comment adversely on the quality of the evidence put forward by Eircom. In my view, they do not have to seek to cross-examine in order to do so. That said, the fact that cross-examination is not available at this interlocutory stage means that they cannot readily undermine evidence which is plausible on its face.”

198. Accordingly, I must likewise do the best I can on the basis of the affidavit evidence presented.

199. Notwithstanding the queries raised by the DPC, I am satisfied that TikTok has established a probability that it will incur very significant costs if required to implement the Suspension Solution. The evidence presented is robust. On the technical front, the in-house evidence of Ms Huang is supported by the expert evidence of Professor Pietzuch and Professor Todri. Mr Xu’s financial projections are endorsed in Mr Jacobs’s Report. Though Mr Wallace has queried some of the methodology, TikTok has sought to address his queries in its replying affidavits. Mr Wallace’s analysis does not, therefore, serve to undermine the detailed evidence of TikTok.

200. Nor have the doubts expressed by the DPC, regarding the extent to which the Suspension Solution may have to be implemented pending the hearing of TikTok’s appeal, or any potential savings which might be achieved in the implementation of Project Clover, been sufficiently explored by the DPC in its evidence to lead me to reject TikTok’s evidence.

201. In truth, the DPC’s main argument was not that TikTok would not incur significant costs

– though the precise scale of those costs was disputed – rather, it argued that any loss suffered was purely financial, and, therefore, compensatable in damages. TikTok’s evidence was significantly more detailed than, for instance, the evidence relied on in Case C-639/23 P(R) Amazon Services Europe Sàrl v European Commission, a decision discussed below in more detail, which did not prevent a finding of irreparable harm in that case (though the stay was refused on other grounds). I am satisfied, therefore, that TikTok has established to the requisite standard that it will suffer significant financial loss if required to give effect to the Suspension Order pending the hearing of its appeal.

202. Is there any loss which it will suffer which is not financial? TikTok, in particular in Ms Huang’s affidavit, identifies certain non-pecuniary loss which she says TikTok will suffer. These include loss of institutional knowledge and expertise, irreversible harm to CGE personnel and their families, whether by their relocation or being made redundant. Mr Jacobs refers to loss of goodwill and market value.

203. Regarding the impact on CGE personnel and their families, this cannot be regarded as a loss to TikTok for the purpose of considering whether it will suffer harm. It may, however, be relevant in the balancing of interests.

204. The loss of institutional knowledge and expertise is undoubtedly a loss to TikTok, but in my view, it should properly be regarded as a pecuniary loss, since its impact is on the value of TikTok’s business. Similarly, other purportedly non-pecuniary losses, including damage to TikTok’s brand, or its competitiveness must also be regarded as financial or pecuniary.

205. However, the classification of these losses as financial or pecuniary does not mean that damages are an adequate remedy, or that the losses should not be regarded as serious and irreparable.

206. First, a question arises as to whether damages would be recoverable at all if TikTok incurred losses and ultimately succeeded in its appeal. Although the DPC argue that Francovich damages are recoverable, the reality of that as a proposition must be open to doubt for a variety of reasons.

207. TikTok refers to the fact that the DPC has immunity from suit, per section 154 of the 2018 Act, and argues that damages are, therefore, not available. Without determining the issue, there must be a question over whether an emanation of the State could rely on a statutory immunity to defeat a claim for Francovich damages. Accordingly, I don’t propose treating the remedy as unavailable by reference to section 154. This does, however, highlight one hurdle which any party would have to overcome if seeking to recover damages in the event of a successful appeal against a decision of the DPC. In circumstances where TikTok’s appeal is not confined to EU law issues, it is entirely possible that Francovich damages would not, in any event, be available if it succeeds in its appeal: it may depend on which grounds of appeal prove successful.

208. Difficulty in recovering Francovich damages has been recognised by the Court of Appeal, in Word Perfect Translation Services, as a basis for concluding that Francovich damages are not an adequate remedy. Given the scale of the potential losses which may be suffered by TikTok, I am quite satisfied that a hypothetical remedy in damages is not an adequate remedy for TikTok in this instance.

209. That conclusion can be reached even without considering the difficulty which would likely arise in seeking to calculate TikTok’s losses. In Curust Financial Services Ltd v Loewe-Lack-Werk [1994] 1 IR 450, the Supreme Court (Finlay CJ), concluded in relation to the adequacy of damages (at p. 469):

“Difficulty, as distinct from complete impossibility, in the assessment of such damages should not, in my view, be a ground for characterising the awarding of damages as an inadequate remedy.”

210. The Court referred to there being no “insuperable difficulties” in calculating damages, characterising it as a matter of calculating the value of market share in a “stable and wellestablished” market, the sale and distribution of rust primers. In this case, the calculation of damage which might be suffered by TikTok across a whole range of categories not encompassed by their calculations of projected losses, would face such insuperable difficulties that it must be regarded as virtually impossible. In Mr Wallace’s affidavit, he refers to the lack of benchmarking of TikTok’s estimated losses, and Mr Jacobs explains that there is no benchmarking because the type of disruption envisaged has never occurred within the industry. This serves to highlight the impossibility of capturing all the losses which TikTok might suffer in an entirely dynamic market, as far removed from the rust primer market at issue in Curust as it is possible to conceive.

211. For completeness, it seems to me that in light of the decision in the Amazon case referred to above, the same difficulty in calculating damages would lead to a conclusion that TikTok would suffer serious and irreparable harm, i.e. the urgency test would be met.

212. At issue in Amazon was the designation of Amazon as a very large online platform pursuant to Regulation (EU) 2022/2065 (the Digital Services Act). Such a designation imposed an obligation on Amazon to provide an “opt out” (Article 38), and an obligation to make publicly available, through a reliable and searchable tool, a repository containing detailed information regarding all advertisements on the platform (Article 39). Amazon challenged its designation as a very large online platform and sought a stay on the obligations imposed on it by that designation.

213. There were obvious similarities to the instant case. The scale of losses predicted was of a similar order, although the evidence substantiating that loss seems to have been considerably weaker than here. As here, it was not suggested that Amazon’s financial viability would be imperilled. Nonetheless, the Court was satisfied that the damage to Amazon, if it were required to comply with the requirements of Article 39, constituted serious and irremediable harm such as to satisfy the urgency test:

“132 As regards the irreparable nature of that damage, it should be borne in mind that, admittedly, damage of a financial nature cannot, otherwise than in exceptional circumstances, be regarded as irreparable since, as a general rule, pecuniary compensation is capable of restoring the aggrieved person to the situation that obtained before he, she or it suffered the damage. That is however not the case, and such damage can then be deemed to be irreparable, if it cannot be quantified (order of the Vice- President of the Court of Justice of 2 March 2016, Evonik Degussa v Commission, C-162/15 P-R, EU:C:2016:142, paragraph 92 and the case-law cited).

133 However, the uncertainty linked to reparation for harm of a pecuniary nature in a possible action for damages cannot be regarded, in itself, as a circumstance capable of establishing that such a harm is irreparable, for the purposes of the case-law of the Court. At the stage of seeking interim relief, the possibility of subsequently obtaining compensation for pecuniary damage, if an action for damages is brought following annulment of the contested measure, is necessarily uncertain. Interlocutory proceedings are not intended to act as a substitute for an action for damages in order to remove that uncertainty, since their purpose is only to guarantee the full effectiveness of the final future decision that will be made in the main action, in this case an action for annulment, to which the interlocutory proceedings are an adjunct (see, to that effect, order of the Vice-President of the Court of Justice of 2 March 2016, Evonik Degussa v Commission, C-162/15 P-R, EU:C:2016:142, paragraph 93 and the caselaw cited).

134 On the other hand, the situation is different where it is already clear, when the assessment is carried out by the judge hearing the application for interim measures, that, in view of its nature and the manner in which it will foreseeably occur, the harm alleged, should it occur, may not be adequately identified or quantified and that, in practice, it will not therefore be possible to make good that harm by bringing an action for damages. That may be the case, inter alia, in a situation involving the publication of specific and confidential commercial information (see, to that effect, order of the

Vice-President of the Court of Justice of 2 March 2016, Evonik Degussa v Commission, C-162/15 P-R, EU:C:2016:142, paragraph 94 and the caselaw cited).”

214. The uncertainty was sufficient to demonstrate to the court that the pecuniary damage alleged is irreparable.

215. Although the uncertainty arises for different reasons here, the quantification of damage is no more straightforward, for the reasons outlined above. Accordingly, even if the applicable threshold were a risk of serious and irremediable harm, on the evidence available, that threshold would be met.

Least risk of injustice /EU Interests test

216. It bears emphasising that no injustice will have been done to TikTok by reason of it having to implement the Decision, and in particular, the Suspension Order pending the determination of its appeal, if the appeal ultimately fails. TikTok made various arguments about the unfairness of it being subject to restrictions which have not been applied to its competitors, but no weight can be attached to those concerns. All data controllers are required to comply with the same rules, TikTok cannot be heard to complain if those rules have a more significant impact on it, because of the manner in which its business is structured, than on its competitors. Or rather, its complaint must be pursued in the legislative rather than the judicial sphere.

217. The potential injustice which must be weighed in the balance, is the potential injustice of being required to comply with a decision which is subsequently proved invalid. This must be weighed against the injustice which might result if TikTok avoided, or delayed, complying with a decision, whose validity is upheld.

218. In Okunade, the Supreme Court indicated that all appropriate weight should be given to the importance of decisions which are presumptively valid being implemented. In Krikke v Barranafaddock Sustainability Electricity Limited [2020] IESC 42, the Court again emphasised the importance of giving appropriate weight to valid measures. In that case, what was at issue was the orderly operation of the planning code, described by O’Donnell J (as he then was) as being “of high public importance”.

219. That requirement is of particular significance in this case where, what is at issue is a risk to fundamental rights. This consideration must, accordingly, be given very considerable weight, indeed, the DPC argues that it is decisive. In this regard, as noted above, the DPC refers to Schrems II and the CJEU’s conclusion that a supervisory authority must suspend transfers where it determines that there has been a breach of GDPR.

220. Notwithstanding the cogent arguments by the DPC that, in effect, the risk to fundamental rights trumps any risk of injustice to TikTok, this application cannot simply be resolved by an invocation of such rights. Were it the case that the engagement of fundamental rights by a decision necessarily defeated any private interest which might be asserted, and was treated as decisive in all cases, this would negate the balancing exercise mandated by national, and indeed Union law, rendering a stay unavailable, undermining the potential effectiveness of remedy.

221. There are a variety of factors in this case which point to a conclusion that the least risk of injustice would be served by a limited stay on the Suspension Order, subject to certain conditions.

222. The first consideration is the length of stay which is required to avoid the most immediate risk of injustice. The Decision provides a period of six months before the Suspension Order comes into effect. As a consequence of the temporary stay which was granted when these proceedings were entered into the Commercial List, that period would expire towards the end of March 2026 if I refused to continue the stay. However, the parties have advised that the substantive proceedings should be in a position to be heard in March of next year, subject perhaps to developments in other proceedings. This can certainly be accommodated by the court, indeed an earlier hearing might be possible. In other words, the appeal could well have been heard before the Suspension Order takes effect. If this application were framed as an application for a stay pending the delivery of judgment in the appeal, could it seriously be doubted that the least risk of injustice would require refusal of the stay? I think not.

223. Of course, matters are not so straightforward. There may be delays in getting the matter to hearing, and I acknowledge that the DPC has indicated certain concerns in that regard. TikTok will be required to take steps in advance of the Suspension Order taking effect and does not, therefore, have the full benefit of that six month implementation period before it must take potentially irreversible steps. Given the multiplicity of issues raised in the appeal, a judgment may not immediately be available. Any delay by TikTok could be addressed by way of conditions attached to a stay, and any judge hearing the appeal will no doubt be keenly aware of the importance of delivering a timely judgment where there may be an ongoing risk to fundamental rights, something which they will be in a better position to assess having heard the appeal. In any event, the timing of this application and of the Suspension Order suggests that a grant of a stay pending determination of the appeal by this court may result in a very limited interference with the orderly implementation of a measure which is prima facie valid.

224. A related consideration is the period of time over which the Inquiry took place, and the additional time which the Decision afforded TikTok for compliance. Without in any way wishing to suggest that the DPC delayed in progressing the Inquiry, especially having regard to the number of occasions on which it afforded TikTok an opportunity to provide further information, it is reasonable to infer that the risks involved were not regarded by the DPC as requiring greater urgency. The urgency procedure under Article 66 of the GDPR was not utilised. It was explained by counsel at the hearing that that procedure is only used in truly exceptional cases, but, accepting that to be so, it is clear, at least, that this case is not that. It is reasonable to conclude that a short further delay pending the determination of these proceedings does not greatly increase the risk that TikTok’s failure to comply with Article

46 poses.

225. A further consideration is the particular nature of the finding by the DPC in this case. The DPC has not concluded that the personal data at issue in these proceedings isn’t subject to equivalent protection in China to that it would enjoy in the EU, rather that TikTok has failed to discharge its obligations to establish that it is subject to such protections: what I characterised as a negative rather than a positive finding earlier in the judgment. Moreover, it is not the case that there are no protections in place, or no effort to afford protections by TikTok.

226. Relatedly, it is important to note the temporal scope of the Inquiry, as determined by the DPC. The finding that TikTok has failed to satisfy the requirements of Article 46 is limited to a period concluding in May 2023. There is no finding that there is a current breach of Article 46. That is not to suggest that I have concluded that it is impermissible for the DPC to impose a Suspension Order on the basis of a finding of breach of the GDPR which has a particular temporal scope. In this regard, I note the DPC’s argument that were it otherwise, there would be never-ending investigations, with data controllers constantly being afforded further opportunities to update their evidence to the DPC.

227. In this case, the DPC contends that it had regard to all the information provided by TikTok about the changes it had made subsequent to the DPC issuing the PDD, i.e. outside the temporal scope of the Inquiry. The DPC concluded that the Suspension Order was still necessary. Of course, TikTok has appealed that finding, and its lawfulness, but it remains a presumptively valid measure to which I must afford all appropriate weight.

228. However, it is, in my view, legitimate to distinguish between the findings made here and a finding such as that discussed in Schrems II (at [111]), i.e. that the data being transferred is not afforded an adequate level of protection, in assessing the risk of injustice which might be occasioned if a stay were granted, that is, the risk of fundamental rights being harmed.

229. In that regard, TikTok has provided detailed evidence that there is, in fact, no risk, having regard to the Project Clover measures put in place, and the type of data involved, and have adduced evidence from Chinese law experts, seeking to confirm that that is the case. It has led uncontested evidence that no Chinese authority has ever sought to access TikTok’s EEA user data.

230. On the other side, the DPC has adduced its own Chinese law evidence, and has referred to the ‘OnCall’ incident to highlight that its concerns are not merely hypothetical. The DPC has very fairly acknowledged that there is uncertainty about the risks involved, though it is clear from the Decision that the risk of concern is of Chinese authorities accessing personal data remotely accessed by CGE personnel in China, pursuant to the relevant Chinese laws (what the DPC calls ‘the problematic laws’).

231. It would be inappropriate in the context of an interlocutory application, to express any view on the Chinese law issue by reference to affidavits which may or may not be admissible in the substantive proceedings. It is possible, however, while giving all due weight to the

decision, to conclude on the basis of the evidence in this application that, even assuming the validity of the DPC’s decision, the risk to EEA user data during the period of any required stay does not appear to be significant.

232. A stay poses no risk to the orderly implementation of the GDPR regime, or to the implementation of the Decision in due course. The main risk in granting a stay is that any data which is remotely accessed in China may or will not have an equivalent level of protection to that afforded it in the EU, and, as a consequence, that data may be processed in breach of the requirements of the GDPR, and fundamental rights will be infringed. As noted above, this is a weighty consideration.

233. The DPC relies on the decision in Amazon where, notwithstanding a finding of serious and irreparable harm, the CJEU refused a stay because of the EU interest in giving effect to the Digital Services Act. Just as the balancing exercise in that case favoured refusal of a stay, it argues that a stay should be refused here, whether applying the Zuckerfabrik criteria, or the test in Okunade.

234. Though Amazon clearly illustrates the weight to be given to EU interests in carrying out a balancing exercise, in my view, the subject matter of those proceedings and of these are sufficiently different, such that it would not be appropriate to treat the Amazon decision as determinative of these proceedings.

235. What was at issue in Amazon was a decision of the European Commission on a central feature of landmark legislation, the Digital Services Act. A failure to give effect to the

decision would, in the Court’s view “lead to a delay, potentially for several years, in the full achievement of [the] objectives” of that Act. What is at issue here could not plausibly be considered to have such a profound effect. There is nothing in these proceedings, or in a grant of a stay, which would affect the operation of the GDPR generally. It involves a single

decision of a supervising authority. True, it is a decision of which all other SACs have been notified, because of the scope of TikTok’s cross-border activities, and none have objected. That adds something to the weight which it should be afforded. But however the other SAC’s acceptance of the DPC’s decision is characterised, it remains a single decision pursuant to the GDPR, which regulation will remain in full force and effect irrespective of these proceedings.

236. It is also relevant, in this instance, to consider the persons potentially affected by a stay. In Amazon, those affected were, in effect, every person affected by the Digital Services Act. In this case, the group effected is confined to TikTok’s users. This, of course, remains a very significant group, with over 159 million monthly users of TikTok’s platform across the EEA. Moreover, the evidence is that they are typically younger users, the protection of whose rights interests requires particular care.

237. TikTok, in fact, argues that the court should have regard to how those users will be negatively affected if the Suspension Order is put in place, due to the deterioration in the

service provided by TikTok. Put otherwise, it is in the interests of the very people whose fundamental rights are at risk if the Suspension Order is stayed that that risk be continued.

238. As appears from the second infringement finding in the Decision, the finding that there was a failure to notify users of the nature of the transfers up to 1 December 2022, the DPC was satisfied, by reference to TikTok’s December 2022 EEA Privacy Policy that, after that date, TikTok’s users were notified of the data transfers thereafter. As recorded at paragraph

604 of the Decisions:

“The December 2022 EEA Privacy Policy also informed EEA users that personal data was stored on servers in the United States and Singapore, and was the subject of limited remote access by entities in TikTok’s corporate group located in Brazil, China, Malaysia, Philippines, Singapore and the United States.”

239. That must, I think, have some bearing on the extent to which it is necessary to refuse a short stay in order to protect the fundamental rights of TikTok’s users.

240. What is not clear, is whether the users have been advised of the DPC’s findings against TikTok, in particular, that it has not complied with Article 46 in relation to the transfers. I can find no reference to such a notification in the papers. Of course, mere notification could not suffice to render lawful a cross-border transfer of personal data which would otherwise be unlawful. Express and informed consent to the transfer is required, per Article 49(1) of the GDPR, to achieve that. However, in my view, any concern about the limited short-term risk to TikTok users’ fundamental rights would be somewhat ameliorated if their continued engagement with the platform was on an informed basis about the issues identified by the DPC (including the fact that TikTok has appealed the DPC’s findings).

241. In light of all of the above, it seems to me that the grant of a stay on the Suspension Order, subject to certain conditions discussed below, gives rise to the least risk of injustice per Okunade.

242. Although not strictly necessary for me to decide, I also consider that, though no doubt more finely balanced than on an application of the Okunade principles, TikTok would have satisfied the EU interests test had it been applicable. TikTok has a much stronger claim for interim relief in this instance than did Amazon in its proceedings under the Digital Services Act. In that case, the asserted loss was speculative and not substantiated by detailed evidence. More importantly, in Amazon, the EU interests ‘in play’ were certain to be adversely affected during the period of any stay. Here, the evidence of loss is robust. The possibility of harm to fundamental rights is far from certain. Accordingly, the serious and irremediable harm which TikTok will suffer if the Decision is ultimately found to be invalid, outweighs the limited risk to EU interests if there is a short delay in implementation of the Suspension Order, on the basis of the conditions proposed.

Conclusion

243. The appropriate test in determining whether to grant a stay on the implementation of the Suspension Order and the Corrective Order is the test in Okunade.

244. In circumstances where the DPC accepts that there is a serious issue to be tried, the objective of the court is to seek to ensure the least risk of injustice pending the hearing of this appeal.

245. I am satisfied on the evidence that TikTok will suffer significant damage if required to implement the Suspension and Corrective Orders in advance of its appeal being heard. I am further satisfied that although the damage can, broadly speaking, be characterised as pecuniary or financial, having regard to the scale of the damage which it will suffer, the near impossibility of quantifying the loss, and the limited prospect of TikTok ever being able to recover that loss if successful in its appeal, damages could not be regarded as an adequate remedy.

246. Although any delay in implementing the Decision does carry a risk to fundamental rights, which weighs heavily in the balance, the evidence suggests that that risk is limited and will be temporary. There is no risk to the implementation of the GDPR more generally if a stay is granted.

247. In the circumstances, and subject to the imposition of conditions, the granting of a stay in this instance creates the least risk of injustice.

248. If, contrary to what I have concluded above, the appropriate threshold for the grant of a stay was that set out in Zuckerfabrik, the same result would be achieved. TikTok will suffer serious and irremediable harm if no stay is granted. Although the EU interests engaged involve a risk to fundamental rights, having regard to the extent of that risk, and the extent of the possible loss to TikTok, it is appropriate to stay the implementation of the Suspension and Corrective Orders, subject to conditions.

249. Those conditions flow from what has been discussed previously. First, the stay should be for the shortest period possible. I therefore propose granting a stay pending the determination of the appeal in this court on the basis of an undertaking by TikTok to prosecute its appeal with all reasonable diligence and, in any event, to ensure, insofar as it is within TikTok’s power to do so, that the appeal is heard not later than March 2026.

250. Second, TikTok will be required, insofar as it has not already done so, to notify, in a manner to be agreed, or in default as directed by this Court, all its users of the DPC’s decision in clear and easily understood language. Any such notification may also refer to TikTok’s appeal and to the stay now being granted.

251. Both parties shall have liberty to apply in relation to the continuation of the stay.

252. As previously indicated, the proceedings will be listed on 14 November 2025 at 11 am to address any consequential orders.