IEHC 419 — IEHC 419 — High Court

APPROVED [2026] IEHC 419

THE HIGH COURT

COMMERCIAL

Record No.: 2025/248 MCA

IN THE MATTER OF SECTION 142 AND SECTION 150

OF THE DATA PROTECTION ACT 2018

Between:

TIKTOK TECHNOLOGY LIMITED and TIKTOK INFORMATION TECHNOLOGIES UK LIMITED

Applicants

And

DATA PROTECTION COMMISSION

Respondent

JUDGMENT of Mr Justice Rory Mulcahy delivered on 30 June 2026

CONTENTS

Introduction ............................................................................................................................................. 3 The GDPR............................................................................................................................................... 4 The Inquiry.............................................................................................................................................. 6 The Decision ......................................................................................................................................... 15 Applicable case law .............................................................................................................................. 17 The WhatsApp proceedings................................................................................................................... 23 The GDPR Fining Guidelines ............................................................................................................... 28 Scope of the appeal ............................................................................................................................... 29 Ground 7 – Errors in having regard to the turnover of ByteDance ....................................................... 31 Error in determining fining caps ....................................................................................................... 31 Arguments ..................................................................................................................................... 31

1 Discussion ..................................................................................................................................... 37 Error in determining the preceding financial year ............................................................................ 41 Arguments ..................................................................................................................................... 41 Discussion ..................................................................................................................................... 42 Error in determining that ByteDance exercised decisive influence over TikTok.............................. 45 Arguments ..................................................................................................................................... 45 Discussion ..................................................................................................................................... 46 Error in having regard to turnover of ByteDance in calculating the amount of the fines ................. 47 Arguments ..................................................................................................................................... 48 Discussion ..................................................................................................................................... 51 Error in having regard to worldwide turnover .................................................................................. 53 Ground 9 – Errors in interpretation of Article 83.................................................................................. 53 Error in treatment of Article 83(2) criteria ........................................................................................ 55 Arguments ..................................................................................................................................... 55 Discussion ..................................................................................................................................... 56 Failure to determine whether compliance with Article 83(1) ........................................................... 61 Arguments ..................................................................................................................................... 61 Discussion ..................................................................................................................................... 62 Misinterpretation of Article 83(3) ..................................................................................................... 63 Arguments ..................................................................................................................................... 64 Discussion ..................................................................................................................................... 64 Ground 8 – Failure to give reasons for the fining decision ................................................................... 65 Arguments ..................................................................................................................................... 66 Discussion ..................................................................................................................................... 68 Summary of conclusions ....................................................................................................................... 69 Proposed questions to be referred to the CJEU for determination pursuant to Article 267 of the TFEU .............................................................................................................................................................. 71 Conclusion ............................................................................................................................................ 72

2 Introduction

1. On 3 June 2026, I delivered judgment on the majority of the grounds of appeal advanced by TikTok in this appeal, [2026] IEHC 347 (“the main judgment”). As set out at §17 and §18 of that judgment, I left over certain issues concerning the manner in which the DPC had calculated the administrative fines which it had imposed on TikTok for this further judgment in circumstances where it appeared that certain questions of law might arise which required to be referred to the CJEU for determination in accordance with Article 267 of the TFEU. This judgment should be read together with the main judgment. The terminology in this judgment mirrors that used in that judgment.

2. To recap, in the main judgment, I concluded that the DPC had not erred in law in its assessment of whether TikTok had infringed the provisions of Article 46 and 13(1)(f) of the GDPR. I concluded further that there was no basis for the court to interfere with the DPC’s findings that TikTok had infringed the GDPR during the temporal scope of the Inquiry, 29 July 2020 to 17 May 2023. Finally, I concluded that the DPC was correct to conclude that the infringements were negligent in character and that, accordingly, it was entitled to impose administrative fines pursuant to Article 58(2)(i) of the GDPR in accordance with the provisions of Article 83 thereof.

3. TikTok’s remaining grounds of appeal, Grounds 7, 8 and 9, all concern the interpretation and application of Article 83 of the GDPR and how the fines were calculated by the DPC. They are summarised at §527 of the main judgment as follows:

• The DPC impermissibly had regard to the turnover of ByteDance in determining the fining caps and the amount of the actual fines (Ground 7); • The DPC failed to provide adequate reasons for the fining decision (Ground 8); and • The DPC made errors of fact in its interpretation and application of Article 83 (Ground 9).

4. As noted in the main judgment, the parties have either agreed the terms of questions which should be referred to the CJEU in respect of these grounds, or, in the absence of agreement, each proposes questions which might usefully be referred.

3 The GDPR

5. Recital 150 of the GDPR provides:

In order to strengthen and harmonise administrative penalties for infringements of this Regulation, each supervisory authority should have the power to impose administrative fines. This Regulation should indicate infringements and the upper limit and criteria for setting the related administrative fines, which should be determined by the competent supervisory authority in each individual case, taking into account all relevant circumstances of the specific situation, with due regard in particular to the nature, gravity and duration of the infringement and of its consequences and the measures taken to ensure compliance with the obligations under this Regulation and to prevent or mitigate the consequences of the infringement. Where administrative fines are imposed on an undertaking, an undertaking should be understood to be an undertaking in accordance with Articles 101 and 102 TFEU for those purposes. Where administrative fines are imposed on persons that are not an undertaking, the supervisory authority should take account of the general level of income in the Member State as well as the economic situation of the person in considering the appropriate amount of the fine. The consistency mechanism may also be used to promote a consistent application of administrative fines. It should be for the Member States to determine whether and to which extent public authorities should be subject to administrative fines. Imposing an administrative fine or giving a warning does not affect the application of other powers of the supervisory authorities or of other penalties under this Regulation.

6. The power to impose administrative fines is contained in Article 58(2)(i) of the GDPR. The conditions for so doing are contained in Article 83. Although the terms of Article 83 are set out in the main judgment, it is convenient to set out the relevant provisions for the purpose of this judgment here:

4 Article 83 General conditions for imposing administrative fines

1. Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive. 2. Administrative fines shall, depending on the circumstances of each individual case, be imposed in addition to, or instead of, measures referred to in points (a) to (h) and (j) of Article 58(2). When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following: a. the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them; b. the intentional or negligent character of the infringement; c. any action taken by the controller or processor to mitigate the damage suffered by data subjects; d. the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them pursuant to Articles 25 and 32; e. any relevant previous infringements by the controller or processor; f. the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement; g. the categories of personal data affected by the infringement; h. the manner in which the infringement became known to the supervisory authority, in particular whether, and if so to what extent, the controller or processor notified the infringement; i. where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned with regard to the same subject-matter, compliance with those measures; j. adherence to approved codes of conduct pursuant to Article 40 or approved certification mechanisms pursuant to Article 42; and 5 k. any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement. 3. If a controller or processor intentionally or negligently, for the same or linked processing operations, infringes several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount specified for the gravest infringement. 4. … 5. Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher: a. … b. the data subjects’ rights pursuant to Articles 12 to 22; c. the transfers of personal data to a recipient in a third country or an international organisation pursuant to Articles 44 to 49; d. … e. … 6. … 7. … 8. The exercise by the supervisory authority of its powers under this Article shall be subject to appropriate procedural safeguards in accordance with Union and Member State law, including effective judicial remedy and due process.

7. As we will see, the remaining grounds of appeal give rise to issues concerning the interpretation and application of Articles 83(1), 83(2), 83(3) and 83(5).

The Inquiry

8. The history of the Inquiry is summarised in detail in the main judgment. I will highlight here additional aspects of the Inquiry relevant to the issues in this judgment.

6 9. Shortly prior to issuing the PDD, on 26 April 2023, the DPC wrote to TikTok to set out its understanding of the concept of ‘undertaking’ and how it applied in the application of Article 83. The letter stated that:

In the context of the GDPR, the application of the concept of ‘undertaking’ means that, while a finding of infringement will be made as against the respondent data controller or processor, any consequent fine must be imposed on the ‘undertaking’ concerned. This means that, in a case where there is another entity, such as a parent company, that is in a position to exercise decisive influence over the controller/processor’s behaviour on the market then both parent and subsidiary will together constitute a single economic entity and a single undertaking. Consequently, the relevant fining “cap”, for the purpose of Articles 83(4) and (5) will be calculated by reference to the turnover of the undertaking as a whole, rather than the turnover of the respondent data controller or processor. As set out above, such an outcome does not involve, or necessitate the making of, any finding that the parent company was directly involved in the conduct giving rise to the finding of infringement.

10. The letter set out the DPC’s understanding that:

- TikTok Ireland is a wholly owned subsidiary of TikTok Information Technologies UK Limited; - TikTok Information Technologies UK Limited is ultimately owned and controlled by Bytedance Ltd.; and - As regards any intermediary companies in the corporate chain, between TikTok Ireland and Bytedance Ltd., that Bytedance Ltd. is in a similar situation to that of a sole owner as regards its power to (directly or indirectly) exercise a decisive influence over the conduct of TikTok Ireland.

11. Accordingly, the letter stated, a rebuttable presumption might arise that ByteDance exercised decisive influence over TikTok and the fining cap would therefore be calculated by reference to the combined turnover of ByteDance and TikTok. The letter invited TikTok to respond and asked it to bring the letter to the attention of its parent and to include in its response any matter which the parent believed to be relevant.

7 12. TikTok replied by letter dated 12 May 2023, disputing the DPC’s assessment.

13. It first took issue with a suggestion in the DPC’s letter that fines should be imposed on undertakings, noting that fines can only be imposed on controllers and processors. Next, it disputed the DPC’s interpretation of the concept of undertaking:

The concept of “undertaking”, as used in Articles 101 and 102 TFEU, refers to a person engaged in an economic activity, regardless of its legal status and the way it is financed. The cross-reference to Articles 101 and 102 TFEU in Recital 150 GDPR does not import the concepts of the “single economic entity” or “decisive control” (or permit the DPC to impose an administrative fine on anyone other than the relevant controller or processor). Consequently, “undertaking” should not be interpreted under Articles 83(4) to (6) GDPR by reference to these concepts.

14. As discussed below, this argument has fallen away in light of subsequent decisions of the CJEU.

15. TikTok’s response also contended that, even if Articles 83(4) to (6) should be interpreted by reference to the concepts of ‘single economic entity’ and ‘decisive influence’,

ByteDance Ltd. is a Cayman Island entity which is not involved in the operation of the TikTok platform, but is instead a holding company which has ownership interests in a diverse range of businesses. TikTok is just one of the numerous business lines in which ByteDance Ltd. has ownership interests.

16. The response did not dispute the factual matters relied on by the DPC set out at §10 above. TikTok argued, however, that it was not permissible to have regard to the turnover of a parent without making a finding that the parent is jointly and severally liable for the infringement in respect of which the administrative fine is to be imposed. It referred to EDPB Decision 01/2021 concerning a dispute over the DPC’s draft decision following an inquiry into WhatsApp (“the WhatsApp Decision”) in support of this proposition, which decision is discussed below. Moreover, TikTok argued, the turnover of the parent could only be relevant to the fining cap and not to the calculation of the actual fine.

8 17. Finally, the letter stated that it was “inappropriate” to ask TikTok to bring these matters to the attention of its parent and that this did not “equate to the provision of a right to be heard and a right of defence to those entities in the manner required by EU law”. The response did confirm, however, that TikTok had brought the DPC’s letter to the attention of the second applicant, TikTok Information Technologies UK Ltd (“TikTok UK”), which held a 100% shareholding in the first applicant, TikTok, to TikTok Limited (Cayman) (“TikTok Cayman”) which held a 100% shareholding in TikTok UK, and to ByteDance, which held a 100% shareholding in TikTok Cayman. It provided a corporate structure chart which confirmed these shareholdings.

18. The PDD issued on 17 May 2023. The question of whether to impose administrative fines, and what fines to impose, was addressed at §463 - §538. At §469 - §503 of the PDD, the DPC considered each of the factors set out in Article 83(2). Notably, in relation to Article 83(2)(k), the PDD suggested that the DPC had had regard to the turnover of ByteDance in its assessment of the Article 83(2) criteria (at §502):

Under this heading, I note the EDPB’s view, as set out in its binding decision 1/2021, that the turnover of the undertaking concerned ought to be taken into account not just for the calculation of the applicable fining “cap” but also for the purpose of assessing the quantum of the administrative fine itself. This position is further reflected in the Fining Guidelines 04/2022 (see, for example, paragraph 49 thereof). The DPC’s assessment of the undertaking concerned and the applicable turnover figure is detailed further below. While this is not a matter that can properly be classified as either mitigating or aggravating, by reference to the circumstances of the case, the DPC has taken the significant turnover of the undertaking concerned into account when determining the quantum of the proposed fine, as set out below.

19. Under a heading ‘Decision on whether to impose administrative fines’, the PDD then provides as follows:

504. In deciding whether to impose an administrative fine in respect of each infringement, I have had regard to the factors outlined in Article 83(2)(a) – (k) cumulatively, as set out above. However, I have considered each of the distinct infringements separately when applying those factors, when deciding whether to

9 impose an administrative fine, and when deciding the amount of each administrative fine. I have also had regard to the effect of the orders in ensuring compliance with the GDPR. The orders will assist in ensuring compliance by mandating specific action on the part of TikTok Ireland in order to re-establish compliance with specific findings of infringements. However, I consider that these measures alone are not sufficient in the circumstances to ensure compliance. I find that administrative fines in respect of each of the infringements are appropriate, necessary and proportionate in view of ensuring compliance with the GDPR.

505. In order to ensure compliance with the GDPR, it is necessary to dissuade non- compliance. Depending on the circumstances of each individual case, dissuading non- compliance can entail dissuading the entity concerned with the corrective measures, or dissuading other entities carrying out similar processing operations, or both. Where a serious infringement of the GDPR occurs, orders alone will not be sufficient to deter future non-compliance. In this regard, by imposing financial penalties, administrative fines are effective in dissuading non-compliance. This is recognised by the requirement in Article 83(1) for a fine, when imposed, to be effective, proportionate and dissuasive. Recital 148 of the GDPR acknowledges that, depending on the circumstances of each individual case, administrative fines may be appropriate in addition to, or instead of, orders and other corrective powers:

“In order to strengthen the enforcement of the rules of this Regulation, penalties, including administrative fines should be imposed for any infringement of this Regulation, in addition to, or instead of appropriate measures imposed by the supervisory authority pursuant to this Regulation. In a case of a minor infringement or if the fine likely to be imposed would constitute a disproportionate burden to a natural person, a reprimand may be issued instead of a fine.”

506. While the orders proposed in this Preliminary Draft Decision will re-establish compliance with the specific infringements identified, I do not consider this measure appropriate to deter other future serious infringements. I find that administrative fines are necessary in respect of each of the infringements to deter other future serious non- compliance on the part of TikTok Ireland and other controllers or processors carrying out similar processing operations. The reasons for this finding include:

10 (A) In coming to the conclusion that administrative fines are necessary, I have had particular regard to the nature, gravity and duration of the infringements. I have attached significant weight to these issues as aggravating factors. The duration of the infringements were lengthy and administrative fines are proportionate in terms of such infringements. In circumstances where a large number of data subjects were affected by the transfers and the lack of transparency, where the scope of the relevant processing was broad, and whereby those data subjects suffered a loss of control over their data, I consider that it is necessary, appropriate and proportionate to impose administrative fines in order to deter non-compliance.

(B) I also attach significant weight, as an aggravating factor, to the negligent nature of the infringements, as I consider that a sophisticated entity such as TikTok Ireland, ought to have known that its provision of information to data subjects fell short of the standards required, and the extent of its obligation to verify, guarantee and demonstrate that the supplementary measures and the SCCs are effective to ensure that the personal data of EEA users is afforded a level of protection essentially equivalent to that guaranteed within the EU, or in the alternative to end or suspend the transfers.

(C) I also attach significant weight as an aggravating factor to TikTok Ireland’s high degree of responsibility in light of the absence of appropriate technical and organisational measures implemented in pursuit of verifying, guaranteeing and demonstrating that the supplementary measures and the SCCs are effective in ensuring that the personal data of EEA users is afforded a level of protection essentially equivalent to that guaranteed within the EU. and in transparently providing the information required under Article 13(1)(f) GPPR. The absence of such measures is stark in light of the scope of the relevant processing.

(D) I also attach significant weight to the categories of personal data affected by the infringement. In light of the broad categories of personal data affected, and the sensitive nature of some of that data, I consider that administrative fines are necessary to deter non-compliance in respect of this type of data.

507. As set out above, I provisionally do not consider that there any mitigating factors relevant to this assessment.

11 508. For the reasons set out above, and having particular regard to the matters discussed under Article 83(2)(a)-(j) cumulatively, I consider it appropriate to impose administrative fines in respect of each of both of the infringements, in addition to the orders also imposed in this Preliminary Draft Decision. Based on the analysis I have set out above, I propose to impose the following administrative fines:

1) TikTok Ireland’s infringement of Article 46(1): a fine of between €450 million and €500 million; and

2) TikTok Ireland’s infringement of Article 13(1)(f): a fine of between €30 million and €50 million.

509. The total of this proposed range is between €480 million and €550 million.

510. In having determined the quantum of the fines proposed above, I have taken account of the requirement, set out in Article 83(1) GDPR, for fines imposed to be “effective, proportionate and dissuasive” in each individual case. My view is that, in order for any fine to be “effective” it must reflect the circumstances of the individual case. As outlined above, the infringements are all serious in nature and high in gravity. The infringements concern transfers of personal data to China in circumstances where TikTok Ireland failed to verify, guarantee and demonstrate that the supplementary measures and the SCCs are effective to ensure that the personal data of EEA users is afforded a level of protection essentially equivalent to that guaranteed within the EU. In order for a fine to be “dissuasive” it must dissuade both the controller or processor concerned as well as other controllers or processors carrying out similar processing operations from repeating the conduct concerned. I consider that the proposed ranges are dissuasive for both. As regards the requirement for any fine to be “proportionate” this requires me to adjust the quantum of any proposed fines to the minimum amount necessary to achieve the objectives pursued by the GDPR.

511. I am satisfied that the fines proposed above do not exceed what is necessary to enforce compliance with the GDPR taking into account number of data subjects affected, the unlawfulness of the transfers and the lack of transparency, the loss of control over personal data suffered by the data subjects, and the scope of the processing and categories of personal data affected by the infringements. I have also had regard to the turnover of ByteDance Ltd, as detailed below. I am satisfied that the fines above

12 would, if imposed on TikTok Ireland, be effective, proportionate and dissuasive, taking into account all of the circumstances of the Inquiry.

20. As indicated at §511 of the PDD, in calculating the fine, the DPC had had regard to the turnover of ByteDance in accordance with Article 83(5) of the GDPR. The reasons for this were explained at §518 to §538 of the PDD, the DPC noting that TikTok had not produced any evidence to rebut the presumption that ByteDance exercised decisive influence over it, or that it acts independently on the market. In the PDD, the DPC had regard to ByteDance’s turnover for the year ending 31 December 2022.

21. In addition, the PDD stated that it was interpreting Article 83(3) in line with the WhatsApp Decision, as permitting the cumulation of fines for different infringements, but subject to the total amount fined not being higher than the maximum which could have been imposed for the gravest offence. Accordingly, TikTok was liable for the full amount of both fines.

22. In its response to the PDD, TikTok advanced many of the arguments it pursues in this appeal. Its response includes a point-by-point rebuttal of the DPC’s assessment of the factors identified in Article 83(2) including a contention, which I rejected in the main judgment, that the infringements were not negligent in character. In addition, TikTok disputed the DPC’s treatment of certain factors, including the negligent character of the infringements, as aggravating factors. TikTok claimed that they should be treated as mitigating factors, or at least neutral. It disputed the DPC’s preliminary conclusion that the proposed fines are effective, proportionate and dissuasive. It contended that the DPC had failed to have regard to the harm to TikTok of implementing the proposed suspension order.

23. It also challenged the DPC’s interpretation of Article 83(3). It argues (at §574 of its response) that the meaning of the provision is clear, that “if there are several infringements for the same or linked processing operations, then the total fine imposed shall not exceed the amount of the fine specified for the gravest infringement.”

24. Finally, it disputed the DPC’s interpretation and application of Article 83(5), arguing that there was no basis for the DPC to have regard to the turnover of ByteDance when calculating the amount of the administrative fines.

13 25. The DPC issued the Draft Decision on 21 February 2025. The proposed administrative fines are addressed at §691 to §779 of the Draft Decision.

26. As with the PDD, the DPC considered the criteria in Article 83(2) first. It then considered the necessity for the fines to be effective, proportionate and dissuasive in accordance with Article 83(1). It proposed fines in the range €440 – €500 million for the infringement of Article 46(1), and of €30 – €50 million for the infringement of Article 13(1)(f), almost identical to the figures proposed in the PDD.

27. The Draft Decision then states that other provisions of Article 83 must be considered “with a view to ascertaining if there are any factors that might require the adjustment of the fines.” (at §754).

28. It first assessed Article 83(3) and the argument advanced by TikTok that this prevented aggregation or cumulation of fines, i.e. that Article 83(3) required that the total fine imposed must be no higher than the fine imposed for the most serious infringement. It again rejected this contention by reference to the WhatsApp Decision.

29. The DPC then considered Article 83(5) of the GDPR. It concluded that TikTok was part of the ByteDance group of companies. Having regard to the ownership of shareholdings of companies within the group, it concluded that there was a presumption of decisive influence by ByteDance over TikTok and that that presumption had not been rebutted by the evidence submitted by TikTok. It concluded, therefore, that the relevant figure for the purpose of Article 83(5) was the turnover of ByteDance. It noted the updated turnover figure provided by TikTok for the year end 2023. Since the proposed fines did not exceed 4% of that figure, it concluded that no adjustment was necessary.

30. By letter dated 25 March 2025, the DPC invited submissions from TikTok on the administrative fines to be imposed, making clear that the submissions “should be limited to the determination, by the DPC, of final fining amounts from within the fining ranges set out in the Draft Decision.”

31. On 11 April 2025, TikTok submitted a reply which, inter alia, made submissions on the amount of the administrative fines. The response, as had been requested, confined itself to addressing where in the fining range the administrative fines should be fixed. TikTok 14 contended, by reference to the criteria in Article 83(2) of the GDPR, that the fines should be fixed at the lower end of the fining range. It also contended that the fines should be at the lower end of the fining range in order to comply with Article 83(1) of the GDPR, i.e. to ensure that the fines were effective, proportionate and dissuasive.

The Decision

32. The assessment of whether to impose administrative fines and the calculation of those fines is dealt with at §718 - §829 of the Decision.

33. As with the PDD and the Draft Decision, the Decision commences with a consideration of the factors identified in Article 83(2).

34. Briefly, for present purposes, it concludes, in relation to Article 83(2)(a) that “the nature, gravity and duration of the infringements are aggravating factors and the DPC has attached significant weight to these issues as aggravating factors.” As part of that analysis, it concludes (at §727):

In assessing the level of damage suffered by the data subjects, the DPC has had regard to the loss of control suffered by them as a result of the infringements. By transferring users’ personal data to China in violation of Article 46(1) GDPR, TikTok Ireland denied users control over their personal data by transferring their personal data to a third country that does not provide a level of protection that is essentially equivalent to EU law, and for which, TikTok Ireland has not verified, guaranteed and demonstrated that the supplementary measures and the SCCs are effective to ensure that the personal data of EEA Users is afforded a level of protection essentially equivalent to that guaranteed within the EU. This also risked interferences with the fundamental rights and freedoms of data subjects.

35. As set out in the main judgment, it concludes in relation to Article 83(2)(b) that the infringements were negligent in character. It treats the negligence as an aggravating factor, concluding that TikTok was negligent “to a high degree” (at §744) in relation to the infringement of Article 46(1). It rejects TikTok’s submission that a finding of negligence rather than intention should be regarded as a mitigating or at least neutral factor.

15 36. It finds nothing aggravating or mitigating under Article 83(2)(c), action taken by the controller to mitigate the damage to data subjects. It treats Article 83(2)(d), the degree of responsibility of the controller for the infringements, as an aggravating factor in respect of both infringements.

37. The fact that there were no previous relevant infringements by TikTok, Article 83(2)(e), is not treated as an aggravating or mitigating factor. The DPC takes the same view in relation to Article 83(2)(f), the degree of cooperation, noting that although TikTok had “cooperated fully” with the Inquiry, this was required by law.

38. It considers that having regard to the categories of personal data affected by the infringement, Article 83(2)(g), this should be treated as an aggravating factor. None of Articles 83(2)(h) – (j) were considered to be either aggravating or mitigating factors.

39. In relation to Article 83(2)(k), any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement, as in the Draft Decision, the DPC takes into account the harm that TikTok said it would suffer if the suspension order was put in place and treats this as a mitigating factor of moderate weight. In contrast to the PDD, there is no reference to the turnover of ByteDance in relation to this criterion. In oral submissions, both parties suggested that this reflects the influence of case law of the CJEU decided between the date of the PDD and of the Draft Decision and Decision. However, the fact that the turnover was not taken into account as part of the consideration of the Article 83(2) criteria did not have any apparent impact on the fines fixed by the DPC.

40. The Decision then includes an assessment of whether the fines are effective, proportionate and dissuasive, similar to that contained within the PDD and Draft Decision. It is preceded by the following passage (at §769):

Having regard to the requirement to ensure the fines imposed are effective, proportionate and dissuasive in accordance with Article 83(1) GDPR, the DPC considers it necessary to have regard to the turnover of ByteDance Ltd, as detailed below, when assessing the quantum of the fines. The DPC’s assessment of the undertaking concerned and the applicable turnover figure is detailed further below.

16 While this is not a matter that can properly be classified as either mitigating or aggravating, by reference to the circumstances of the case, the DPC has taken the significant turnover of the undertaking concerned into account when determining the quantum of the fines, as set out below.

41. The Decision rejects TikTok’s contention that the finding of infringement of Article 46 was “one of demonstration rather than substance”. At §779 of the Decision, the DPC states that, as part of this assessment, it “has also had regard to the turnover of ByteDance Ltd, as detailed below.”

42. The Decision fixes fines in the amount of €485 million for the infringement of Article 46(1) and €45 million for the infringement of Article 13(1)(f), i.e. above the mid-range proposed in the PDD and Draft Decision for each infringement.

43. As with the Draft Decision, the Decision then considers whether an adjustment is required. It maintains the interpretation of Articles 83(3) and 83(5) from the PDD and Draft Decision. Thus, the DPC concludes it is entitled to impose a cumulative fine of €530 million, since that total was less than the maximum which could have been imposed for either infringement on its own. In addition, it concludes that Article 83(5) entitles it to have regard to the turnover of ByteDance, TikTok’s parent, when calculating the amount of the fine. In the Decision, the DPC has regard to ByteDance’s turnover for the year ending 31 December 2024, being the year preceding the imposition of the fine, a figure provided by TikTok following the Draft Decision.

44. Finally, the DPC considers the submissions by TikTok in response to the Draft Decision and of the CSAs.

Applicable case law

45. In the main judgment, reference was made to two decisions of the CJEU, Case C- 683/21, NVSC and Case C-807/21, Deutsche Wohnen, which were decided at the same time, and which establish that Article 83(2) precludes the imposition of an administrative fine in the absence of a finding of fault, be it negligence or intention.

17 46. In NVSC, the Advocate General commented on the provisions of Article 83(3) for the purpose of his interpretation of Article 83(2):

“71 Second, I note that, although Article 83(2) of the GDPR does not expressly state that the infringement must have occurred ‘intentionally or negligently’, the same cannot be said of paragraph 3 of that provision, which contains a general rule precluding the aggregation of administrative fines. That paragraph mentions only the situation where the relevant infringement(s) occurred ‘intentionally or negligently’.

72 In my view, it logically follows that Article 83(2) of the GDPR must be interpreted as meaning that a fine can be imposed only if the alleged infringement occurred intentionally or negligently. Indeed, if the scope of paragraphs 2 and 3 of Article 83 of the GDPR were different, then it would be possible to impose aggregated fines for less serious infringements (that is to say, those committed without any fault), since, although they could still result in the imposition of a fine in application of the first of those provisions (Article 83(2)), they would not be caught by the second (Article 83(3)). The same would not, however, be possible for infringements committed negligently or intentionally, as they would all be subject to the rule against aggregation contained in Article 83(3) of that regulation. Such an outcome would clearly go against the basic principle of the penalty regime put in place by the GDPR, which is that serious infringements should, in principle, be penalised more strictly than less serious ones, and not the other way around.”

47. Although the CJEU also relied on the references to negligence and intention in Article 83(3) in interpreting Article 83(2) (at §72), it did not, as the Advocate General had, characterise Article 83(3) as a “rule against aggregation”.

48. In Deutsche Wohnen, the court considered the concept of undertaking referenced in Article 83(5). One of the questions referred to the court for determination in those proceedings was whether it was permissible to impose administrative fines on legal persons only insofar as the relevant infringement had first been attributed to a natural person. The court rejected that suggestion. In so doing, it confirmed that the references to undertaking in Article 83 were to be understood by reference to Recital 150:

18 “53 Lastly, in view of the referring court’s questions, it should be stated that the concept of an ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, has no bearing on whether and under what conditions an administrative fine may be imposed pursuant to Article 83 of the GDPR on a controller who is a legal person, since that question is exhaustively regulated by Article 58(2) and Article 83(1) to (6) of that regulation.

54 That concept is relevant only for the purpose of determining the amount of the administrative fine imposed under Article 83(4) to (6) of the GDPR on a controller.”

49. The Court continued:

“55 As the Advocate General observed in point 45 of his Opinion, the reference in recital 150 of the GDPR to the concept of an ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, is to be understood in that specific context of the calculation of administrative fines imposed in respect of the infringements referred to in Article 83(4) to (6) of the GDPR.

56 In that regard, it should be stated that, for the purposes of applying the competition rules, referred to in Articles 101 and 102 TFEU, that concept covers any entity engaged in an economic activity, irrespective of the legal status of that entity and the way in which it is financed. The concept of an undertaking therefore defines an economic unit even if in law that economic unit consists of several persons, natural or legal. That economic unit consists of a unitary organisation of personal, tangible and intangible elements which pursues a specific economic aim on a long-term basis (judgment of 6 October 2021, Sumal, C-882/19, EU:C:2021:800, paragraph 41and the case-law cited).

57 Accordingly, it is apparent from Article 83(4) to (6) of the GDPR, which concerns the calculation of administrative fines in respect of the infringements listed in those paragraphs, that, where the addressee of the administrative fine is or forms part of an undertaking, within the meaning of Articles 101 and 102 TFEU, the maximum amount of the administrative fine is calculated on the basis of a percentage of the total

19 worldwide annual turnover in the preceding business year of the undertaking concerned.

58 In short, as the Advocate General observed in point 47 of his Opinion, only an administrative fine determined on the basis of the actual or material economic capacity of the person on which it is imposed, and therefore imposed by the supervisory authority, relying, as regards the amount of that fine, on the concept of an economic unit within the meaning of the case-law cited in paragraph 56 of the present judgment, is capable of satisfying the three conditions set out in Article 83(1) of the GDPR, namely to be effective, proportionate and dissuasive.

59 Therefore, where a supervisory authority decides, by virtue of its powers under Article 58(2) of the GDPR, to impose on a controller, which is or forms part of an undertaking, within the meaning of Articles 101 and 102 TFEU, an administrative fine pursuant to Article 83 of that regulation, that authority is required to take as its basis, under Article 83 GDPR, read in the light of recital 150 of that regulation, when calculating administrative fines in respect of the infringements referred to in Article 83(4) to (6) of the GDPR, the concept of an ‘undertaking’, within the meaning of Articles 101 and 102 TFEU.”

50. The concept of ‘undertaking’ in Article 83 of the GDPR, therefore, has the same meaning it does in Articles 101 and 102 of the TFEU, contrary to the position adopted by TikTok during the Inquiry. In this appeal, TikTok argues that a host of competition law concepts regarding the imposition of fines are thus imported into the GDPR. In the DPC’s view, only the definition of undertaking and the mechanism for calculating fines by reference thereto is borrowed from competition law.

51. Both parties rely on the decision of the CJEU in Case C-383/23, ILVA. ILVA operated a chain of furniture shops in Denmark. It was part of a larger group of companies, the Lars Larsen Group. In the relevant year, the turnover of the Lars Larsen Group was €881 million, the turnover of ILVA €241 million. In Denmark, administrative fines can only be imposed in criminal proceedings, and ILVA was charged with having failed to comply with the GDPR. The Aarhus District Court found that as only ILVA and not the larger group had been liable for the breach, any fine should be calculated on the basis of ILVA’s turnover only. The 20 public prosecutor appealed on the basis that the Court was required to have regard to the turnover of the group of which ILVA formed part when setting the fine. The referring court referred questions to the CJEU on this issue.

52. By reference to the decision in Deutsche Wohnen, the Advocate General concluded as follows:

“26 I conclude that it follows from the judgment in Deutsche Wohnen that, in a case where a GDPR infringement is committed by a controller or a processor that is (or forms part of) an undertaking, when setting the maximum amount of the fine, the reference to the total worldwide annual turnover of the ‘undertaking’ is understood in accordance with Articles 101 and 102 TFEU. However, it is not only the issue related to the maximum amount of the fine that can potentially be imposed on that controller or processor which is thereby clarified. What it also means is that the highly nuanced (and quite case-specific) case-law relating to the concepts of ‘undertaking’ and ‘economic unit’ becomes relevant, to a certain extent, also in order to set the conditions for determining the actual fine imposed for that specific GDPR infringement."

53. She went on to describe a two-stage process for determining the amount of a fine. The first step is to determine the maximum fine by reference to the turnover of the undertaking. She explained that concept:

“30 It also follows from the Court’s case-law that the term ‘undertaking’ in Articles 101 and 102 TFEU can refer to a single economic unit, even if that economic unit consists of several natural or legal persons. Whether several entities form such a unit depends largely on whether the individual entity is free in its decision-making ability or whether a leading entity, namely the parent company, exercises decisive influence over the others. The criteria for determining this are based on the economic, legal and organisational links between the parent company and its subsidiary, for example, the amount of the participation, personnel or organisational ties, instructions and the existence of company contracts.”

54. She made clear that it was for the national court to determine whether a parent, in fact, exercised decisive influence over a subsidiary.

21 55. In her opinion, the Advocate General noted that turnover is not referred to in Article 83(2), and she regarded this as a deliberate choice. Nonetheless, she stated, turnover was not irrelevant to the calculation of a fine. Each of Articles 83(1) to 83(6) must be considered, none of them were “primus inter partes” (at §54).

56. She concluded:

“57 Therefore, to my mind, it should be possible to rely on the concept of ‘undertaking’ within the meaning of Articles 101 and 102 TFEU when fixing the actual fine, but only where this is duly justified for the purposes of the dissuasiveness and effectiveness of the fine. Indeed, in that respect, the use of that concept must be nuanced and individualised in each given case. More specifically, it may be used as an adjustment mechanism when considering the specific circumstances of an individual case once the fine in accordance with Article 83(2) of the GDPR has been established. It is therefore incumbent on the referring court to determine whether, in the present case, circumstances exist which would justify increasing the fine in such a manner, in particular, for the purposes of deterrence.”

57. In its judgment, the Court agreed that a distinction must be drawn between the calculation of the maximum fine and the calculation of the actual fine. The calculation of the maximum fine was to be done by reference to the turnover of the undertaking concerned (as that concept is understood in competition law) (see §23). But the calculation of the actual fine also had to take into account the requirements of Article 83(1) – that the fine be “effective, proportionate and dissuasive” – and each of the criteria referenced in Article 83(2). These ensure that “each of those infringements is assessed on the basis of all the relevant individual circumstances and that the objectives pursued by the system of penalties provided for in the GDPR are achieved” (at §28).

58. The court made clear that the criteria in Article 83(1) could not be satisfied without taking account of whether the party being fined forms part of an undertaking:

“29 Although [the factors in Article 83(2)] do not make reference to the concept of an undertaking, within the meaning of Articles 101 and 102 TFEU, the Court has already ruled that only a fine which takes into account not just all of the factors thus

22 characterising the established infringements of the GDPR, but also, where appropriate, the actual or material economic capacity of the person on which the fine is imposed is capable of satisfying the three conditions set out in Article 83(1) of the GDPR, namely to be effective, proportionate and dissuasive. In order to assess those conditions, it is necessary to take account of whether that person forms part of an undertaking, within the meaning of Articles 101 and 102 TFEU (see, to that effect, judgment of 5 December 2023, Deutsche Wohnen, C-807/21, EU:C:2023:950, paragraph 58).

…

36 In the light of the foregoing considerations, the answer to the questions referred is that Article 83(4) to (6) of the GDPR, read in the light of recital 150 of that regulation, must be interpreted as meaning that the term ‘undertaking’ in those provisions corresponds to the concept of ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, with the result that, where a fine for infringement of the GDPR is imposed on a controller of personal data which is or forms part of an undertaking, the maximum amount of the fine is to be determined on the basis of a percentage of the undertaking’s total worldwide annual turnover in the preceding business year. The concept of ‘undertaking’ must also be taken into account in order to assess the actual or material economic capacity of the recipient of the fine and thus to ascertain whether the fine is at the same time effective, proportionate and dissuasive.”

The WhatsApp proceedings

59. Both parties refer to the WhatsApp Decision, a decision of the EDPB in a dispute arising from the draft decision of the DPC following an inquiry relating to WhatsApp Ireland Limited (“WhatsApp”), referenced in the Decision. A number of issues were addressed in the EDPB Decision which are relevant to this appeal.

60. One issue in dispute was what turnover should be taken into account for the purpose of calculating a fine. The dispute concerned whether the relevant turnover was that of the entire Facebook group (of which WhatsApp formed part) or just the combined turnover of Facebook Inc and WhatsApp. The EDPB concluded that the relevant figure was the total 23 turnover of the entire Facebook group. In so concluding, it expressed the following view, by reference to the decision of the CJEU in Case C-97/08P, Akzo Nobel, which is discussed below:

290. Firstly, according to established case law of the CJEU and as recalled by the IE SA in its Draft Decision when a parent company and its subsidiary are found to form a single undertaking within the meaning of Articles 101 and 102 TFEU, this means that the conduct of the subsidiary may be imputed to the parent company, without having to establish the personal involvement of the latter in the infringement. In particular, the parent company may be held liable for the fine.

61. A separate dispute arose as to what was the “preceding financial year” for the purpose of Article 83. The EDPB concluded:

298. In light of the above, the EDPB decides that the date of the final decision taken by the LSA pursuant to Article 65(6) GDPR, is the event from which the preceding financial year should be considered. The EDPB agrees with the approach taken by the IE SA for the present case to include in the draft decision a provisional turnover figure based on the most up to date financial information available at the time of circulation to the CSAs pursuant to Article 60(3) GDPR.

62. In the draft decision proposing the imposition of a fine on WhatsApp, the DPC had considered that Article 83(3) meant that it could impose a fine only for the gravest infringement of the GDPR, contrary to the approach adopted by it in this case. Despite having found simultaneous infringements of Articles 12, 13 and 14 of the GDPR, it proposed a fine only in relation to the breach of Article 14 (which it considered the gravest infringement). The other CSAs disputed this approach. The EDPB concluded that the DPC’s approach was in error and directed it to amend the draft decision to take account of all the infringements when imposing the administrative fine. It observed:

322. As regards the interpretation of Article 83(3) GDPR, the EDPB points out that the effet utile principle requires all institutions to give full force and effect to EU law. The EDPB considers that the approach pursued by the IE SA would not give full force

24 and effect to the enforcement and therefore to compliance with the GDPR, and would not be in line with the aforementioned purpose of Article 83 GDPR.

323. Indeed, the approach pursued by the IE SA would lead to a situation where, in cases of several infringements of the GDPR concerning the same or linked processing operations, the fine would always correspond to the same amount that would be identified, had the controller or processor only committed one – the gravest – infringement. The other infringements would be discarded with regard to calculating the fine. In other words, it would not matter if a controller committed one or numerous infringements of the GDPR, as only one single infringement, the gravest infringement, would be taken into account when assessing the fine.

63. Finally, for present purposes, the EDPB addressed the following dispute:

406. As indicated above, there is a disagreement between the IE SA and DE SA about whether the turnover figure is relevant only to determine the maximum fine that can be lawfully imposed, or whether it is also potentially relevant in the calculation of the fine amount.

* emphasis in original

64. The EDPB rejected the contention that the turnover was only relevant for the purpose of determining the maximum fine:

409. Though it is true that neither Article 83(2) GDPR nor Article 83(3) GDPR refer to the notion of turnover, drawing from this an absolute conclusion that turnover may be considered exclusively to calculate the maximum fine amount is unsustainable in law. Firstly, including a reference to turnover in these provisions is unnecessary, as on the one hand all fines - whether set close to the upper limit or far below it - must be set at a level that is effective, proportionate and dissuasive (cf. Article 83(1) GDPR), and on the other hand the dynamic maximum fine amount sets out the limits within which the SAs may exercise their fining power. Secondly, it would be internally contradictory for the GDPR to introduce a dynamic upper limit to fines, while at the same time prohibiting supervisory authorities from assessing whether a fine might need to be

25 increased or decreased in light of the turnover of a company - again - to ensure it is effective, proportionate and dissuasive (cf. Article 83(1) GDPR).

65. As noted in the main judgment and above, the WhatsApp Decision is the subject of an annulment action by WhatsApp, Case T-709/21 (“the WhatsApp proceedings”), which the CJEU deemed admissible in its judgment in Case C-97/23. The pleadings in the WhatsApp proceedings are confidential. A summary of the grounds pleaded in the action was published in the Official Journal on 3 January 2022 and refers to WhatsApp having pleaded that the “EDPB violated Article 83 GDPR and various underlying principles governing the determination of fines under the GDPR”.

66. In Meta Platforms Ltd v DPC [2025] IECA 60, the Court of Appeal was called on to consider how to manage proceedings which raised similar issues of interpretation of Article 83 to those at issue in the WhatsApp proceedings (at that time pending before the CJEU in the appeal on the issue of admissibility). The parties were agreed that certain issues could not be finally determined in light of those pending proceedings. The Court of Appeal took the view that the most appropriate means of progressing the Meta Platforms proceedings was to advance them to the point where questions regarding the relevant issues of interpretation could be referred to the CJEU pursuant to Article 267 of the TFEU. As the court (Collins J) pointed out, if the annulment proceedings were still extant at that time, an application could be made to stay the annulment proceedings pending a determination of the issues in the reference.

67. The DPC in its oral submissions in this case suggested that, in light of the annulment proceedings, the court was obliged to either stay the determination of those issues of interpretation which overlapped with the annulment proceedings, or, in line with the decision in Meta Platforms, refer those issues to the CJEU pursuant to Article 267. It referenced, in this regard, Case C-344/98, Masterfoods Ltd v HB Ice Cream Ltd. In that case, Masterfoods had commenced proceedings in the High Court concerning an exclusivity arrangement between HB and retailers by which HB supplied freezer cabinets free of charge to retailers on condition that they stock only HB products. HB were successful in the High Court, and Masterfoods appealed to the Supreme Court.

26 68. In addition to the domestic proceedings, Masterfoods had made a complaint to the Commission. The Commission issued a decision in which it determined that HB’s arrangement infringed Articles 85 and 86 of the Treaty. HB brought an action for the annulment of that decision.

69. The Supreme Court queried whether the duty of sincere co-operation required it to stay the domestic proceedings pending determination of the annulment proceedings and referred that question for determination to the Court of Justice. The Court of Justice determined that it was necessary either to stay the domestic proceedings or make a reference for a preliminary ruling:

“57 When the outcome of the dispute before the national court depends on the validity of the Commission decision, it follows from the obligation of sincere cooperation that the national court should, in order to avoid reaching a decision that runs counter to that of the Commission, stay its proceedings pending final judgment in the action for annulment by the Community Courts, unless it considers that, in the circumstances of the case, a reference to the Court of Justice for a preliminary ruling on the validity of the Commission decision is warranted.”

70. During the course of submissions, the DPC provided the court with a table of statutory appeals pending in which issues of interpretation which may be determined in the WhatsApp proceedings may also arise. There are a total of twelve appeals pending, with fines totalling almost €3.5 billion in dispute, excluding the within appeal.

71. In Masterfoods, of course, the annulment proceedings and the domestic proceedings concerned the same parties. In this case, although some of the issues which might arise in the annulment proceedings may be the same as those at issue in these proceedings, the parties are not the same. In those circumstances, it doesn’t seem to me that I am obliged by the duty of sincere co-operation to make a reference on those issues (or stay my determination of them). The decision in Meta Platforms does not suggest otherwise, that case proceeding on the basis that the parties agreed that certain elements of the appeal could not be advanced before the decision in the WhatsApp proceedings, whereas in this case all issues were fully argued. However, it is clear that there may be a benefit in referring certain questions. It is appropriate also to have regard to the fact that the parties consider that there

27 is sufficient uncertainty on some issues that a reference would be of assistance. In this regard, the fact that a large number of appeals are pending in which similar issues arise is also a relevant consideration.

The GDPR Fining Guidelines

72. On 24 May 2023, the EDPB adopted Guidelines 04/2022 on the calculation of administrative fines under the GDPR (“the GDPR Fining Guidelines”) in accordance with its powers pursuant to Article 70 of the GDPR. Since the GDPR Fining Guidelines were adopted after the date of the PDD, the parties agree that they are not directly applicable. However, both made submissions by reference to them, as a guide to how the calculation of fines should be approached.

73. The objectives of the GDPR Fining Guidelines are explained in Chapter 1, to ensure consistent application of the GDPR. The approach is explained:

5. The aim of these Guidelines is to create harmonised starting points as a common orientation, on the basis of which the calculation of administrative fines in individual cases can take place. However, it is settled case law that any such guidance need not be as specific as to allow a controller or processor to make a precise mathematical calculation of the expected fine. It is emphasised throughout these Guidelines that the final amount of the fine depends on all the circumstances of the case. The EDPB therefore envisages harmonisation on the starting points and methodology used to calculate a fine, rather than harmonisation on the outcome.

6. These Guidelines can be seen as following a step-by-step approach, though supervisory authorities are not obliged to follow all steps if they are not applicable in a given case, nor to provide reasoning surrounding aspects of the Guidelines that are not applicable. Although, reasoning should at least include the factors which led to determining the level of seriousness, the turnover which is applied, and the aggravating and mitigating factors that were applied.

28 74. Chapter 2 then sets out a five-step methodology, though making clear that the setting of a fine is a matter within the discretion of the supervisory authority.

75. Step one is the identification of the infringements and determining whether they arise out of the same processing operations within the meaning of Article 83(3).

76. The second step is to “identify the starting point for further calculation”. This is done by reference to (a) the classification of the infringement in Articles 83(4) – (6), to (b) the seriousness of the infringement by reference to Article 83(2)(a), (b) and (g), and to (c):

… the turnover of the undertaking as one relevant element to take into consideration with a view to imposing an effective, dissuasive and proportionate fine, pursuant to Article 83(1) GDPR.

77. Step 3 involves a consideration of aggravating or mitigating factors listed in Article 83(2). Step 4 involves identifying the legal maximum. The final step involves analysing whether the final figure arrived at meets the requirement of being effective, proportionate and dissuasive as set out in Article 83(1).

78. Each of the steps is then explained in further detail in separate chapters of the GDPR Fining Guidelines. Illustrative examples are provided.

Scope of the appeal

79. Before considering the remaining grounds of appeal, it is worth recalling the conclusions from the main judgment on the scope of the appeal, reached in light of the judgment in LinkedIn v DPC [2026] IEHC 235 (see §142 - §186 of the main judgment).

80. Grounds 7, 8 and 9 of the appeal all relate to the administrative fines imposed by the DPC. They can therefore be considered as an appeal pursuant to section 142 of the Data Protection Act 2018 (“the 2018 Act”). As made clear in LinkedIn, the appeal provided for under section 142 of the 2018 Act is not simply an appeal against error, rather it is an appeal on the record. Accordingly, the court has full jurisdiction to examine the merits of the appeal based on the material before the DPC and any additional material on which an appellant is

29 permitted to rely. Of course, in order to successfully appeal, an appellant must first identify an error in the DPC’s decision making.

81. In the main judgment, I considered what the implications of these conclusions were for the various grounds of appeal advanced by TikTok regarding breach of fair procedures, in circumstances where it had opted to pursue its appeal against the Decision rather than its judicial review proceedings. I concluded that where TikTok established a breach of fair procedures, the consequence was not annulment of the Decision but rather, insofar as was possible, I was required to determine the merits of the underlying issue (see, for instance, §172, §579, and §590) and determine whether it was appropriate to substitute a different form of order for that of the DPC in light of that breach of fair procedures.

82. Those observations apply with equal force to fair procedure-type arguments made in relation to the decision to impose administrative fines. At Ground 8 of the appeal, TikTok pleads a series of failures by the DPC to explain its reasons for various aspects of the decision to impose the administrative fines. Where TikTok identifies an absence of adequate reasoning on the part of the DPC, that could not possibly lead to a decision simply to annul the administrative fines. Rather, it will be necessary first to consider whether the deficiency in reasoning could have a bearing on the overall conclusion regarding the decision to impose fines and the amounts thereof. If so, it will be necessary to consider whether a different administrative fine should be imposed, or, conceivably, no administrative fine. In circumstances where the court is entitled to consider the merits of the appeal, it is not sufficient for TikTok to show that the DPC’s conclusions on particular issues are not adequately reasoned for it to obtain a different form of order than that made by the DPC. It is necessary for it to show that the DPC’s conclusions are not, as a matter of fact, justified.

83. As it happens, as we will see, many of TikTok’s complaints about adequacy of reasons are based, fundamentally, on its disagreement with the DPC about whether it had infringed Article 46(1) at all, a conclusion which I have already found to be warranted in the main judgment.

30 Ground 7 – Errors in having regard to the turnover of ByteDance

84. TikTok alleges a number of errors by the DPC in relation to its treatment of ByteDance and TikTok as an undertaking or single economic unit for the purpose of Article 83(5). I propose to address each in turn.

Error in determining fining caps

85. First, TikTok alleges that the DPC was not entitled to have regard to the turnover of ByteDance, or any other company in the group, at all unless it attributed joint liability for the infringement to that company. Before having regard to ByteDance’s turnover, the DPC was therefore required to impute liability to ByteDance for the infringement and afford it full rights of defence in relation to the matter. In this regard, it is alleged that the DPC erred in relying on the presumption of decisive influence by the parent, ByteDance, over the subsidiary, TikTok, when it was for the parent and not the subsidiary to rebut that presumption.

Arguments

86. TikTok’s contention is that if, as the CJEU has determined in Deutsche Wohnen, the concept of ‘undertaking’ has the same meaning in Article 83 of the GDPR as it does in Articles 101 and 102 of the TFEU, i.e. for the purpose of competition law, then the mechanism by which a parent’s turnover becomes relevant in the calculation of a fine must also be the same.

87. It explains the mechanism in competition law proceedings by reference to, inter alia¸ Case C-97/08P, Akzo Nobel, which, as noted above, was referenced in the DPC’s letter of 26 April 2023 and in the WhatsApp Decision. In that case, four wholly owned subsidiaries of Akzo Nobel were found to have been involved in a cartel. Although Akzo Nobel was not involved in the cartel, it was found jointly and severally liable for the breach of competition law by the Commission and then by the Court of First Instance (as the General Court then was). As recorded in the Advocate General’s opinion, there was no dispute that the parent could be made answerable for the actions of its subsidiaries, rather, the issue in dispute was

31 the determination that the parent exercised decisive influence over the subsidiaries, and whether the fact that the parent owned 100% of the shareholding in the subsidiary was sufficient to give rise to the presumption, or something more was required. On this issue, the court concluded as follows:

“54 It must be observed, as a preliminary point, that Community competition law refers to the activities of undertakings… … and that the concept of an undertaking covers any entity engaged in an economic activity, regardless of its legal status and the way in which it is financed…

55 The Court has also stated that the concept of an undertaking, in the same context, must be understood as designating an economic unit even if in law that economic unit consists of several persons, natural or legal…

56 When such an economic entity infringes the competition rules, it falls, according to the principle of personal responsibility, to that entity to answer for that infringement…

57 The infringement of Community competition law must be imputed unequivocally to a legal person on whom fines may be imposed and the statement of objections must be addressed to that person… … It is also necessary that the statement of objections indicate in which capacity a legal person is called on to answer the allegations.

58 It is clear from settled case-law that the conduct of a subsidiary may be imputed to the parent company in particular where, although having a separate legal personality, that subsidiary does not decide independently upon its own conduct on the market, but carries out, in all material respects, the instructions given to it by the parent company…

…

60 In the specific case where a parent company has a 100% shareholding in a subsidiary which has infringed the Community competition rules, first, the parent company can exercise a decisive influence over the conduct of the subsidiary… … and,

32 second, there is a rebuttable presumption that the parent company does in fact exercise a decisive influence over the conduct of its subsidiary…

61 In those circumstances, it is sufficient for the Commission to prove that the subsidiary is wholly owned by the parent company in order to presume that the parent exercises a decisive influence over the commercial policy of the subsidiary. The Commission will be able to regard the parent company as jointly and severally liable for the payment of the fine imposed on its subsidiary, unless the parent company, which has the burden of rebutting that presumption, adduces sufficient evidence to show that its subsidiary acts independently on the market …”

88. TikTok also refers to Case C-521/09P, Elf Aquitaine, in relation to the significance of the presumption of decisive influence being rebuttable:

“59 The purpose of the presumption of actual exercise of decisive influence is, in particular, to strike a balance between, on the one hand, the importance of the objective of combatting conduct contrary to the competition rules, in particular to Article 101 TFEU, and of preventing a repetition of such conduct, and, on the other hand, the importance of the requirements flowing from certain general principles of EU law such as the principle of the presumption of innocence, the principle that penalties should be applied solely to the offender, the principle of legal certainty and the principle of the rights of the defence, including the principle of equality of arms. It is for that reason, among others, that, as is clear from the consistent case-law cited in paragraph 56 above, the presumption is rebuttable.”

89. It also refers to the following passage from that judgment:

“152 Where, as in the present case, a decision taken in application of the EU competition law rules relates to several addressees and raises a problem with regard to the imputability of the infringement, it must include an adequate statement of reasons with respect to each of its addressees, in particular those of them who, according to the decision, must bear the liability for the infringement. Accordingly, in respect of a parent company held jointly and severally liable for the infringement committed by its

33 subsidiary, such a decision must in principle contain a detailed statement of reasons for imputing the infringement to that company…

90. In light of the foregoing, TikTok contends that the DPC was not entitled to have regard to the turnover of ByteDance without imputing liability to ByteDance for the infringement. Accordingly, it argues, the DPC was required to afford ByteDance full rights of defence in relation to the matter. This obligation was not discharged by asking TikTok to bring the matter to the attention of its parent. Furthermore, insofar as the DPC relied on the rebuttable presumption that ByteDance exercised decisive influence over TikTok, it was ByteDance, as parent, which was required to be afforded the opportunity to rebut that presumption.

91. It contends that the DPC’s ‘notification’ to ByteDance by its request to TikTok in its letter of 26 April 2023 was plainly inadequate. It refers to the Case C-612/12P, Ballast Nedem, a competition case in which the CJEU determined that notification to the parent company in that case could not be established by showing that it could not have been unaware that the Commission intended to hold it liable for its subsidiaries’ actions.

92. The DPC rejects the contention that in order to have regard to the turnover of ByteDance, it was required to impute TikTok’s conduct to its parent, or to impute liability for the infringement to ByteDance. Accordingly, it says, it was under no obligation to notify ByteDance that it intended to take into account its turnover or to afford it rights of defence. It points out that in ILVA, the fine was imposed on ILVA by reference to the turnover of its parent, but there was no suggestion that liability had been imputed to the parent, that the parent was jointly and severally liable for the fine, or that it was required to be heard in relation to the proposal to impose administrative fines by reference to its turnover on the basis that it exercised decisive influence over ILVA.

93. It contends that TikTok is wrong in seeking to read across competition case law regarding the imposition of liability on undertakings when considering the concept of undertaking for the purpose of Article 83. It refers to the decision in Case C-58/12P, Groupe Gascogne. As with Akzo Novel, these were proceedings concerning a cartel. The Commission found that a company, Sachsa, had been involved in various competition law breaches. It imposed fines of €13.2 million on Sachsa, finding that its parent, the appellant, was jointly and severally liable for €9.9 million of that sum. The General Court dismissed

34 the appeal, and the appellant appealed to the CJEU on the grounds, inter alia, that the General Court erred in concluding that it was entitled to have regard to the entire group when determining the maximum penalty which could be imposed. The appellant argued that this was only permissible if the entire group could be shown to be a single entity.

94. The court noted that Article 23(2) of Regulation 1/2003 provided that a fine could be imposed on any undertaking who participated in an infringement in an amount not exceeding 10% of the turnover in the preceding year of that undertaking. It explained the rationale for the rule in detail. Some of what is said is relevant to other grounds of appeal pursued by TikTok so it is worth setting out here for ease of understanding:

“48 That upper limit of the amount of the fine seeks to prevent fines being imposed which it is foreseeable that the undertakings will not be able to pay, having regard to their size, as determined, albeit approximately and imperfectly, by their total turnover. That limit is therefore one which is uniformly applicable to all undertakings, arrived at by reference to the size of each of them and seeks to ensure that the fines are not excessive or disproportionate …

49 That objective must, however, be combined with the aim of ensuring that the fine has sufficient deterrent effect, which justifies taking into consideration the size and the economic power of the undertaking concerned, namely the global resources of the infringer …

50 The taking into consideration of the size and global resources of the undertaking in question is justified by the impact sought on the undertaking concerned, in order to ensure that the fine has sufficient deterrent effect, as the sanction must not be negligible in the light, particularly, of its financial capacity …

51 In those circumstances, when assessing the financial resources of an undertaking to which a breach of the EU competition law rules is attributed, the taking into account of the turnover of all the companies in respect of which the undertaking concerned has the opportunity to exercise a decisive influence is justified.

35 52 In particular, when the undertaking to which the infringement is attributed heads a group which constitutes an economic unit, the turnover of the group as a whole must be taken into account when calculating the upper limit of the amount of the fine referred to in Article 23(2) of Regulation No 1/2003.

53 That turnover is the best indicator of the ability of the undertaking concerned to mobilise the funds needed to pay the fine.

…

55 It follows that, provided that the Commission has established to a sufficient legal standard that an infringement may be attributed to a company which heads a group, it is entitled, for the purposes of assessing the financial capacity of that company, to take into consideration the latter’s consolidated accounts inasmuch as they may be regarded as constituting a relevant factor of assessment.

…

57 Contrary to what the appellant contends, the Commission cannot be required, after establishing that the parent company must be held liable for the infringement of its subsidiary, to demonstrate that each subsidiary in the group does not determine its conduct on the market independently. As the General Court held in paragraph 112 of the judgment under appeal, attributing a subsidiary’s infringement to the parent company and prohibiting a fine being imposed in excess of 10% of the turnover of the undertaking concerned are two separate issues serving different purposes. If the case arises, it is for the company which considers that the consolidated turnover does not reflect the economic reality to submit evidence capable of refuting the existence of a power of control by the parent company.”

95. Thus, the mechanism of having regard to the turnover of the undertaking is a means of determining ability to pay. Taking into account the turnover of the entire group is the “best indicator” of the undertaking’s ability to mobilise funds.

36 96. Also, and importantly, the attribution of liability to a parent and limiting the maximum fine which can be imposed by reference to the turnover of the undertaking are separate issues, serving different purposes.

97. Insofar as TikTok argues that the DPC was required to put ByteDance on notice of the Inquiry or at least of the intention to have regard to its turnover for the purpose of Article 83, the DPC also pleads that TikTok is estopped from pursuing that argument by reason of its failure, when invited to do so, to submit observations from ByteDance on the proposed administrative fine. Although the DPC denies any obligation to notify ByteDance or afford it rights of defence, it relies, to the extent necessary, on its notification to ByteDance through TikTok.

Discussion

98. There is no suggestion in the Decision that the DPC considered that it was imputing liability for the infringements to ByteDance, still less that it was imposing the administrative fines on ByteDance. It did not do so. The question is whether this was required.

99. It is important to recall a significant distinguishing feature between the regime for imposing penalties for breach of competition law contained in Council Regulation 1/2003 and the provisions for imposing administrative fines detailed in the GDPR. Article 23(2) of Regulation 1/2003 provides as follows:

2. The Commission may by decision impose fines on undertakings and associations of undertakings where, either intentionally or negligently: (a) they infringe Article 81 or Article 82 of the Treaty; or (b) they contravene a decision ordering interim measures under Article 8; or (c) they fail to comply with a commitment made binding by a decision pursuant to Article 9. For each undertaking and association of undertakings participating in the infringement, the fine shall not exceed 10 % of its total turnover in the preceding business year.

37 100. Thus, provision is expressly made that fines may be imposed on “undertakings”. This reflects the fact that Articles 101 and 102 of the TFEU (formerly Articles 81 and 82 of the Treaty of Rome) are addressed to undertakings and the conduct of undertakings.

101. By contrast, Articles 58 and 83 of the GDPR are addressed to controllers (and processors). Although Articles 83(4) – (6) provide a mechanism for calculating caps on fines by reference to the fact that a controller may be part of an undertaking, neither Article 58 nor Article 83 envisages fines being imposed on the undertaking rather than on the controller. This is reflected in the judgment of the court in Deutsche Wohnen, where the court stated that the concept of an undertaking has “no bearing” on whether and under what conditions a fine may be imposed, and is relevant only for the purpose of determining the amount of the fine. In ILVA, the Advocate General made this point explicitly:

“53 Even though the EU legislature has, to a certain limited extent, formed a bridge between the two fields of EU law for the purpose of setting maximum fines, the GDPR rules and EU competition rules clearly pursue different objectives. The regulatory scheme of the GDPR is different from that of EU competition rules and is based on the concept of the responsibility of the controller (and processor) for the lawful processing of personal data. In other words, while EU competition law is directed at‘undertakings’ (it expresses its prohibition by reference to an ‘undertaking), the GDPR focuses on ‘controllers’ and ‘processors’.”

102. It appears, therefore, that TikTok is mistaken in considering that the entire ‘fine calculating’ framework developed in relation to breaches of competition law has been incorporated into the GDPR by the references to undertakings in Article 83, read in light of Recital 150. Rather, all that has been done is to incorporate a mechanism for calculation. As noted in Groupe Gascogne, attributing a subsidiary’s infringement to the parent company and prohibiting a fine being imposed above a level calculated by reference to the turnover of an undertaking are two separate issues serving different purposes. There is no reason to suppose that the inclusion of the mechanisms in Article 83(4) to (6), prohibiting the imposition of fines above levels calculated by reference to an undertaking’s turnover, also imports a requirement that liability must be imputed to a parent for this purpose, still less that any fines imposed must or can be imposed on the parent. Rather, it appears that the GDPR has simply adapted a mechanism to ensure, as with the equivalent mechanism in

38 competition law proceedings, as explained in Groupe Gascogne, that any fine imposed is not excessive or disproportionate and has a deterrent effect, by having regard to the financial capacity of the undertaking and its ability to mobilise funds.

103. This is consistent with the approach of the CJEU in ILVA. I accept TikTok’s observation that the question of whether liability had been imputed to the parent was not before the court in those proceedings. But that case was referred on the basis that the infringement had not been imputed to the parent. It is clear that the court was prepared to deal with a reference where a penalty had been imposed on the subsidiary only, by reference to the turnover of its parent, indeed the entire group of which it formed part, and in proceedings to which the parent was not a party. If TikTok were correct in its interpretation of the GDPR, it seems extraordinary that neither the Advocate General nor the court made any comment on this fundamental misapplication of the regulatory regime.

104. If there is no requirement to impute liability to a parent, or to make the parent liable for any infringement or the payment of a fine, it would seem to follow that there would be no basis for concluding that the parent was required to be afforded rights of defence. This is likely to be so even where there is a contested question of whether the parent exercises decisive influence over a subsidiary, or where the regulator proposes to rely on a presumption of decisive influence, e.g. by reference to the parent owning the entire shareholding in the subsidiary. Although the competition law cases relied on by TikTok refer to it being for the parent to rebut that presumption, those statements refer to the obligation being on the parent to rebut the presumption in response to the argument being advanced that it was for the regulator to prove decisive influence, i.e. the authorities do not support the suggestion that the parent rather than the subsidiary must be given the opportunity to rebut the presumption. TikTok did not identify any reason why only its parent was in a position to rebut the presumption of decisive influence.

105. For the foregoing reasons, I am minded to reject TikTok’s arguments under this heading. However, I must accept that the issues raised are not acte clair. The EDPB Decision refers to Akzo Nobel and the conduct of a subsidiary being imputed to the parent (as did the DPC’s correspondence of 26 April 2023) which suggests some room for doubt on this point. It is possible, therefore, that similar arguments have been or will be advanced in the WhatsApp proceedings. In addition, the DPC has identified a plethora of pending appeals in which

39 these and the other similar issues have been or could be raised and appears to accept that there is sufficient doubt about its interpretation of the GDPR that it has agreed, in this instance, the wording of questions which should be referred to the CJEU for determination.

106. In all the circumstances, and having regard to the observations of Collins J in Meta Platforms regarding the most efficient means of achieving a final determination on these issues¸ I consider it appropriate to refer questions arising from this ground of appeal to the CJEU for determination.

107. The parties have proposed a number of questions. My provisional view is that it is not necessary to refer all the questions they have proposed, and that simplified versions of what is proposed would be more appropriate. For instance, one proposed question queries whether the concept of ‘single economic unit’ should be applied in the same way for the purpose of Articles 83(1) and for Articles 83(4) – (6). I cannot see any basis in the GDPR for contending that it should be applied differently between the two sub-articles. Any such contention is, moreover, inconsistent with the decisions of the CJEU in Deutsche Wohnen and ILVA. Accordingly, I propose to refer the following questions for determination by the CJEU pursuant to Article 267 of the TFEU:

(1) Where a supervisory authority proposes, when imposing an administrative fine on a controller, to have regard to the turnover of the undertaking of which the controller forms part in determining the maximum fine in accordance with Article 83(4), (5) or (6) GDPR and / or the amount of the fine in accordance with Article 83(1) and/or Article 83(2) GDPR, is the supervisory authority required to first:

(i) impute the conduct of the controller to the parent company (or other group member);

(ii) impute liability (jointly or otherwise) for the infringement(s) in issue to the controller’s parent company or other group member; and/or

(iii) notify the respondent’s parent company (or other group member) directly that it intends to take the turnover of the undertaking into account and afford it rights of the defence?

40 (2) If the answer to 1(iii) is ‘no’, where a supervisory authority intends to rely on the presumption of decisive influence to find that the controller concerned forms part of an undertaking, is the supervisory authority required to put the parent company on notice of its intention to do so and afford the parent company an opportunity to rebut that presumption?

108. I should note that the DPC did not press its estoppel argument and I do not consider it well made. If the DPC was required to afford ByteDance the rights of defence, and TikTok has potentially been fined without that interested party having been heard, I do not think that it can be prevented from making that complaint now because it did not take up the opportunity to submit observations on ByteDance’s behalf. For the avoidance of doubt, if ByteDance was required to be notified of the DPC’s intention to calculate the fines by reference to its turnover, the contents of the DPC’s letter of 26 April 2023 could not be taken to have discharged that obligation, as made clear by the decision in Ballast Nedem.

Error in determining the preceding financial year

109. By its second argument under Ground 7, TikTok alleges that the DPC erred in having regard to 2024 as the “preceding financial year” for the purpose of determining the relevant turnover to be taken into account. It contends that 2022, the year before the end of the temporal scope, was the appropriate financial year to have been considered. In this regard, it should be noted that ByteDance’s turnover increased significantly in 2024 and, therefore, the identification of the correct preceding financial year could have had a material impact on the amount of the administrative fines (subject to other issues raised in the appeal).

Arguments

110. TikTok’s complaint under this head is not based on an interpretation of Article 83 which means that “the preceding financial year” is the year preceding the breach of the GDPR rather than the year preceding the imposition of the fine, rather it contends that because of

41 the delay by the DPC in progressing the Inquiry, it would, in effect, be unfair to have regard to the increased turnover at a time after the temporal scope.

111. TikTok refers to the decision in Case C-611/16, Xellia Pharmaceuticals, a competition case, and the following observation (at §209):

“… the Commission must assess, in each specific case and having regard both to the context and the objectives pursued by the scheme of penalties created by Regulation No 1/2003, the intended impact on the undertaking in question, taking into account in particular a turnover which reflects the undertaking’s real economic situation during the period in which the infringement was committed …”

112. There is, therefore, some flexibility in determining the appropriate year to which regard should be had for the purpose of the relevant calculation. Having regard to the increase in ByteDance’s turnover between the temporal scope, ending in May 2023, and the imposition of the fine, in April 2025, TikTok argues that the turnover for 2022 was the figure to which regard should have been had.

113. The DPC argue that its decision to rely on the year preceding its final decision rather than the PDD is consistent with the case law, including the WhatsApp Decision. Although, as in Xellia, the CJEU has determined that it is permissible to take into account a financial year other than the one immediately preceding a decision, that arises where the previous financial year does not correspond to a full year of normal activity for the undertaking concerned (see Xellia at §210). There is no evidential basis for contending that 2024’s turnover does not represent a year of normal activity for ByteDance.

114. The DPC rejects the contention that there was any delay on its part.

Discussion

115. A literal interpretation of Articles 83(4) to (6) suggests that the reference to “preceding financial year” is to the year preceding the one in which the administrative fine is calculated,

42 rather than the one in which the infringement occurs. This is also consistent with a purposive interpretation of those provisions.

116. As set out above, and as discussed in Groupe Gascogne, the purpose of imposing fining caps by reference to the turnover of an undertaking is to ensure that fines are effective, proportionate, and dissuasive. Typically, this will be achieved by having regard to the turnover of the undertaking at the time that the fine is imposed.

117. As referenced in the WhatsApp Decision, the equivalent provision in Regulation 1/2003, Article 23(2), has been interpreted as meaning the year preceding the imposition of the fine (see, for instance, Case C-637/13P, Laufen Austria AG v. European Commission at §48).

118. The CJEU has, however, interpreted the requirement to have regard to the preceding financial year flexibly, in order to give effect to the purpose of the fining provisions of EU law. As Xellia makes clear in relation to Article 23(2), where the preceding financial year is not representative of the undertaking’s financial capacity, the Commission may have regard to an earlier year’s accounts in order to determine the relevant fining caps in accordance with that legislation.

119. There is no suggestion in this case that ByteDance’s turnover for 2024 was not representative or that it did not enable the DPC to calculate fines which met the requirements of Article 83(1). The purpose of having regard to the preceding year’s turnover when calculating fines was met, therefore, by having regard to 2024’s turnover.

120. As to the suggestion that an earlier year should have been chosen because, in effect, of culpable delay on the part of the DPC, I have some doubt whether TikTok can rely on this as an issue at all where it has not appealed the Decision on the basis of culpable delay. In any event, it is clear that in order to maintain this particular objection, the onus rests on TikTok to show that there has been culpable delay. This has not been established by TikTok. Although the Inquiry was lengthy and, in particular, there was a significant delay between the PDD and the issuing of the Draft Decision to the CSAs, TikTok delivered significant amounts of additional material during this period, much of which it sought to rely on in this

43 appeal. Indeed, as appears from the main judgment, TikTok’s appeal against the corrective orders rested almost entirely on material delivered during 2024 and 2025.

121. The DPC was entitled to take some period of time to consider the additional material, which was of considerable complexity. Moreover, there is nothing unusual about a delay between a finding of infringement and the date on which that infringement occurred. In fact, that is likely to be the norm. The ‘gap’ between the finding of infringement in this case, the temporal scope ending on 17 May 2023, and the imposition of a fine in 2025 is, seen in that light, not significant.

122. More fundamentally, TikTok cannot take the benefit of the extended time it took the DPC to complete the Inquiry, by relying on material submitted during that period to challenge the corrective orders made by the DPC, and at the same time complain that it has been prejudiced because its turnover increased during that time, thus increasing the potential fine to which it could be exposed.

123. In any event, the actual fines to be imposed are not determined by reference to the turnover during the preceding financial year. That turnover figure limits the fines which can be imposed and is relevant to the overall consideration of whether a fine meets the requirements of Article 83(1). Thus, there is sufficient flexibility available in determining the actual fine to enable a supervisory authority to have regard to any increase in turnover since the date of an infringement should that be considered relevant. Insofar as the DPC does not appear to have done so in this case, I do not consider that TikTok has identified any error by it.

124. The parties have suggested questions to be referred on this issue. However, the question of what the preceding year is is acte clair in light of the case law above. A further question based on an underlying premise of culpable delay on the part of the DPC simply does not arise on the facts.

44 Error in determining that ByteDance exercised decisive influence over TikTok

125. TikTok also alleges that the DPC’s finding of decisive influence was based on an inadequate investigation and that it had not, for instance, formed any view on whether ByteDance exercised decisive influence over TikTok Cayman.

Arguments

126. TikTok’s argument under this heading relies on the corporate structure described above, which shows that TikTok Ireland is a wholly owned subsidiary of TikTok UK, TikTok UK is a wholly owned subsidiary of TikTok Cayman, and TikTok Cayman is a wholly owned subsidiary of ByteDance.

127. TikTok argues that the DPC was required to consider whether each of these ‘interposed companies’, as they describe the companies between TikTok and ByteDance, operated autonomously on the market.

128. The DPC reject this argument and contend that it was for TikTok to rebut the presumption of decisive influence which arose from each subsidiary being wholly owned by its parent. It refers to the decision in Case C-508/11P, Eni addressed to a similar situation. In that case, the court determined (at §48):

“In addition, in the specific case where a holding company holds 100% of the capital of an interposed company which, in turn, holds the entire capital of a subsidiary of its group which has committed an infringement of European Union competition law, there is also a rebuttable presumption that that holding company exercises a decisive influence over the conduct of the interposed company and also indirectly, via that company, over the conduct of that subsidiary…”

129. The DPC also contends that TikTok is estopped from pursuing this complaint for the reasons outlined above, and also that it has no standing to pursue this complaint, as it is a ius tertii, a complaint that the rights of a third party, ByteDance, have been infringed.

45 Discussion

130. There is, in my view, no basis for distinguishing the position described in Eni above and that at issue here. The undisputed facts are that each company between TikTok and ByteDance in the ByteDance group was 100% owned by its parent. Accordingly, there was a rebuttable presumption that ByteDance exercised decisive influence over TikTok such that the undertaking for the purpose of Article 83(4) – (6) should be presumed to be ByteDance.

131. TikTok offered no, or no sufficient, evidence during the Inquiry to rebut the presumption of decisive influence. The affidavit of Elaine Fox refers to certain matters which, it appears to be suggested, establish that ByteDance (or some of the interposed companies) do not exercise decisive influence over TikTok. In addition, it is suggested that some companies within the ByteDance Group are not ‘linked’ to TikTok. Ms Fox suggests that ByteDance could have put this information before the DPC had it been put on notice of the Inquiry.

132. Ms Fox does not explain how it is that TikTok is able to put this information before the court, but it was only ByteDance which could have provided the information to the Inquiry. More importantly, the evidence falls far short of rebutting the presumption of decisive influence. Indeed, it does not even purport to address the critical issue necessary to rebut the presumption, whether TikTok operates independently of ByteDance in the market. The facts, as submitted during the Inquiry and as averred by Ms Fox, that ByteDance may have many other interests, that TikTok’s turnover in the EEA is a relatively small proportion of its total turnover, and that TikTok and TikTok UK prepare consolidated accounts do not establish that TikTok operates independently of ByteDance in the market. The case law makes clear that where a parent owns the entire shareholding in a subsidiary, even if indirectly through interposed companies, a regulator is entitled to rely on the presumption of decisive influence unless it is rebutted. I see no error by the DPC in concluding that the presumption had not been rebutted in this case.

133. TikTok complains that the DPC did not engage with its submission that TikTok UK was the appropriate undertaking to consider as forming a single economic unit with TikTok and that TikTok UK’s turnover was, accordingly, the relevant turnover to consider for the purpose of Article 83. The conclusion that ByteDance and TikTok formed a single economic

46 unit and that ByteDance’s turnover was therefore relevant for the purpose of Article 83 necessarily involved a rejection of TikTok’s contrary argument. In circumstances where I have concluded that the DPC was entitled to conclude that ByteDance was the relevant entity, TikTok’s complaint that the DPC did not explain why TikTok UK was not the relevant entity is without substance (see, for instance, Friends of the Irish Environment v Minister for Housing [2025] IECA 128 at §156).

134. Subject to clarification of the issue of whether ByteDance should have been afforded an opportunity to be heard, whether on the issue of whether it exercised decisive influence over TikTok or more generally, I can identify no error by the DPC in its conclusion that ByteDance was the relevant undertaking for the purpose of Article 83.

135. It is not, therefore, necessary to address in any detail the question of whether TikTok had standing to advance this complaint. I merely observe that in circumstances where it is TikTok which is obliged to pay the administrative fines imposed (whether or not it will be the entity which actually pays them), it is difficult to see how it could be precluded from advancing any argument that the DPC erred in the approach it took to the calculation of those fines.

Error in having regard to turnover of ByteDance in calculating the amount of the fines

136. TikTok’s fourth argument under this ground of appeal is that the DPC erred in the manner in which it had regard to the turnover of ByteDance in determining the amount of the actual fines, as distinct from the fining caps. I note that TikTok also complains, under Ground 8, that the Decision is deficient in failing to give reasons sufficient to explain how the DPC treated ByteDance’s turnover when calculating the administrative fines. It is apparent from the DPC’s opposition to this ground of appeal, however, that the DPC disputes that the turnover of ByteDance has the limited relevance for which TikTok contends.

137. TikTok accepts that the turnover of the undertaking of which a controller forms part may have some relevance in determining the amount of a fine, but contends that it can only operate as an “adjustment mechanism” to ensure that any proposed fine, which must, in the

47 first instance, be calculated solely by reference to the criteria in Article 83(2), is effective, proportionate and dissuasive.

Arguments

138. During the Inquiry, TikTok argued that the turnover of the undertaking was only relevant for the purpose of determining fining caps and had no relevance for the purpose of determining the actual amount of a fine. It pointed out that there is no reference to “undertaking” or “turnover” in the factors to which regard must be had when calculating a fine set out in Article 83(2).

139. In light of the decision in ILVA, TikTok has modified its position. It now contends that the DPC was required first to calculate the amount of the fine by reference to Article 83(2), and only then consider whether it was necessary to adjust that figure in light of the undertaking’s turnover to ensure that the requirements of Article 83(1) were met. It relies in this regard, on observations of the Advocate General in ILVA:

“41 In that regard, the Commission argues, in essence, that, in the present case, the GDPR implies that not only must the maximum amount of the fine be based on the turnover of the undertaking to which the company belongs, but so must the calculation of the actual fine. However, the considerations that have been laid out in points 37 to 40 of the present Opinion do not permit the conclusion that Article 83(1) to (6) of the GDPR is to be interpreted as meaning that the rules for establishing the maximum amount of the fine (step 1) must also be used as the main or only reference for setting the actual fine (step 2).

…

46 Thus, the foregoing considerations and the Court’s case-law (cited in point 40 of the present Opinion) lead me to conclude that the principle of legality must frame the limits of the impact of EU competition case-law on the imposition of actual fines for GDPR infringements. In particular, it must be ensured that the actual GDPR fines are calculated solely in relation to the acts of the perpetrator and take fully into account all the characteristics of the specific infringement. Therefore, the interpretation of the

48 concepts of ‘turnover’ and ‘undertaking’ when setting the maximum amount of the fine cannot automatically be grafted onto the calculation of the actual fine.

47 For a fine to meet the objective of the GDPR – to strengthen the enforcement of the rules of that regulation – and in the light of the Court’s case-law discussed above, the interpretation of the terms ‘undertaking’ and ‘turnover’ when setting the amount of the actual fine should comply with the following requirements. In the process of determining the actual fine, the supervisory authority must, first, take as a basis all the individual circumstances of that specific case, as required by Article 83(2) of the GDPR, including the relationship within the ‘undertaking’ as determined by the EU competition case-law. Second, as a result of the balancing of all the relevant circumstances, the actual fine must be effective, proportionate and dissuasive. Lastly, yet importantly, where appropriate, aspects of criminal law relevant to the case must be respected.

…

57 Therefore, to my mind, it should be possible to rely on the concept of ‘undertaking’ within the meaning of Articles 101 and 102 TFEU when fixing the actual fine, but only where this is duly justified for the purposes of the dissuasiveness and effectiveness of the fine. Indeed, in that respect, the use of that concept must be nuanced and individualised in each given case. More specifically, it may be used as an adjustment mechanism when considering the specific circumstances of an individual case once the fine in accordance with Article 83(2) of the GDPR has been established. It is therefore incumbent on the referring court to determine whether, in the present case, circumstances exist would justify increasing the fine in such a manner, in particular, for the purposes of deterrence.”

140. There is clearly, therefore, support for TikTok’s contention that the calculation of an administrative fine is a two-step process, with the turnover of the undertaking of which a controller forms part relevant only as an adjustment mechanism at the second stage.

141. The DPC argues for a more holistic approach to calculating the fine and highlights that the court’s judgment in ILVA does not stipulate the same rigidly structured approach as

49 suggested by the Advocate General. It contends that its approach is consistent with the GDPR Fining Guidelines.

142. Although the Decision does not expressly state how the DPC took into account the turnover of ByteDance in calculating the fine, references at §769 and §779 of the Decision illustrate that it was not merely relied on as an adjustment mechanism. As stated at §769 “the DPC has taken the significant turnover of the undertaking concerned into account when determining the quantum of the fines, as set out below.”

143. The DPC highlights the change in treatment of the turnover of ByteDance between the PDD and the Decision. In the PDD, it was addressed as a relevant factor under Article 83(2)(k), but not in the Decision. In oral submissions, the DPC said that it realised that this was incorrect in light of Deutsche Wohnen and ILVA, decided post-PDD but before the Draft Decision, and that “it needs to take it into account elsewhere” (Transcript Day 9, page 40). As noted above, however, that this did not trigger any apparent adjustment in the amount of the fines, the fines ultimately imposed falling within the range proposed in the PDD.

144. During the course of the hearing, I had the following exchange with counsel for the DPC (Transcript Day 9, pp. 41 – 42):

MR. JUSTICE MULCAHY: Given the scale of the fines actually imposed, in the region of 500 million, the reasonable inference is, maybe not your starting point, but they were set by reference to the turnover of ByteDance, because otherwise why would they not be 5 million as opposed to 500 million? 500 million as a level can only really be understood by reference to -- MS. SMITH: Oh, to the reference to the turnover of ByteDance? MR. JUSTICE MULCAHY: Yes. MS. SMITH: Absolutely. And the DPC says it took into account the turnover the ByteDance.

145. It seems clear, therefore, that the administrative fines were calculated by reference to the turnover of ByteDance, not simply adjusted by reference to it.

50 Discussion

146. The question posed by this ground of appeal is at what point does the turnover of the undertaking of which a controller forms part come into the consideration of the amount of any administrative fine for a breach of the GDPR, it being accepted that that the turnover figure is a relevant consideration. To a certain extent, the dispute between the parties comes down to a dispute regarding where the starting point should be for a supervisory authority in calculating administrative fines.

147. TikTok argues that the administrative fine should, in the first instance, be calculated solely by reference to the criteria in Article 83(2) and then subjected to review in light of the turnover of the undertaking in order to ensure that it meets the Article 83(1) criteria. Although a stepped approach is consistent with the GDPR Fining Guidelines, as discussed above, the GDPR Fining Guidelines make clear that the starting point for the calculation of a fine involves a consideration of the seriousness of the offence and the turnover of the undertaking. As noted in the GDPR Fining Guidelines, the structure of Article 83, which provides higher maximum penalties for breaches to which Article 83(5) apply than to breaches to which Article 83(4) apply reflects the link between turnover and seriousness of offence.

148. TikTok argue that the GDPR Fining Guidelines were issued before ILVA was decided and are, therefore, of no relevance in this instance.

149. Taken by itself, the Advocate General’s opinion provides persuasive support for TikTok’s view of the correct starting point. One is left to wonder, however, how a consideration of the criteria in Article 83(2) alone could be said to provide a starting point. Other than Article 83(2)(k) which refers to the financial benefit gained or losses avoided by an infringement, the application of those criteria could provide little or no guidance on what level of fine might be appropriate as a starting point. In the paper submitted by the parties in which they set out the questions which they proposed should be referred to the CJEU, the DPC suggests that TikTok’s position is that the fine is calculated by reference to the turnover of the controller, subject to adjustment in light of the turnover of the undertaking of which it forms part in order to ensure that the fine is effective, proportionate and dissuasive. If that

51 is TikTok’s position, it is difficult to see where support for such a bifurcated view can be found in the language of the GDPR.

150. Of course, the Advocate General’s opinion was not the last word on this issue, and it is to the CJEU’s decision which we must look for guidance. What that decision appears to envisage is that the individual provisions in Article 83 operate together and a fine must be calculated by reference to all relevant criteria. This would allow for consideration of the undertaking’s turnover, as the DPC suggest, as a relevant factor in calculating the fine.

151. The turnover of the undertaking determines the maximum fine which can be imposed. If consideration of the turnover had to be entirely excluded at the initial stage, this would create the anomalous position that a supervisory authority would have to calculate a fine without regard to the maximum fine which could be imposed. TikTok did not identify any other instance where a regulator or court was required to disregard the maximum penalty when calculating a sanction. Typically, the maximum, and thus the range of penalties which can be imposed, is central to the calculation of the penalty. Moreover, as stated in Groupe Gascogne, turnover is the best means of determining an undertaking’s ability to pay.

152. The court did not, however, expressly disagree with the approach advocated by the Advocate General. The correct approach to the treatment of an undertaking’s turnover when calculating a fine is not, therefore, acte clair. If, as she suggests, the turnover of the undertaking can only be considered as an adjustment mechanism to ensure that a fine is effective, proportionate and dissuasive, this has the potential to have a significant impact on the fines imposed on TikTok for its infringements of the GDPR. In light of the factors considered above, it is appropriate to refer the following question to the CJEU for its determination:

(3) When determining the amount of the fine to be imposed on a controller which forms part of an undertaking, is a supervisory authority required first to determine the amount of the fine solely by reference to the factors specified in Article 83(2) GDPR, and only then have regard to the turnover of the undertaking of which the controller forms part to ensure that the amount determined by reference to Article 83(2) is effective, proportionate and dissuasive, as required by Article 83(1) GDPR or is the turnover of the

52 undertaking relevant from the outset of the supervisory authority’s consideration of the fine to be imposed?

Error in having regard to worldwide turnover

153. Finally in relation to Ground 7, TikTok argues that the DPC should only have had regard to the turnover to which the infringement relates, being, it claims “the profits earned in the EEA.” TikTok does not offer any interpretation of Articles 83(4) to (6) which would require a supervisory authority to consider only the turnover, still less the profit, earned in the EU or EEA. Such an interpretation is expressly contradicted by ILVA (see §36 quoted above).

154. The “profits earned in the EEA” or the turnover of the controller could be a relevant consideration pursuant to Article 83(2)(k). And of course, in seeking to ensure a fine is effective, proportionate and dissuasive, a supervisory authority is required to consider the actual or material capacity of the recipient of the fine. However, that does not mean that the DPC erred in having regard to the turnover of ByteDance when calculating either the maximum penalty which could be imposed or in calculating the actual fine. Having regard to the evidence before it, there was no error by the DPC in this respect.

Ground 9 – Errors in interpretation of Article 83

155. Ground 8 comprises a series of allegations that the Decision is inadequately reasoned. As part of Ground 9, TikTok alleges errors by the DPC in its conclusions regarding various aspects of the Decision which relate to the amount of the administrative fines. There is, accordingly, a significant degree of overlap between the grounds. As noted above and in the main judgment, in an appeal on the record, it does not follow from a breach of fair procedures, including a failure to give reasons, that any adjustment should be made to the amount of the administrative fines imposed. Put simply, if I agree on the evidence with the DPC’s conclusions on the issues identified, then TikTok will not have identified a basis to interfere with those conclusions. Of course, if a decision of the DPC is inadequately

53 reasoned, there will likely be greater scope for a controller in persuading a court that the administrative fines imposed by it should not be confirmed.

156. In light of the foregoing, I propose to address Ground 9 of the grounds of appeal before addressing Ground 8.

157. TikTok allege four errors by the DPC in its application of Article 83.

158. First it alleges that the administrative fine imposed for infringement of Article 46(1) was in substance a finding of a breach of Article 24 of the GDPR for which no administrative fine can be imposed. I have addressed that argument and rejected it in the main judgment (at §243) and do not propose to consider it further here.

159. Second, it alleges that the DPC erred in the manner it dealt with a number of criteria in Article 83(2) and, in particular, the manner in which it assessed whether certain matters were aggravating or mitigating factors.

160. Third, it suggests that there was a failure to determine whether there was compliance with the Article 83(1) obligation that any fine be effective, proportionate and dissuasive.

161. And fourth, it contends that Article 83(3) prohibits aggregation of fines, so that the total fine imposed on it should have been limited to the fine imposed for the infringement of Article 46(1), the gravest infringement, and no additional fine should have been levied for the infringement of Article 13(1)(f).

162. I note that the parties have agreed the terms of questions which may be referred to the CJEU for determination. However, the legal issues which arise will depend on the facts as found. As will appear, a number of the questions proposed do not fall for consideration in light of my conclusions on the facts.

54 Error in treatment of Article 83(2) criteria

Arguments

163. TikTok complains about the DPC’s approach to several of the criteria contained in Article 83(2). In relation to Articles 83(2)(a), it complains that the DPC erred in concluding that a large number of data subjects were affected and had suffered damage. It considers this finding unsustainable in light of the DPC’s overall ‘negative’ finding, i.e. that TikTok hadn’t adequately assessed the level of protection afforded to personal data transferred to China, rather than that there was not, in fact, adequate protection.

164. As noted above, the DPC concluded that by transferring data subjects’ data to a country which did not guarantee effectively equivalent protection to that available in the EEA, and without verifying that such protection could be guaranteed, the users had lost control of their data and risked interference with their fundamental rights. TikTok contend that this was not a finding which was open to the DPC.

165. TikTok makes a series of other complaints about the DPC’s treatment of Article 83(2)(a). First it complains that the DPC separately considered the nature, the gravity and the duration of the infringement, concluding that each was aggravating, “compounding the weight attributable to this criterion”. Second, it argues that the DPC was not entitled to conclude that the infringement was “serious”. Third, it contends that the DPC failed to have regard to the reduced risks because of its supplementary measures. For those reasons, it disputes the DPC’s conclusion that the gravity of the infringement was high. It also disputes, as unsupported by evidence, the DPC’s conclusion that TikTok’s transparency failings were likely to have affected users’ engagement with the TikTok platform (see §733 of the Decision).

166. In relation to Article 83(2)(b), the negligent character of the infringements, TikTok says that the DPC should have treated the fact that it concluded that the infringements were negligent rather than intentional as a mitigating or neutral factor rather than as aggravating.

167. TikTok argues that the actions taken by it to mitigate the damage suffered by data subjects, Article 83(2)(c), should have been treated as a mitigating factor. It contends that

55 the DPC’s conclusion that because TikTok did not accept that there was an infringement, nothing arose under this criterion would, if correct, mean that it was a condition precedent to mitigation that a controller not defend itself.

168. It disputes the DPC’s assessment of its degree of responsibility, per Article 83(2)(d), as an aggravating factor of significant weight. It argues, inter alia, that this is not reconcilable with the DPC’s finding that the infringements were not intentional, and ignores the supplementary measures implemented by TikTok. It makes the same point regarding failure to take into account the supplementary measures in relation to Article 83(2)(g), regarding the categories of personal data affected by the infringement.

169. In relation to Articles 83(2)(e), the absence of previous infringements, and 83(2)(f), the fact that it co-operated fully, it argues that these should have been treated as mitigating factors rather than neutral as concluded by the DPC.

170. It contends that insufficient weight was given to the effect of the suspension order as a mitigating factor when considering Article 83(2)(k).

171. In its written submissions, the DPC dismisses these complaints as “in substance merits- based complaints regarding the weight afforded to specific factors, and to specific evidence” which, it says, manifestly do not meet the standard for review (at §296). It says that TikTok has misinterpreted the requirements of Articles 83(2)(a) – (g) and (k).

Discussion

172. As is apparent from TikTok’s submissions, it treats each of the criteria in Article 83(2) as potentially mitigating, aggravating or neutral factors in determining the amount of administrative fines. As noted above, if, as TikTok contend, the starting point for the calculation of an administrative fine is the criteria in Article 83(2), it is not clear how TikTok contend that the treatment of each criterion in terms of mitigation/aggravation would enable a supervisory authority to calculate a fine at all.

173. There is some support for this approach to Article 83(2). Article 83(2)(k) appears to be something of a catch-all provision and refers to “any other aggravating or mitigating factor

56 applicable to the circumstances of the case,” indicating that the other criteria should also be considered as potentially aggravating or mitigating. This suggests, of course, that these are not the only matters to which a supervisory authority can have regard when calculating the appropriate fine to be imposed.

174. It is also consistent with the GDPR Fining Guidelines to assess the criteria on the basis that they may be either aggravating or mitigating. Contrary to TikTok’s submissions, however, there is no basis for contending that any of the criteria should be considered a priori as not being capable of being either aggravating or mitigating.

175. The DPC’s objection that these are merits-based complaints which do not meet the threshold for review is based on its contention that the threshold for review was that in an appeal against error in which the standard in Orange Limited v Director of Telecoms [2000] 4 IR 159 is applied. Since its submissions were prepared, the decision in LinkedIn has determined that the appeals under sections 142 and 150 of the 2018 Act are appeals on the record. It is, accordingly, open to TikTok to pursue merits-based complaints. The DPC’s objection does highlight, however, that these appeal grounds, in the main, give rise to factual rather than legal complaints, and to the question of whether the DPC’s characterisation of certain matters as aggravating (or neutral) was justified on the evidence. Although the parties have suggested questions for referral to the CJEU in relation to this ground of appeal, it seems to me that the issues are ones of fact, or of judgment in light of certain facts, rather than issues of law, and are, therefore, not appropriate for referral.

176. In relation to TikTok’s complaint about Article 83(2)(a), I do not accept that there was any error in separately treating each of the nature, the gravity and the duration of the infringements as aggravating. Although all are contained within the same sub-article, it is clear that each can operate independently of the other.

177. Nor do I see how it can be argued that the DPC failed to have regard to supplementary measures which were introduced after the period of infringement. The fine was imposed for infringements during the temporal scope, up to May 2023 (or December 2022 in the case of the Article 13(1)(f) infringement). Supplementary measures introduced after those dates could not affect the nature, gravity or duration of the infringement.

57 178. The most substantial complaint is that the DPC erred in treating the number of data subjects affected and the damage suffered by them as aggravating factors. I do not agree that there was any error by the DPC in this regard. These were aggravating factors.

179. As determined in the main judgment, the DPC was not required to show that there was in fact a lack of essentially equivalent protection for personal data transferred to China, still less, that that lack of essentially equivalent protection had led to any actual breach of data subjects’ rights. Rather, I concluded that in order to establish an infringement, it was sufficient for the DPC to show that TikTok had failed to demonstrate that there was essentially equivalent protection, i.e. that data subjects’ rights were guaranteed. That was the infringement found by the DPC and that is the infringement in respect of which it is necessary to consider whether data subjects were affected and what damage was suffered.

180. Clearly, where TikTok had failed to demonstrate essentially equivalent protection for any personal data transferred to China, all the data subjects whose data was transferred were affected by that infringement. Given the number of data subjects involved, this was clearly an aggravating factor.

181. And in respect of all of those data subjects, in the absence of TikTok demonstrating essentially equivalent protection, they went from a position where their personal data was afforded the protection of the GDPR to a situation where that protection was not guaranteed and could, potentially, be at risk. In other words, they lost one of the fundamental benefits of the GDPR, the guarantee of certain rights. I cannot see any error by the DPC in regarding that as damage which was an aggravating factor.

182. Similarly, the fact that TikTok’s 2021 Privacy Policy did not meet the transparency requirements of the GDPR affected all of TikTok’s many users. Every data subject was deprived of adequate information regarding the treatment of their personal data during the period that the 2021 Privacy Policy was in place. This must also be regarded as damage capable of being considered an aggravating factor.

183. For the same reasons, the complaint in relation to Article 83(2)(g) must be rejected. All of the categories of personal data transferred to China were affected by the infringements.

58 184. In relation to the suggestion that negligence could not be considered an aggravating factor, this, in my view, is a misinterpretation of Article 83(2)(b). There is nothing in it to suggest that infringements should be strictly divided between those which are intentional, which should be regarded as aggravating, and those which are negligent, which must be regarded as a mitigating or at least neutral factor. There are clearly degrees of negligence, and, for that matter, degrees of intentionality.

185. The DPC concluded, in relation to the Article 46(1) infringement, that TikTok was negligent to a high degree. In my view, this was an entirely reasonable conclusion based on the evidence. As set out in the main judgment, TikTok’s fundamental obligation under Article 46(1) was to assess the level of protection afforded to personal data actually transferred to a third country, i.e. the data remotely accessed from China. Instead, it consistently addressed the level of protection afforded to personal data which could be accessed from China, i.e. the data remotely accessible from China. Its suggestion that the assessment of the latter necessarily encompassed the former was ultimately belied by its own evidence, the third Xu opinion. In the circumstances, TikTok failed, without providing any adequate explanation, to discharge its principal duty under Article 46(1). This could only be regarded as negligent to a high degree, to the point where its negligence ought properly to be regarded as an aggravating factor.

186. Similarly, the deficiencies in the 2021 Privacy Policy were significant and, in truth, very difficult to understand. The identification of the third countries, in particular China, to which personal data was being transferred was so obviously information which ought to have been included in the policy that the DPC’s acceptance that this was negligent rather than intentional can only be regarded as extremely forgiving. If not intentional, and I do not propose to look behind the DPC’s conclusion in this regard, it can only be regarded as negligent to a degree which should be regarded as aggravating.

187. It is difficult to understand TikTok’s complaint in relation to Article 83(2)(c). Clearly, a controller, once it becomes aware of an alleged infringement can take steps to address it. If it does, especially if it does so promptly, this could be regarded as a mitigating factor. It could, of course, take such steps without accepting that there has been an infringement.

188. Similarly, a controller could deny the alleged infringement and take no steps to address it. If the controller is proved wrong, and an infringement is found, it runs the risk that its

59 failure to take prompt action to address it will be regarded as an aggravating factor. In relation to the infringements as found in this case, during the temporal scope in the case of Article 46(1), and until the 2022 Privacy Policy was introduced in the case of Article 13(1)(f), TikTok does not argue that it took steps to mitigate the damage caused to data subjects, or, put otherwise, to address its infringing behaviour. There is, accordingly, no basis for complaint that this was not treated as a mitigating measure.

189. Similarly, there is no substance to TikTok’s complaint that its degree of responsibility for the infringements was not an aggravating factor. TikTok arranged its business in such a way that its standard operation involved the transfer of huge volumes of personal data outside the EEA, to China. It was TikTok’s responsibility to ensure that there was effectively equivalent protection available for that data in China. It failed to do so. It was TikTok’s responsibility to ensure that it was transparent about those transfers. It was not.

190. The fact that there were no previous relevant infringements by TikTok should, I think have been regarded as a mitigating factor for the purpose of Article 83(2)(e). It is not clear to me why the DPC did not consider it to be a mitigating factor.

191. TikTok has misunderstood the criteria at Article 83(2)(f). It does not relate to co- operation in an inquiry, it relates to the degree of co-operation in remedying the infringement and mitigating the impacts of the infringement. The DPC’s conclusion that TikTok’s full co-operation with it in the Inquiry was not a mitigating factor cannot, therefore, be faulted.

192. Finally, as regards TikTok’s complaint that greater weight as a mitigating factor should have been given to the burden of complying with the suspension order for the purpose of Article 83(2)(k), in my view, this should not have been regarded as a mitigating factor at all, or given very little weight. In the stay judgment (at §216), I made the point that the fact that TikTok has arranged its business in such a way that it necessitates transferring large amounts of personal data outside the EEA was not a basis for complaint if a requirement to comply with the GDPR had a disproportionate financial effect on it. Similarly, where, because of the manner in which it operates its business, the cost of complying with a corrective order is significant, this should not put TikTok in a better position with regard to the assessment of an appropriate fine than a company which, in order to comply with the GDPR, would not have to incur such costs.

60 193. I have, accordingly, identified two of the criteria in Article 83(2) where I disagree with the DPC’s interpretation of whether they constituted aggravating or mitigating factors. The fact that there had been no previous infringements should have been treated as a mitigating factor. The fact that TikTok will incur significant costs in complying with the corrective order, i.e., in complying with the GDPR, should not.

194. On a crude analysis, it might be suggested that these two issues cancel each other out. In truth, I think that the difference between the DPC’s analysis and mine has operated to the benefit of TikTok.

195. In light of the foregoing, I see no basis to interfere with the Decision by reference to the DPC’s application of Article 83(2).

Failure to determine whether compliance with Article 83(1)

Arguments

196. TikTok contends that the assessment by the DPC of whether the fines met the requirement of Article 83(1) to be effective, proportionate and dissuasive failed to comply with the criteria identified in Case C-544/19, Ecotex Bulgaria, a case concerning a fine imposed for breach of rules concerning the movement of capital. In those proceedings, the court concluded that the range of penalties provided in the relevant Bulgarian legislation did not go beyond what was necessary for the purpose of achieving the objectives of the legislation, in that case combatting tax evasion and avoidance. However, it stated (at §109):

“… it is ultimately for the referring court to carry out the concrete examination of the proportionality of that legislation, taking account in particular of the imperatives of suppression and prevention, as well as the amounts at issue and the level of the penalties actually imposed.”

197. TikTok relies on the affidavit of Ms Fox at §498 - §518 in which she makes a series of averments in relation to the proportionality of the fines which reflect arguments made under other headings, e.g. that the turnover of the TikTok platform forms a small part of the

61 turnover of ByteDance, and that the DPC had erred in its assessment of various of the Article 83(2) criteria.

198. The DPC’s response, in its Statement of Opposition is that, in effect, it did give adequate consideration to the question of whether the administrative fines proposed were effective, proportionate and dissuasive.

Discussion

199. TikTok’s complaint under this heading is, in substance, a reiteration of its arguments that the DPC erred in the manner in which it factored the turnover of ByteDance into its assessment of the administrative fines and in which it assessed the factors in Article 83(2). I have either rejected those grounds or, in the case of the treatment of ByteDance’s turnover, I do not consider that the complaint under this heading adds anything to those grounds.

200. The Decision considered in detail whether the administrative fines proposed were effective, proportionate and dissuasive (see §770 - §780). Assuming for the purpose of this argument, that there was no error by the DPC in the manner in which it incorporated the turnover of ByteDance into its assessment of the administrative fines, then TikTok has not established any error by it in its assessment of proportionality.

201. The GDPR determines the range of acceptable penalties for infringements thereof. Whereas in Ecotex Bulgaria, the court was required to examine whether that range went beyond what was necessary to ensure the objectives of the regulatory regime at issue in those proceedings, in the absence of a challenge to the GDPR, it must be taken that the sanctions permitted under Article 83 also do not go further than is necessary to meet the objectives of the GDPR. In that regard, it is apparent that the GDPR allows for the imposition of very substantial fines for infringements.

202. The fines imposed in this case were well within what was permitted by the GDPR. In Case T-141/08, E.ON Energie, the court considered the proportionality of a fine of €38 million for breach of a seal placed by the authorities on a premises during the course of an investigation. It rejected arguments similar to those made by TikTok here. It noted (at §294):

62 “Fourthly, contrary to what the applicant maintains, a fine of EUR 38 million cannot be regarded as disproportionate to the infringement, in the light of the particularly serious nature of a breach of seal, the size of the applicant and the need to ensure that the fine has a sufficiently deterrent effect, in order that it cannot pay for an undertaking to break a seal affixed by the Commission in the context of inspections.”

203. The court also noted that the fine was just 0.14% of the appellant’s turnover in concluding that it was not disproportionate. The fine here is less than 1% of ByteDance’s 2024 turnover.

204. As the DPC point out, the GDPR Fining Guidelines (and, for that matter, the Competition Fining Guidelines discussed below) suggest a high threshold for establishing that a fine is disproportionate due to inability to pay, the party must show that payment of the fine would create an existential risk for it. TikTok’s evidence doesn’t remotely approach that threshold. There is no suggestion of a risk to TikTok by reason of the fine. I note that in the context of the stay application, where there was an argument that TikTok would have to show an existential risk to it if it did not obtain a stay, TikTok did not assert such a risk notwithstanding that the cost of implementing the corrective orders was said to be a multiple of the administrative fines.

205. Insofar as TikTok contend that the burden of implementing the corrective orders had sufficient deterrent effect such that no administrative fine was required, this is plainly incorrect. The corrective order requires TikTok to comply with the GDPR. There would be no deterrent effect of a sanction if the consequence of failing to comply with the GDPR was limited to incurring the cost, going forward, of complying with it.

206. Accordingly, there is no basis to interfere with the DPC’s decision by reference to its application of Article 83(1).

Misinterpretation of Article 83(3)

207. The last issue which requires to be addressed under Ground 9 is TikTok’s complaint that the DPC erred in its interpretation of Article 83(3) by applying an additional fine for the infringement of Article 13(1)(f) having already imposed a larger fine for the infringement

63 of Article 46(1). This ground of appeal turns on the proper interpretation of Article 83(3) concerning which there are conflicting precedents.

Arguments

208. The infringements of Article 13(1)(f) and Article 46 both relate to the same processing operations, the transfer of data subjects’ personal data to China by way of remote access. The parties agree, therefore, that Article 83(3) is engaged, and the total amount of the administrative fine imposed for the two infringements could not exceed “the amount specified for the gravest infringement”. They disagree about what that phrase means.

209. TikTok contends that it refers to the fine specified by the supervisory authority. Accordingly, it is always impermissible to aggregate fines for infringements which arise out of the same or linked processing operations. Once the fine for the gravest infringement is fixed, no additional fine can be levied. It draws support for this interpretation from the comments of the Advocate General in NVSC, quoted above, to the effect that Article 83(3) contains a “general rule precluding the aggregation of administrative fines”. Although the Advocate General was referring to Article 83(3) in the context of an examination of whether a finding of negligence or intention was a prerequisite to the imposition of an administrative fine, it is clear from his observations that he considered that there was, as he called it, a rule against aggregation.

210. The DPC contend that ‘specified’ refers to the maximum fine specified in the GDPR. It draws support from the WhatsApp Decision, discussed above. In the draft decision of the DPC the subject of that decision, the DPC had, in fact, adopted the interpretation advocated by TikTok here and imposed a sanction for only one of three concurrent infringements. The EDPB rejected that interpretation as contrary to the effet utile principle.

Discussion

211. Unsurprisingly given the conflicting views expressed in the Advocate General’s opinion and the WhatsApp Decision, the parties have identified this is an issue which it would be appropriate to refer to the CJEU for its opinion. Although the reasoning of the EDPB is

64 compelling, I agree that this issue is not acte clair. It seems likely that it will be an issue which falls for determination in the WhatsApp proceedings and, indeed, is an issue which will likely arise frequently.

212. In the circumstances, I propose referring the following further question to the CJEU pursuant to Article 267 of the TFEU:

(4) Where the same or linked processing operations give rise to the infringement by a controller of two or more provisions of the GDPR, and the competent supervisory authority has proposed separate administrative fines for the infringement of each such provision, does Article 83(3) GDPR preclude the aggregation by the competent supervisory authority of the amount of the fines it has proposed for the infringement of the provisions in question, or is it permissible to aggregate the fines, subject to the total amount of the fine not exceeding the maximum permitted by Articles 84(4) – (6)?

Ground 8 – Failure to give reasons for the fining decision

213. In its written submissions, TikTok identifies no less than ten aspects of the fining decision in respect of which the DPC did not provide adequate reasons. Its main focus in oral submissions was on the failure by the DPC to identify a ‘basic’ fine and show how it was adjusted in light of aggravating and mitigating factors, and on the failure of the DPC to make clear how it had had regard to the turnover of ByteDance in making its decision.

214. It also makes complaints under this ground regarding the reasoning of the proportionality assessment, regarding the finding that TikTok was negligent to a high degree, and the DPC’s findings in relation to the factors considered at Article 83(2)(a) to Article 83(2)(k). In light of my conclusions above, those complaints fall away.

215. Similarly, the complaints that the supplementary measures put in place by TikTok after the temporal scope were not considered is addressed above, as is the complaint about DPC’s conclusion that a fine was appropriate notwithstanding the corrective orders. Its complaint

65 that the decision to disregard TikTok’s arguments regarding the role of ByteDance and of TikTok UK also falls away in light of the conclusions already reached in this judgment.

Arguments

216. TikTok’s submissions make a number of general observations regarding the duty to give reasons. It refers to the decision in Elf Aquitaine, one of a number of decisions of the CJEU in which it made the following observations in relation to the duty to give reasons, in that case by reference to Article 253 of the Treaty of Rome, now Article 296 of the TFEU (at §147):

“In that vein, the statement of reasons required under Article 253 EC must be appropriate to the measure at issue and must disclose in a clear and unequivocal fashion the reasoning followed by the institution which adopted that measure in such a way as to enable the persons concerned to ascertain the reasons for it and to enable the competent Court of the European Union to exercise its jurisdiction to review legality (see France v Commission, paragraph 35, and Deutsche Telekom v Commission, paragraph 130).”

217. It also contends that in relation to fines, the reasoning must be sufficient to put an applicant in a position to assess the validity of the adjustment to the fines and cites Case T- 15/02, BASF at §131. In fact, the thrust of that part of the decision in BASF is to almost opposite effect to that contended for by TikTok:

“Inasmuch as the applicant complains that the reasoning for this adjustment of the general starting amounts is inadequate, it is sufficient, in order to reject that complaint, to point out that, although the Decision does not indicate how the Commission determined those specific amounts on the basis of the size of the various markets at issue, the Court of Justice has held that the essential procedural requirement to state reasons is satisfied where the Commission indicates in its decision the factors which enabled it to determine the gravity of the infringement and its duration and that it is not obliged to give in it a more detailed explanation or to indicate the figures relating to the method of calculating the fine … … Moreover, once the defendant made clear during the proceedings what data it used to assess the size of the markets, the applicant was in

66 a position to assess the validity of the adjustment at issue here and, where appropriate, to raise complaints in that regard.”

218. In other words, the sort of granular or mechanical calculation contended for by TikTok is not required.

219. TikTok also refer to both the fining guidelines adopted by the Commission in relation to fines for competition law infringements, Guidelines on the method of setting fines imposed pursuant to Article 23(2)(a) of Regulation No /2003 (“the Competition Fining Guidelines”), and to the GDPR Fining Guidelines.

220. As appears from the Competition Fining Guidelines, the Commission undertook to use a particular method when imposing fines. First, it will assess the ‘basic’ amount of a fine. The Guidelines set out a methodology for so doing, by reference to the value of sales of the relevant undertaking. Having calculated the basic amount, the Commission will then make adjustments up, where there are aggravating circumstances, or down, where there are mitigating factors.

221. The guidance notes that this second stage “will be carried out on the basis of an overall assessment which takes account of all the relevant circumstances.”

222. The adjusted figure is then checked against the legally permissible maximum.

223. The Competition Fining Guidelines also note that in “exceptional circumstances”, the Commission will take into account inability to pay. However, the Commission:

… will not base any reduction granted for this reason in the fine on the mere finding of an adverse or loss-making financial situation. A reduction could be granted solely on the basis of objective evidence that imposition of the fine as provided for in these Guidelines would irretrievably jeopardise the economic viability of the undertaking concerned and cause its assets to lose all their value.

224. The GDPR Fining Guidelines are discussed above and include similar advice regarding the exceptional circumstances in which an inability to pay might be relevant, noting that a party would have to show “that it will likely exit the market” if a fine was imposed.

67 225. The GDPR Fining Guidelines provide for a stepped approach, but somewhat less structured than the Competition Fining Guidelines. TikTok contend that the GDPR Fining Guidelines are inconsistent with ILVA.

226. The DPC maintains that the reasons given in the Decision are adequate. It points out that the Competition Fining Guidelines represent a voluntary decision by the Commission to approach the calculation of fines in a particular way and have no application here. Accordingly, it argues, it was not required to explain its methodology in the manner contended by TikTok, i.e. to set out a basic figure and then show how it was adjusted up or down in light of aggravating or mitigating circumstances.

227. It refers to the decision in Case C-298/98P, Metsä-Serla, a competition law case which pre-dated the adoption of fining guidelines, in which the court concluded that there was no obligation on the Commission to indicate in its decision the figures relating to the method of calculating the fines (at §51).

Discussion

228. TikTok are correct that the Decision does not indicate a ‘base’ or ‘basic’ fine to be adjusted by reference to aggravating or mitigating figures, still less does it explain how the mitigating and aggravating factors were applied. The question, of course, is whether that was required.

229. It is difficult to identify any basis for the contention, insofar as it is TikTok’s case, that the DPC was required to show by some form of mathematical calculation how it adjusted any proposed fine in light of aggravating or mitigating factors. Even the Competition Fining Guidelines, which of course have no application here, do not suggest such an approach, rather the Commission commits to an “overall assessment” of those factors. This is entirely consistent with the case law relied on by both parties and is what the DPC did in this case. There was thus no error by it in its approach and no basis for interfering with its Decision on this basis.

68 230. If there is no requirement to show adjustments to a basic figure, only to show that the relevant matters have been considered, it is difficult to see why it would be necessary to identify a basic figure from which the adjustments are to be made.

231. However, during the hearing of the case I raised a concern that it was entirely unclear to me why what was being proposed were fines totalling in excess of €500 million, not orders of magnitude less (or more). This is not explained in the Decision. It seems to me, as already suggested, that the only possible explanation, though not expressed, is that the scale of the fines was informed by the maximum fine which could be imposed and, accordingly, indirectly, by the turnover of ByteDance.

232. Though this seems to me to be a logical manner of approaching the calculation of fines, in light of the Advocate General’s comments in ILVA, there must be a question as to whether this is permissible. The third question proposed for reference to the CJEU is intended to resolve this issue.

Summary of conclusions

233. The DPC had regard to the turnover of ByteDance in calculating the administrative fines. It did not, however, impute liability for TikTok’s infringements to ByteDance, nor did it seek to make ByteDance liable for those fines. ByteDance was not afforded an opportunity to be heard which would satisfy the rights of defence if those rights were engaged

234. An issue arises as to whether the DPC was required to impute liability and/or impose the fines on ByteDance if relying on its turnover, and regarding the extent, if any, to which ByteDance was required to be afforded an opportunity to be heard in the Inquiry which requires to be referred to the CJEU for determination.

235. An issue also arises as to how the turnover of the undertaking of which TikTok forms part should be incorporated as a consideration in the calculation of the appropriate fine to be imposed. This issue also requires to be referred to the CJEU for determination.

69 236. The two infringements in this case arose from the same processing operations. A further issue arises concerning the interpretation of Article 83(3) and whether it permits aggregation of fines where more than one infringement arises from the same or linked processing operations. This question will also be referred pursuant to Article 267.

237. Subject to clarification of the foregoing issues, I have concluded as follows.

238. The DPC was entitled to conclude that 2024 was the preceding financial year for the purpose of Article 83(5) of the GDPR. There was no culpable delay by the DPC in the progress of the Inquiry such as to require that data from an earlier year be used.

239. The DPC was entitled to find on the evidence that ByteDance exercised decisive influence over TikTok such that they formed an undertaking for the purpose of Article 83(5) and, accordingly, have regard to ByteDance’s turnover. The DPC was entitled to rely on the presumption of decisive influence having regard to the ownership of shareholdings in the ByteDance group. TikTok did not rebut that presumption.

240. There were limited errors by the DPC in its assessment of the criteria in Article 83(2). In particular, the fact that there had been no previous relevant infringements by TikTok should have been treated as a mitigating factor. The fact that TikTok will have to comply with the suspension order, i.e. comply with the GDPR, should not have been treated as a mitigating factor. These errors operated to the benefit of TikTok overall and do not merit revisiting the administrative fines imposed.

241. There was no failure by the DPC to consider whether the fines met the requirements of Article 83(1) of the GDPR.

242. Any inadequacy in the reasons given by the DPC for its fining decision are not such as to justify an interference with that decision in an appeal on the record.

70 Proposed questions to be referred to the CJEU for determination pursuant to Article 267 of the TFEU

243. Subject to any further observations of the parties, I propose referring the following questions:

(1) Where a supervisory authority proposes, when imposing an administrative fine on a controller, to have regard to the turnover of the undertaking of which the controller forms part in determining the maximum fine in accordance with Article 83(4), (5) or (6) GDPR and / or the amount of the fine in accordance with Article 83(1) and/or Article 83(2) GDPR, is the supervisory authority required to first:

(i) impute the conduct of the controller to the parent company (or other group member);

(ii) impute liability (jointly or otherwise) for the infringement(s) in issue to the controller’s parent company or other group member; and/or

(iii) notify the respondent’s parent company (or other group member) directly that it intends to take the turnover of the undertaking into account and afford it rights of the defence?

(2) If the answer to 1(iii) is ‘no’, where a supervisory authority intends to rely on the presumption of decisive influence to find that the controller concerned forms part of an undertaking, is the supervisory authority required to put the parent company on notice of its intention to do so and afford the parent company an opportunity to rebut that presumption?

(3) When determining the amount of the fine to be imposed on a controller which forms part of an undertaking, is a supervisory authority required first to determine the amount of the fine solely by reference to the factors specified in Article 83(2) GDPR, and only then having regard to the turnover of the undertaking of which the controller forms part to ensure that the amount determined by reference to Article 83(2) is effective, proportionate and dissuasive, as required by Article 83(1) GDPR or is the turnover of the

71 undertaking relevant from the outset of the supervisory authority’s consideration of the fine to be imposed?

(4) Where the same or linked processing operations give rise to the infringement by a controller of two or more provisions of the GDPR, and the competent supervisory authority has proposed separate administrative fines for the infringement of each such provision, does Article 83(3) GDPR preclude the aggregation by the competent supervisory authority of the amount of the fines it has proposed for the infringement of the provisions in question, or is it permissible to aggregate the fines, subject to the total amount of the fine not exceeding the maximum permitted by Articles 84(4) – (6)?

Conclusion

244. In light of the foregoing, I will invite the parties to prepare a draft Order for Reference for the court’s approval. As previously advised, I will list the matter for further mention on 10 July 2026 at 10.00 am.

72