Meta loses Irish High Court challenge over potential €430m fine
Published: 22/05/2026
| The Irish Times
Meta has lost its High Court challenge in Ireland against a draft decision by the Irish Data Protection Commission (DPC), which could result in a fine of up to €430 million and an order requiring system-wide corrective measures. In a 98-page judgment, Ms Justice Siobhán Phelan rejected all grounds of Meta's case, dismissing claims that the DPC had exceeded its statutory powers.
The legal proceedings stemmed from an October 2025 draft DPC decision, based on an investigation into a single data protection complaint filed by a Facebook user in July 2018. The user requested access to his personal data stored in a digital warehouse called Hive. Although Meta provided online tools to download the information, the complainant argued that additional personal data had been left unsent.
Following an investigation into violations of Articles 12, 15, and 20 of the EU General Data Protection Regulation (GDPR), the DPC signalled that it would order corrective measures and impose administrative fines ranging between €360 million and €430 million due to the significant impact of Meta's practices on millions of users.
Meta challenged the draft decision, arguing that the regulator had unlawfully expanded a complaint-based inquiry into a broader, own-volition investigation. The tech company claimed that systemic issues could only be addressed through separate, self-initiated regulatory inquiries. The DPC counter-argued that the legal challenge was premature and maintained that it was obliged to consider systemic effects when determining appropriate remedies for proven infringements.
The judge ruled that Meta's interpretation of the architecture of the GDPR and the [Irish] Data Protection Act 2018 was not legally sound. She determined that regulatory frameworks do not differentiate between complaint-based and own-volition inquiries regarding the extent of investigative or corrective powers available.
Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.
What is this page?
You are reading a summary article on the Privacy Newsfeed, a free resource for DPOs and other professionals with privacy or data protection responsibilities helping them stay informed of industry news all in one place. The information here is a brief snippet relating to a single piece of original content or several articles about a common topic or thread. The main contributor is listed in the top left-hand corner, just beneath the article title.
The Privacy Newsfeed monitors over 300 global publications, of which more than 3,250 summary articles have been posted to the online archive dating back to the beginning of 2020. A weekly roundup is available by email every Friday.