Facebook parent Meta has lost its challenge over a possible fine of up to €430 million, and possible orders affecting its general data access practices, following an inquiry into a single complaint relating to personal data processing.
In a judgment on Thursday, High Court judge Siobhán Phelan rejected all grounds of Meta’s case against the Data Protection Commission.
In its judicial review proceedings, Meta Platforms Ireland Ltd challenged the watchdog’s October 2025 draft decision following an inquiry into the complaint made in 2018.
The commission signalled an intent to make findings of infringements of Articles 12, 15 and 20 of the General Data Protection Regulation and to direct “corrective measures”, including a reprimand, a compliance order affecting Meta’s general data access practices (not just the complainant’s data access), and fines totalling €360-€430 million due to the significant impact of its practice on millions of users.
RM Block
The complaint was made in July 2018 by a Facebook user regarding access to personal data held by Meta in a digital warehouse termed a “Hive”.
After the complainant requested access to any of his personal data stored by Meta through his Facebook account, Meta provided him with online “tools” to assist downloading his information. He claimed there was remaining personal data left unsent, to which he should have access.
In its challenge, Meta argued the DPC acted beyond its powers in expanding the scope of its inquiry beyond the individual’s complaint into a wider, “own-volition” inquiry by the commission.
The DPC, it said, took a view the complainant’s request had a “general application”, in that similar considerations over data “could” arise for many other Facebook users.
The DPC argued the case was premature because there was only a “draft of a draft decision”. It submitted there has been no conversion of the inquiry and it has not only a power but is “obliged” to consider systemic effects in the context of deciding on appropriate corrective measures once a finding of infringement is made.
Notwithstanding its prematurity argument, the DPC asked the court to determine the core legal issue. That concerned the scope of the commission’s powers, within a complaint-based GDPR inquiry, to direct corrective measures and impose administrative fines on foot of a finding of an infringement, which also affects the wider user base.
In her 98-page judgment, Phelan said Meta’s contention that the architecture and structure of the GDPR and the Data Protection Act 2018 requires the commission to address systemic issues only within the rubric of an own-volition inquiry “is not legally sound”.
The GDPR, she said, establishes a broad system of enforcement in which supervisory authorities are tasked with monitoring and ensuring compliance. It confers wide investigative and corrective powers, including the obligation to investigate complaints “to the extent appropriate” and to take measures necessary to ensure compliance.
These provisions do not differentiate between complaint-based and own-volition inquiries in terms of the extent of powers of investigation or the nature of corrective measures available, she held.
The 2018 Act reflects the “same broad scheme” as the GDPR and confers identical corrective powers regardless of whether an inquiry is commenced on foot of a complaint or on the commission’s own initiative.
A complaint-based inquiry may lawfully address systemic issues arising on the facts and may result in “system-wide corrective measures” including administrative fines informed by systemic considerations, the judge held.
This does not convert a complaint-based inquiry into an own-volition process but reflects the DPC’s “overarching obligation” to ensure effective enforcement of the GDPR when infringements are found, she said.
On foot of those and other findings, the judge dismissed Meta’s case. Final orders will be made later.
