Summary

• Ireland's Supreme Court has granted permission for a direct appeal concerning four preliminary issues in LinkedIn's challenge to its €310m GDPR fine.
• The DPC may appeal three issues, while LinkedIn may cross-appeal on the remaining question about the scope of the statutory appeal.
• The hearing is expected in early 2027 and will address procedural law before the underlying enforcement dispute can be resolved.

Ireland’s Supreme Court has agreed to examine the legal powers available to companies challenging decisions by the country’s data protection regulator, granting permission for appeals arising from LinkedIn’s dispute over a €310 million GDPR fine imposed in 2024.

The ruling allows the Data Protection Commission (DPC) to appeal three preliminary issues decided by the High Court in April, while LinkedIn may cross-appeal on a fourth. The questions concern the scope of the appeals permitted under Ireland’s Data Protection Act 2018 and the evidence courts can consider when reviewing a regulatory decision.

Although the dispute involves one of the largest fines imposed by Ireland’s privacy regulator, the Supreme Court has not determined whether the original penalty was justified. Its latest decision permits a direct appeal from the High Court, bypassing the Court of Appeal because the preliminary questions are considered sufficiently important to require an authoritative ruling.

The Supreme Court expects the case to be heard in early 2027, subject to its scheduling arrangements. The outcome could influence other statutory appeals against regulatory decisions, particularly where companies challenge the findings supporting a penalty as well as the amount imposed.

The enforcement decision behind the litigation

LinkedIn’s dispute originates in a DPC investigation into the use of members’ personal information for behavioural analysis and targeted advertising. The regulator began examining the company’s practices in 2018 following a complaint originally made to France’s data protection authority by the non-profit organisation La Quadrature du Net.

As LinkedIn’s lead supervisory authority within the European Union, the Irish regulator assessed whether the company had a lawful basis for processing information supplied directly by members and information received through third parties. The investigation also examined the fairness of that processing and whether individuals had received sufficient explanations about how their data was used.

In October 2024, the DPC found infringements of the General Data Protection Regulation and issued three administrative fines totalling €310 million. It also reprimanded LinkedIn and ordered the company to bring the relevant processing activities into compliance.

The findings distinguished between the legal grounds on which the company had sought to rely. The DPC concluded that consent obtained for processing certain third-party data was insufficient because it did not meet the requirements for a freely given, specific, informed and unambiguous choice.

It also found that LinkedIn could not rely on contractual necessity for the first-party processing examined in the decision. In relation to other activities, the regulator concluded that the company’s claimed legitimate interests were overridden by the interests and fundamental rights of affected individuals.

The decision did not establish that behavioural advertising is unlawful in every circumstance. Its conclusions concerned specified processing activities and the particular legal bases relied upon by LinkedIn, which subsequently challenged the findings and enforcement measures through Irish legal proceedings.

Other European data protection authorities were involved through the GDPR’s cross-border cooperation mechanism, but none raised an objection to the DPC’s draft decision in 2024. The Irish enforcement action consequently emerged from an EU-wide supervisory process rather than a complaint confined to users in Ireland.

Which decisions can a company appeal?

The current legal dispute concerns the interpretation of sections 142 and 150 of Ireland’s Data Protection Act 2018. Both provide routes for challenging specified decisions of the regulator, but the extent of those routes and the standard a court should apply have become contested questions.

In its April judgment, the High Court considered whether section 142 permits an appeal against every part of a DPC decision or is confined to a decision imposing an administrative fine. The distinction matters where a regulatory action combines findings of infringement with several corrective measures.

The High Court concluded that section 142 concerns the imposition of fines, whereas challenges to infringement findings and other corrective powers must be considered under the relevant statutory provisions governing those decisions. That interpretation is among the issues now heading to the Supreme Court.

Separately, the High Court examined the type of review available when a company appeals a regulatory decision. A court might be asked to decide the matter afresh or instead assess the regulator’s determination on the record already available, subject to rules governing whether further evidence can be admitted.

Those approaches involve different responsibilities. A full rehearing can require substantial reconsideration of the evidence, while an appeal focused on an existing decision may give greater weight to the original investigation and the findings reached by the regulator.

The question also influences how much additional material a company can place before the court after the regulatory process has concluded. A party challenging an enforcement decision might seek to introduce information or arguments that were not presented during the inquiry, while the regulator may contend that the appeal should be determined principally on the record it considered.

The four preliminary issues addressed these connected questions. Issue 1 concerns which aspects of a decision can be appealed under section 142; Issues 2 and 3 concern the nature and standard of review under the relevant statutory routes; and Issue 4 concerns additional evidence and arguments presented during an appeal.

After the High Court ruled on the issues, the DPC sought a direct Supreme Court appeal concerning Issues 2, 3 and 4. LinkedIn sought permission to cross-appeal on Issue 1, bringing the related questions before the same court.

A direct appeal with wider consequences

The Supreme Court accepted that exceptional circumstances justified hearing the case without an intermediate appeal. It considered the substantial financial penalty, the large number of potentially affected LinkedIn users and the significance of the questions for other statutory regulatory appeals.

Ordinarily, a case proceeding from the High Court would pass through the Court of Appeal before reaching the Supreme Court. That route provides an opportunity for further judicial analysis, but it can also increase expense and delay where the disputed legal questions need to be resolved before the substantive proceedings can advance.

The Supreme Court concluded that the importance of establishing the applicable law justified an exception in this case. However, it did not accept that the appeal needed to displace other matters already scheduled during the current legal term, indicating instead that a hearing was likely in the normal course early next year.

The court has left open the possibility of considering an application for greater priority if circumstances change. Neither the hearing date nor the eventual outcome has therefore been fixed by the October ruling.

For technology companies operating across the EU, the decision may clarify how Irish courts assess appeals against an important category of regulatory enforcement actions. Ireland hosts the European headquarters of several large digital businesses, making its national appeal procedures particularly significant in disputes involving cross-border GDPR decisions.

The questions also affect the relationship between regulatory expertise and judicial scrutiny. Data protection authorities are responsible for investigating complex processing practices, while courts must provide the appeal rights required by legislation and ensure that regulatory powers are exercised lawfully.

Determining the proper scope of review does not itself decide whether LinkedIn’s advertising practices complied with the GDPR. That substantive assessment will remain part of the continuing proceedings once the preliminary legal questions have been resolved.

The €310 million penalty therefore remains the subject of litigation rather than a newly imposed fine or a sanction overturned by the latest ruling. The Supreme Court’s next task is to establish the legal framework through which the challenge can proceed, with consequences potentially extending to other companies contesting decisions by Ireland’s data protection regulator.