LinkedIn Ireland Unlimited Company v Data Protection Commission

THE HIGH COURT [2026] IEHC 235 Record Number 2024/580 MCA IN THE MATTER OF SECTION 142 AND SECTION 150 OF THE DATA PROTECTION ACT 2018 Between LINKEDIN IRELAND UNLIMITED COMPANY Appellant and DATA PROTECTION COMMISSION Respondent JUDGMENT of Ms Justice Nessa Cahill delivered on 20 April 2026 INTRODUCTION .................................................................................................................................. 2 BACKGROUND .................................................................................................................................... 4 ISSUE 1: SCOPE OF SECTION 142 ..................................................................................................... 8 (a) Summary of the Parties’ Arguments ............................................................................................. 8 (b) Relevant Provisions of the 2018 Act ............................................................................................. 9 (c) GDPR .......................................................................................................................................... 23 (d) Conclusions on the interpretation of the statutory language ....................................................... 26 (e) Absurdity Arguments .................................................................................................................. 26 (i) Overlap between infringement and fine ................................................................................... 27 1 (ii) Orders under Section 143(3) ................................................................................................... 29 (iii) Consequences of separate appeals ......................................................................................... 31 (iv) Content of the LinkedIn Decision .......................................................................................... 33 ISSUE 2: INTERPRETATION OF SECTION 142 ............................................................................. 35 (a) Preliminary .................................................................................................................................. 35 (b) Inconsistency in statutory appeals ............................................................................................... 36 (c) Categorising appeals .................................................................................................................... 40 (d) Understanding the categories ...................................................................................................... 42 (e) Interpretation of section 142 ........................................................................................................ 49 (i) Language of section 142 .......................................................................................................... 49 (ii) Positions of the parties ............................................................................................................ 51 (iii) Comparison with other legislation ......................................................................................... 52 (iv) Conclusions on the interpretation of the statutory language .................................................. 68 (f) GDPR, Charter and ECHR........................................................................................................... 73 (c) Curial Deference .......................................................................................................................... 93 (i) Parties’ positions ..................................................................................................................... 93 (ii) Interaction between standard of review and curial deference ................................................. 94 (iii) Relevant authorities................................................................................................................ 94 (iv) Article 60 ................................................................................................................................ 96 ISSUE 4: ADMISSIBILITY OF NEW EVIDENCE AND ARGUMENT ......................................... 100 CONCLUSIONS................................................................................................................................. 106 INTRODUCTION 1. This judgment arises in the context of an appeal by the Appellant (“LinkedIn”) from a decision of the Respondent (“the DPC”) made on 22 October 2024 (“the LinkedIn Decision”), which was made pursuant to section 113(2)(a) of the Data Protection Act 2018 (“the 2018 Act”) and Article 60 of Regulation 2016/679/EU (“the GDPR”). By that Decision, the DPC found that LinkedIn had infringed Articles 5(1)a, 6(1), 13(1)(c) and 14(1)c of the GDPR and that corrective powers should be exercised in the form of a reprimand, an order to bring processing into compliance and the imposition of three administrative fines, totalling €310 million. 2. This judgment addresses the rules governing an appeal to this Court under the Data Protection Act 2018 (“the 2018 Act”). Four issues were identified and agreed by the parties to be suitable and appropriate for preliminary trial. They each concern the interpretation of provisions of that Act. 2 3. While the questions raised are complex, they do arise and have been presented, largely independently of the facts of these proceedings and in the absence of any relevant factual conflict. For that reason, the background is briefly summarised to contextualise the issues raised but is not further examined. 4. The only truly salient facts are that the Data Protection Commission (“the DPC”) conducted a six-year long investigation between 2018 and 2024, which culminated in a decision that LinkedIn had committed infringements of provisions of the General Data Protection Regulation (“the GDPR”) and a decision to exercise corrective powers, including the imposition of a fine in the amount of €310 million. 5. In addition to this statutory appeal, LinkedIn also issued judicial review proceedings challenging the decision of the DPC and certain provisions of the 2018 Act, invoking provisions of the Constitution, the Charter of Fundamental Rights of the European Union (“the Charter”), and the European Convention on Human Rights (“ECHR”). There is a clear overlap between the two sets of proceedings. 6. The four preliminary issues are: 1. Is the Appellant entitled to appeal the decision of the Respondent dated 22 October 2024 (the "Decision") under section 142 of the Data Protection Act 2018 or are there aspects of the within appeal which can only proceed as an appeal under section 150 of the 2018 Act? 2. What type of appeal does section 142 of the Data Protection Act 2018 provide for and what is the standard of review/assessment to be applied by the Court in an appeal under section 142? 3. If there are aspects of the Appellant's appeal which can only proceed as an appeal under section 150 of the Data Protection Act 2018, is the standard of review/assessment to be applied by the Court the same under sections 142 and 150 of the 2018 Act or does a different standard of review/assessment apply in an appeal under section 150 of the 2018 Act? 4. Having regard to the answers to the foregoing questions, is the Appellant entitled to rely on evidence adduced and/or arguments made in the Appeal which were not already adduced or made to the Respondent during the inquiry process? 7. Each of the parties adopted the position that the same type of appeal and standard of review are applicable to an appeal under section 142 and section 150 of the Act. Accordingly, the answers under Issue 2 will also answer the questions raised in Issue 3 and no submissions were made regarding Issue 3. Consequently, the nature and the standard of review are addressed in this judgment by reference to section 142 only and Issue 3 is not addressed as a discrete topic. Issue 4, by contrast, is focussed on section 150. 3 BACKGROUND 8. This judgment arises in the context of an appeal by the Appellant (“LinkedIn”) from a decision of the Respondent (“the DPC”) made on 22 October 2024 (“the LinkedIn Decision”), which was made pursuant to section 113(2)(a) of the Data Protection Act 2018 (“the 2018 Act”) and Article 60 of Regulation 2016/679/EU (“the GDPR”). By that Decision, the DPC found that LinkedIn had infringed Articles 5(1)a, 6(1), 13(1)(c) and 14(1)c of the GDPR and that corrective powers should be exercised in the form of a reprimand, an order to bring processing into compliance and the imposition of three administrative fines, totalling €310 million. 9. The LinkedIn Decision was arrived at following a complaint-based inquiry conducted under section 110 of the 2018 Act (“the Inquiry”) which spanned a period of more than six years. The stages of the Inquiry process will be summarised here. The Complaint 10. The Inquiry was commenced following a complaint filed by La Quadrature du Net, a French non-profit organisation (“the Complaint”). The Complaint, which was asserted to have been made on behalf of 8,540 users of the LinkedIn service in France, was lodged on 28 May 2018 with the French supervisory authority for GDPR compliance, Commission Nationale de l’Informatique et des Liberts (“CNIL”) and primarily concerned LinkedIn’s processing of the personal data of its members in the EEA and the UK for the purpose of “behavioural analysis and targeted advertising”, referred to in the LinkedIn Decision as “BA & TA”. The Complaint alleged that such processing was not in compliance with the requirements of the GDPR and further alleged breaches of the transparency and fairness requirements in Articles 13 and 5(1)(a) GDPR. The Complaint was referred by CNIL to the DPC as the supervisory authority (“SA”) with jurisdiction over LinkedIn in matters concerning cases of cross-border processing under the GDPR. The Investigation 11. On 20 August 2018 LinkedIn was notified by the DPC of the commencement of the Inquiry (“the Notice of Commencement”). The letter further contained a request for information and a translated copy of the Complaint. LinkedIn answered this request for information on 1 October 2018. On 17 January 2020, the DPC sent LinkedIn a second letter containing a further request for information. On 14 July 2021, the DPC provided LinkedIn with a draft statement of the issues in the investigation and invited submissions. LinkedIn’s submissions on the draft statement of issues were furnished on 4 August 2021. On 4 October 2021, the DPC sent a further request for information. LinkedIn provided the requested information on 29 October 2021. The DPC provided LinkedIn with its finalised statement of issues on 22 December 2021. 4 The Preliminary Draft Decision 12. By letter dated 9 March 2023, LinkedIn was informed that a preliminary draft decision was being prepared. This letter also noted the DPC’s position that for the purposes of any administrative fine under Article 83 GDPR LinkedIn and Microsoft were considered to comprise a single undertaking. The DPC further requested certain information about the group structure, including a corporate structure chart and figures related to Microsoft’s turnover. 13. LinkedIn complied with this request without prejudice to its assertion that LinkedIn and Microsoft should not be treated as a single undertaking for the purposes of considering the imposition of an administrative fine. On 25 April 2023, the DPC provided LinkedIn with its Preliminary Draft Decision (“the PDD”) and invited submissions in response. The DPC’s preliminary findings, contained in the PDD, were that LinkedIn had infringed Article 5(1)(a), Article 6, and Articles 13(1 )(c) and 14(1 )c) of the GDPR. The DPC indicated its intention to order the following corrective measures: (i) to reprimand LinkedIn. (ii) to make Corrective Orders requiring Linkedln to bring its processing into compliance with the GDPR within three months. (iii) to impose fines of between €430 - €490 million on LinkedIn. 14. On 20 July 2023 LinkedIn delivered submissions in response to the PDD, supported by factual and expert evidence. In its response, LinkedIn disputed the provisional conclusions and the proposed fines, submitting that they were excessive and disproportionate. The Draft Decision 15. On 11 July 2024, the DPC submitted a draft decision to the concerned SAs in other Member States (“the CSAs”) in accordance with Article 60(3) GDPR and section 113 of the 2018 Act. On 11 July 2024 the DPC furnished LinkedIn with a copy of the draft decision (“the Draft Decision”) along with notice that the Draft Decision had been sent to the CSAs in accordance with Article 60 GDPR. The Draft Decision broadly reached the same conclusions as the PDD finding that Article 5(1)(a), Article 6, and Articles 13(1)(c) and 14(1)(c) GDPR had been breached. The DPC did concede some of the objections raised by LinkedIn in its response to the PDD, including submissions that it was not appropriate to impose a separate fine for infringement of the fairness principle under Article 5(1)a) GDPR, as that conduct had already been taken into account in imposing the fines in respect of other infringements. As a result of the changes made in the Draft Decision, the proposed fines (which had totalled between €430 and €490 million under the PDD) were reduced to between €290 and €320 million in the Draft Decision. 5 The Revised Draft Decision and Comments 16. Three CSAs raised comments on the Draft Decision but no objections were raised. On 24 September 2024, the DPC informed LinkedIn that it proposed to make non-material amendments to the Draft Decision to take account of the views expressed by the three CSAs in these comments. The DPC further informed LinkedIn that it proposed to have regard to these comments in determining the amount of the fines to be imposed within the scale already determined by the DPC in the Draft Decision. LinkedIn delivered submissions on 8 October 2024. The Decision 17. In its final Decision, dated 22 October 2024, the DPC made the following findings: a) LinkedIn did not validly rely on Article 6(1)(a) GDPR to process third-party data of its members for the purpose of “BA & TA”, excluding analytics, on the basis that the consent obtained by Linkedln was not freely given, sufficiently informed or specific, or unambiguous. Accordingly, LinkedIn contravened Article 6 and Article 5(1)(a) GDPR. b) LinkedIn did not validly rely on Article 6(1)(f) GDPR for its processing of first-party personal data of its members for “BA & TA”, or third-party data for analytics. Accordingly, LinkedIn contravened Article 6 and Article 5(1)(a) GDPR. c) LinkedIn did not validly rely on Article 6(1)(b) GDPR to process first-party data of its members for the purpose of “BA & TA”. Accordingly, LinkedIn contravened Article 6 and Article 5(1)(a) GDPR. d) LinkedIn contravened Article 13(1)(c) and Article 14(l)(c) GDPR in respect of the information it provided to data subjects regarding its reliance on Article 6(1)(a), Article 6(1)(b) and Article 6(1)(f) GDPR as lawful bases. e) LinkedIn did not contravene Article 13(1)(d) or Article 14(2)(b) GDPR. f) LinkedIn contravened the principle of fairness in Article 5(l)(a) GDPR. The Proceedings 18. On 18 November 2024 LinkedIn issued a statutory appeal of the Decision pursuant to sections 142 and 150 of the 2018 Act. The appeal was grounded on the affidavit of Ms Sue Duke and supported by an affidavit sworn by Professor Andrew Stephen and Mr Abhishek Shrivastava. On the same date, an ex parte application for leave to seek judicial review proceedings was filed. 19. By letter dated 18 November 2024 solicitors for LinkedIn wrote to the DPC enclosing copies of the statutory appeal and judicial review papers. In that correspondence, LinkedIn explained that the judicial review proceedings were confined to challenges to the validity and compatibility of aspects of the statutory scheme and that the statutory appeal was intended to address the merits of the Decision, with 6 a view to avoiding duplication between the two sets of proceedings. By letter dated 25 November 2024, solicitors for the DPC responded declining to confirm that all issues raised could be addressed within the statutory appeal and stating that the procedural route by which to challenge the Decision was a matter for the appellant to determine. Further correspondence was exchanged between the parties in December 2024 in which LinkedIn reiterated its position that duplication should be avoided and sought confirmation that the issues raised could be addressed within the statutory appeal. The DPC maintained that it was for LinkedIn to determine how to proceed with its challenge. 20. On 16 December 2024 Gearty J. granted LinkedIn leave to seek judicial review on the basis of a draft amended statement of grounds (“the Judicial Review”). 21. On 25 February 2025, the DPC delivered its statement of opposition, verified by an affidavit sworn by Ms Fleur O’Shea. Replying affidavits were sworn by Ms Duke on 8 April 2025 and on 26 May 2025 (a replying affidavit having been sworn by Mr Owen O’Donnell on behalf of the DPC on 6 May 2025). The DPC’s statement of opposition in the judicial review proceedings was delivered on 4 March 2025. The State delivered its statement of opposition in the Judicial Review on 18 March 2025. Identification of Preliminary Issues 22. The second affidavit of Ms. Duke addressed, among other matters, the position adopted by the DPC as to the scope and standard of appeal under sections 142 and 150 of the Data Protection Act 2018 and indicated that LinkedIn might seek the determination of those matters as preliminary issues. 23. In May 2025, further correspondence was exchanged between the parties concerning the possible determination of preliminary issues relating to the scope of sections 142 and 150, the applicable standard of review, and the admissibility of new evidence on appeal. On 22 May 2025, a motion was issued by LinkedIn seeking an order pursuant to Order 25, rule 1 and/or Order 34, rule 2 of the Rules of the Superior Courts directing a trial of the four specified preliminary issues. The motion was grounded on an affidavit sworn by Mr Richard Willis. The DPC agreed to the trial of these preliminary issues and, by order of the High Court (Gearty J.) made on consent on 25 June 2025, the Court directed a trial of these preliminary issues. The order further provided for the participation of the State at the hearing of the motion. 24. Written submissions were delivered by LinkedIn on 24 September 2025, by the DPC on 29 October 2025 and by the State on 18 November 2025. The preliminary issues were heard over the course of three days, on 2, 3 and 4 December 2025. Very helpful supplemental submissions were then delivered by LinkedIn on 19 and 24 March 2026; by the DPC on 16 March 2026 and on 26 March 2026; and by the State on 20 March 2026. 7 ISSUE 1: SCOPE OF SECTION 142 25. The question that arises under Issue 1 is whether an appeal under section 142 encompasses the entire Decision or whether it is confined to an appeal against the imposition of the fine. The decision as to the scope of section 142 hinges primarily on the interpretation of sections 142 and 150(5), an exercise which should be undertaken in accordance with the principles set out in the judgment of Murray J. in Heather Hill Management Company CLG v An Bord Pleanala [2022] IESC 43 (O'Donnell C. J., O'Malley, Woulfe, Hogan JJ. in agreement) (“Heather Hill”) which were summarised as follows: “The words of the section are the first port of call in its interpretation, and while the court must construe those words having regard to the context of the section of the Act in which the section appears, the pre-existing relevant legal framework and the object of the legislation insofar as discernible, the onus is on those contending that a statutory provision does not have the effect suggested by the plain meaning of the words chosen by the legislature to establish this” (at [128]). 26. I will therefore address the correct interpretation of those statutory provisions (read in their immediate and broader context), before turning to the submissions of LinkedIn about the impact of that interpretation. (a) Summary of the Parties’ Arguments 27. LinkedIn contends that the correct interpretation of the 2018 Act is that, when a fine is imposed, the decision in its entirety, including the infringement findings and any other corrective powers that were exercised, may be appealed under section 142. This is said to be a recognition of the need for special protection when fines are imposed. If the decision culminates only in other corrective measures and no fine, then the appeal falls only under section 150(5). 28. It is contended that, if it was intended that there must be a bifurcation of the appeal, this must be provided for in explicit terms, but this was not done. It is contended that there is no basis in the language of sections 142 and 150 to separate out the appeals as between infringement and fines or to require the issues to be decided according to different rules. 29. Further, LinkedIn relies heavily on the overlap between a decision on infringement and a decision as to the imposition of fines and asserts that it is impracticable and absurd for appeals against such decisions to be subject to separate appeals under different statutory provisions and applying different standards and rules, including with respect toto the admission of new evidence and argument. 30. The position of both the DPC and the State is that section 142 governs only a decision on the imposition of a fine and that this is distinct and separate from the finding of infringement, which can only be 8 appealed under section 150(5). The DPC relies on the language of section 142 and the references to “fines” throughout that provision and its neighbouring provisions, particularly the incorporation of Article 83 GDPR in section 142(4). The DPC also points to the language of sections 111, 112 and 113 which provide for a decision on infringement and “in addition” a decision as to the exercise of corrective measures, which points towards separate, distinct and segregable decisions. Both the State and the DPC assert that there is no ambiguity in the language of these sections. 31. According to the State, the divisibility of the sanctions appeal arises from the language of the 2018 Act and the distinction drawn in that Act between sections 142 and 150(5) must be given effect to. (b) Relevant Provisions of the 2018 Act 32. The first “port of call”, as confirmed in Heather Hill, is the language of the relevant provisions. Section 142(1) provides that, “Without prejudice to section 150, a controller or processor that is the subject of a decision under section 111, 112, 113 or 133(9) to impose an administrative fine may, within 28 days from the date on which notice of the decision concerned was given to it under section 116 or, as the case may be, section 133(9)(b) appeal to the court against the decision.” 33. Section 142(4) then states, “The court shall, for the purposes of subsection (3), act in accordance with Article 83”. 34. Section 150(5) provides a general right of appeal against a decision of the DPC (such as the decision at issue in these proceedings): “A data subject or other person affected by a legally binding decision of the Commission under Chapter 2 or 3 may, within 28 days from the date on which notice of the decision is received by him or her, appeal against the decision.” 35. It is immediately apparent that these provisions cannot be construed in isolation, and must instead be read in conjunction with other proximate provisions of the 2018 Act and indeed of the GDPR (both appear in Part 6 of the 2018 Act which is concerned with the enforcement of the GDPR). 36. The correct interpretation of section 142 and section 150(5) and the positions advanced by the parties will be addressed, beginning with the construction of the statutory language itself. Section 150(5) 37. Section 150(5) refers to a “legally binding decision” under Chapter 2 or 3 of Part 6. Chapter 2 comprises sections 107 to 117 of the 2018 Act. These sections concern, in general terms, investigations of 9 suspected infringements of a provision or provisions of the GDPR or the 2018 Act. Investigations may arise from complaints made to the DPC (section 108) or may be initiated by the DPC itself. In either case, section 110 provides that the DPC may conduct an investigation and inquiry. The relevant provision for the purposes of these proceedings is section 113 which addresses the outcome when a complaint has been investigated by the DPC as the lead Supervisory Authority (“LSA”) pursuant to the cooperation mechanism contained in Article 60 GDPR. 38. Chapter 3 concerns the enforcement of Directive (EU) 2016/680 (“the Law Enforcement Directive”) on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. It is not relevant here, but I would note that a similar approach to that taken in sections 111, 112 and 113 can be seen in Chapter 3. For example, sections 124 and 125 provide for the DPC to make a decision as to whether there was an infringement and then state that the DPC “shall, in addition, make a decision” concerning whether and which corrective power to exercise. Section 150(12) 39. Section 150(12) defines and limits the scope of the decisions to which section 150 applies. It provides; “For the purposes of this section, a “legally binding decision” means a decision — (a) under paragraph (a),(b) or (da) of section 109(5) or paragraph (a),(b) or (da) of section 122(4), (b) under section 111(1)(a), 112(1), 113(2)(b) or (6)(aa), 114, 124(1)(a) or 125(1), or (c) to exercise a corrective power under Chapter 2 or 3.” 40. Before addressing the specific provisions listed in section 150(12)(b), it is relevant to observe the breadth of section 150(12)(c). By this provision, the exercise of any corrective power under Chapter 2 without distinction is within the scope of section 150. LinkedIn argued in oral submissions that a controller or processor could choose to appeal the decision to impose a fine under section 150(5) or under section 142. The State seems to be of a different view and points out that fines are not expressly mentioned in section 150(12)(c). The State also makes the uncontroversial point that it is Chapter 6 as opposed to Chapter 2 which contains the provisions of the 2018 Act which deal specifically and substantively with fines. The DPC did not specifically address the question of whether section 150(12) includes administrative fines, although the tenor and logical inference of the submissions made by the DPC is that fines may only be appealed under section 142. 41. While there was limited focus on the terms of section 150(12)(c), I do think it is relevant to interpreting the intersection between sections 142 and 150 and aspects of the language of each. The starting point 10 is that it is inescapably the case that section 150(12) is broad in its formulation and would capture any decision on infringement under sections 111, 112 or 113 and the exercise of any corrective power under those provisions. Indeed, all parties agree that section 150 is the default appeal provision under Part 6 of the 2018 Act. 42. As will be seen when it comes to section 115 and section 142(1) itself, a decision to impose an administrative fine under the 2018 Act is a decision taken under sections 111(2), 112(2) or 113(4). Section 150(12)(c) does therefore on its terms include a decision to impose an administrative fine under each of those provisions. This means that a decision to impose an administrative fine is a “legally binding decision” for the purposes of section 150(5). It may be recalled in this connection that section 150(5) is permissive in its formulation (a “person affected by a legally binding decision of the Commission under Chapter 2 or 3 may…appeal”). The only relevant consequence of encompassing a fining decision within section 150 is that the controller or processor “may” appeal under section 150(5). This does not detract from the undisputed fact that a decision to impose a fine may also be appealed under section 142. 43. There are some consequential points to note. First, when section 150(12) is read this way, that makes sense of the proviso in section 142 that it is “without prejudice to section 150” (to which I will return later). On this interpretation, a processor or controller faced with a decision to impose an administrative fine may appeal under the default appeal route in section 150(5) or choose to appeal the decision to impose the fine under section 142. This appears to be consistent with LinkedIn’s interpretation of the scope of section 150 as regards the imposition of fines. It does not however deal with the broader case made by LinkedIn about appealing findings of infringement. 44. Second, as the DPC points out, the language of “legally binding decision” in section 150 may be traced to Article 78(1) GDPR: “Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.” If a controller or processor does elect to appeal a fining decision under section 150, this does not detract from or lessen the entitlement to an effective judicial remedy. The extent of the protection available is further confirmed by the positions adopted by each of the parties to these proceedings (and by the State) that the same standard of review is applicable whether the appeal is pursued under section 150(5) or section 142. 45. As an aside (although one that is not irrelevant in light of the absurdity arguments made by LinkedIn), the option of appealing under section 150(5) would allow for an appeal against a decision on infringement and the exercise of non-fine corrective powers to proceed together with an appeal against a decision on the imposition of administrative fines. 11 Sections 111, 112, 113 46. The provisions referenced in section 142(1) are sections 111, 112, 113 and 133(9). Section 133(9) is concerned with the imposition of administrative fines for failure to comply with an enforcement notice and is not relevant here. 47. Section 111 addresses the decisions that may be made by the DPC following an “own volition” investigation and provides (in relevant part), “(1) Where an inquiry has been conducted of the Commission’s own volition, the Commission, having considered the information obtained in the inquiry, shall— (a) if satisfied that an infringement by the controller or processor to which the inquiry relates has occurred or is occurring, make a decision to that effect, and (b) if not so satisfied, make a decision to that effect. (2) Where the Commission makes a decision under subsection (1)(a), it shall, in addition, make a decision— (a) as to whether a corrective power should be exercised in respect of the controller or processor concerned, and (b) where it decides to so exercise a corrective power, the corrective power that is to be exercised.” Section 107 of the 2018 Act defines “corrective power” as “a power conferred by Article 58(2)” of the GDPR. Article 58(2) lists the corrective powers of the SAs which include the powers to: i. issue warnings about intended processing operations which are likely to infringe the GDPR; ii. issue reprimands where there has been infringement; iii. order the controller or processor to bring processing operations into compliance with the GDPR; iv. impose a ban on processing; v. order the rectification or erasure of personal data. 50. Notably, one of the corrective powers referenced in Article 58 is the power “to impose an administrative fine pursuant to Article 83, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case” (Article 58(2)(i)). 51. Section 112 concerns inquiries on foot of complaints in respect of which the DPC is the competent SA. Section 112(1) provides, in similar terms to section 111(1), that the DPC may either make a decision that there was infringement or a decision dismissing the complaint. Section 112(2) (also mirroring section 111(2)) then provides: 12 “Where the Commission makes a decision under subsection (1)(a), it shall, in addition, make a decision— (a) as to whether a corrective power should be exercised in respect of the controller or processor concerned, and (b) where it decides to so exercise a corrective power, the corrective power that is to be exercised.” 52. As already noted, section 113 of the 2018 Act governs the investigation and determination of complaints in respect of which the DPC is the lead SA for the purposes of Article 60 of the GDPR. This is the applicable provision in this case. It sets out the requirement that the DPC shall: “make a draft decision in respect of the complaint (or, as the case may be, part of the complaint) and, where applicable, as to the envisaged action to be taken in relation to the controller or processor concerned” (section 113(2)(a)). 53. This is the provision pursuant to which the LinkedIn Decision was made. The DPC must then “in accordance with Article 60 and, where appropriate, Article 65, adopt its decision in respect of the complaint or, as the case may be, part of the complaint” (section 113(2)(b)). 54. Section 113(4) then provides: “Where the Commission adopts a decision under subsection (2)(b) to the effect that an infringement by the controller or processor concerned has occurred or is occurring, it shall, in addition, make a decision— (a) where an inquiry has been conducted in respect of the complaint— (i) as to whether a corrective power should be exercised in respect of the controller or processor concerned, and (ii) where it decides to so exercise a corrective power, the corrective power that is to be exercised.” 55. There is a notable element of repetition between sections 111(2), 112(2) and 113(4). Each of these provisions refers to two decisions that the DPC is required to make or adopt: a decision as to whether there was (or is) an infringement and, if infringement is found, the DPC shall also (“in addition”) make a decision as to whether and which corrective power should be exercised. The DPC and the State contend that there are two discrete, segregable decisions provided for in these sections. 56. LinkedIn’s position on the formulation of these provisions is that they do not provide for separate decisions, but rather a single decision dealing with both infringement and sanction (drawing an analogy 13 with liability and quantum in civil cases). There is however an acknowledgement that it is a two-stage decision making process. 57. I consider the requirement that the DPC must “in addition, make a decision” as to the corrective powers to be unambiguous. It plainly indicates that there must be one decision on infringement and then a second additional decision as to the exercise of corrective powers (if infringement is found). This is the interpretation urged by the DPC and the State and it does garner support from the language of sections 111(2), 112(2) and 113(4). 58. In each of section 111, 112 and 113, there is also a separate, final sub-section to the effect that, where the DPC “makes a decision” to exercise a corrective power, it “shall exercise the corrective power concerned” (section 111(3), section 112(3), section 113(6)(a)). Section 115(1) 60. The next provision to note is section 115(1): “For the purposes of exercising a corrective power under section 111, 112 or 113, the Commission may do either or both of the following: (a) subject to Chapter 6, decide to impose an administrative fine on the controller or processor concerned; (b) exercise any other corrective power specified in Article 58(2).” 61. The parties’ position on section 115 may be briefly summarised as follows. The DPC refers to section 115 as indicating a dichotomy between the imposition of a fine and other corrective powers and as evidencing the need for a decision as to the imposition of a fine. LinkedIn argues that there is only one decision provided for in the 2018 Act and in the GDPR and that all aspects of the decision and all corrective measures imposed are addressed in the single indivisible decision, which may contain three findings (as to infringement, corrective measures and fines). LinkedIn does not however disagree that there is a difference between the imposition of a fine and other corrective powers. Rather, it was contended on behalf of LinkedIn that section 115 highlights that the exercise of the corrective power to impose a fine brings the entire decision within the scope of the special section 142 appeal procedure. 62. I would immediately note that the separate treatment of fines in section 115 has a greater consequence than LinkedIn allows: it confirms that it is the decision to impose a fine that is “subject to Chapter 6”. That wording is solely applicable to the fining decision and is not referable to the exercise of other corrective powers. 63. One possible interpretation of the plain language of section 115 (read in light of the language of sections 111(2), 112(2) and 113(4)) is that there should be a decision on infringement, then a decision to exercise 14 a corrective power, followed by the exercise of the corrective power, and “for the purposes of exercising” that power, there may then be a third decision to impose a fine. None of the parties to these proceedings advanced that rather technical, literal interpretation and I am satisfied that it is not intended that there would be a third decision following a decision under sections 111(2), 112(2) or 113(4) as to which corrective power to exercise. Instead, I regard the effect and purpose of section 115 as three- fold: first, it differentiates the specific corrective power to impose a fine from the other corrective powers that may be exercised; second, it confirms the necessity of a discrete, identifiable decision when the DPC is exercising the power to impose a fine; and, third, it provides that the decision to impose an administrative fine is “subject to Chapter 6”. 64. This is consistent with the position (made manifest in section 142(1)) that the decision to impose a fine is a decision that itself is made under sections 111, 112 or 113 and not under section 115. This dichotomy between fines and other corrective powers can be seen in Article 58, which includes the imposition of fines among the list of possible corrective powers, but on the basis that it is a power to be exercised in accordance with Article 83. 65. When sections 111, 112, 113 and 115 are read together and in light of section 142(1), I am of the view that those provisions indicate that there are two separate decisions: (a) a decision as to whether there is infringement; (b) if there is a finding of infringement, a decision as to whether and which corrective power(s) to exercise. If it is decided to exercise the power to impose a fine, there must be a specific decision to that effect (which is then subject to Chapter 6). 66. I pause here to note that the requirement of a separate “decision” is not to be equated with a requirement for a separate document containing each individual decision. I did not detect any argument to the contrary by the parties to these proceedings and would simply note that there is nothing in the 2018 Act or the GDPR to suggest that several decisions cannot be contained in a broader composite “decision” (as indeed the DPC did in this case). LinkedIn does however rely on the fact that there was a single “decision” issued here in support of its case as to the scope of section 142. 67. It appears to me that the question of whether findings of infringement and fine imposition are included in one document cannot itself be decisive as to the application of Article 60 or the scope of section 142. There is nothing in section 142 to support such an interpretation of its scope. The term “decision” is not defined in the GDPR or the DPA, it is plain that section 142 and Article 83 are directed to “a decision to impose an administrative fine” (section 142(1)) and a SA when “deciding whether to impose an administrative fine” (Article 83(2)). Even if the decision regarding the imposition of a fine is included with other findings or decisions in an overall document or decision, that cannot detract from the specific treatment of fining decisions under Chapter 6. The use of the term “decision” is not therefore 15 necessarily an individually documented decision, but can rather be a “decision” within a broader document which also includes other statutory decisions. 68. The LinkedIn Decision at issue here is a single document which includes discrete sections dealing with decisions as to infringement, whether to exercise corrective powers and which powers to exercise. The question of infringement is addressed under the headings of Issues A to E and occupies pages 22 to 107 of the document. This is the decision adopted pursuant to section 113(2)(b). The decision as to whether and which corrective powers to exercise is then addressed from pages 108 to 110, with the decision on the imposition of administrative fines commencing on page 111 and continuing to page 137. The fact that each of these elements of the overall decision are in the same document does not alter the scope of section 142. 69. As the terminology may be apt to confuse, I use the term “decision” when addressing the “decision” as to whether there was infringement and the “decision” as to whether to exercise the corrective power to impose a fine. LinkedIn in its submissions favours the designation of these as “findings” or stages in a decision-making process, rather than as separate “decisions”. It is argued by LinkedIn that there is only one decision. Based on the language of sections 111(2), 112(2), 113(4) and 115(1)(a) and the interpretation of that language in this judgment, I consider that the finding that there was infringement and the determination as to which corrective powers to exercise and, specifically, whether and in what amount to impose a fine, are properly to be termed “decisions” as that is the language of Part 6 of the DPA. I would however emphasise that this is not to be confused with the references to “decision” in other contexts, particularly Article 60 GDPR. As already noted, there is no rule or requirement of EU law as to how a decision of an SA is to be structured or composed and there is certainly no impediment to the DPC issuing a composite “decision” which includes several distinct decisions, as was done here. This does not alter the analysis or interpretation of the relevant provisions of the DPA. I do not attach any weight to the inclusion in a single composite document of the decision on infringement; the decision on the imposition of a fine; and the decision on the exercise of other corrective measures, or to the application by the DPC of the singular term “decision” to that document. Rather, the material factor in the interpretation of the 2018 Act is the language of that Act and the relevant provisions (sections 111(2), 112(2) and 113(4)) unambiguously require distinct decisions and that is the correct framework for the analysis here (regardless of how the decisions are presented). Section 116 70. A further provision to which LinkedIn attaches particular weight is section 116. In the context of section 113 (the relevant provision here), section 116(2) provides: “Subject to subsection (4), the Commission shall— 16 (a) as soon as practicable after it adopts a decision under section 113(2)(b), give the controller or processor concerned a notice in writing setting out— (i) the decision and the reasons for it, and (ii) where applicable, the corrective power that the Commission has decided to exercise or, as the case may be, the action that it has decided to take, in respect of the controller or processor, and (b) in the case of a complaint lodged with the Commission, and as soon as practicable after the giving of the notice under paragraph (a), give the complainant concerned a notice in writing setting out— (i) the decision and the reasons for it, and (ii) where applicable, the corrective power that the Commission has decided to exercise or, as the case may be, the action that it has decided to take, in respect of the controller or processor.” 71. LinkedIn relies on the references in section 116 to “the decision” singular, as evidence of a unitary decision, the entirety of which must be appealable together, whereas the DPC contends that section 116 continues to evidence the dichotomy between the decision on infringement (and the reasons for it) and the corrective powers which the DPC has decided to exercise, each being addressed separately in that provision. I am not persuaded that section 116 assists greatly in the interpretation of the scope of section 142. It does refer to notice of a “decision” as a general, singular term, but then also refers – separately and disjunctively – to notice of “the corrective power that the Commission has decided to exercise”. It does not clearly advance either interpretation although it is arguably more consistent with the view of the DPC as to the disjoint between infringement and corrective measures. Chapter 6 72. The next question of interpretation of the 2018 Act concerns Chapter 6. This Chapter contains sections 141, 142 and 143 and deals with the topic of the imposition of administrative fines. Before addressing the text of those provisions, it is relevant to summarise LinkedIn’s position. LinkedIn embraces the proposition that it is the imposition of an administrative fine which warrants the particular appeal provisions contained in section 142. However, it asserts that this does not result in or arise from a bifurcation of the decision on infringement and fines. The case made is that there is at all times a single “decision” and that, if a fine is imposed as part of that decision, the decision in its entirety is appealable under section 142. I will return to this question when I assess the alleged overlaps between infringement and fines and the absurdity arguments raised by LinkedIn. 73. There is however no dispute – nor could there be – but that the power to impose an administrative fine is of a different character to the other corrective powers conferred on an SA by the GDPR or that it is 17 only when a fine is imposed that section 142 is available. The dispute hinges on whether the other decisions may then also be appealed under section 142. Section 141(1) 74. The starting point is section 141(1) which requires the DPC to act in accordance with section 141 and Article 83 GDPR in considering “(a) whether to make a decision to impose an administrative fine, and (b) where applicable, the amount of such a fine.” 75. The plain language of “decision to impose an administrative fine” suggests that there is a distinct identifiable decision to impose a fine. This also reflects section 115(1). The requirement to act in accordance with section 141 and Article 83 GDPR when considering whether and in what amount to impose a fine suggests a need for a deliberate and careful assessment of the requirements of those provisions when considering the imposition of an administrative fine. This in turn points to a need for a clear segregation in the decision-making analysis, such that there is an identifiable decision-making stage during which those requirements are triggered. Section 142(1) 76. Section 142(1) then provides that “Without prejudice to section 150, a controller or processor that is the subject of a decision under section 111, 112, 113 or 133(9) to impose an administrative fine may, within 28 days from the date on which notice of the decision concerned was given to it under section 116 or, as the case may be, section 133(9)(b) appeal to the court against the decision.” 77. The wording of this provision was addressed quite extensively by the parties and the discrete arguments – and my analysis of them - will next be addressed. 78. Beginning with the introductory wording that section 142 is “without prejudice to section 150”, counsel for LinkedIn contends that this does not limit the scope of section 150, but is rather a statutory device to ensure there is no unintentional effect on that provision. LinkedIn’s position is that section 150 does allow for an appeal against decisions to impose corrective measures, including fines, but that section 142 is an alternative avenue of appeal when a fine is imposed and includes the important additional facility to introduce new arguments and evidence. 79. It is argued by the DPC that the starting point is that section 150 applies to all appeals and its breadth is acknowledged by the “without prejudice” language in section 142. This signals that section 142 is not 18 intended to undermine or “read down” section 150. The DPC contends that, if LinkedIn’s interpretation of the scope of section 142 was correct, there would be no reference to section 150. My understanding of the DPC’s submissions on this point is that the words “without prejudice to section 150” confirm and advance the DPC view that the decision on infringement remains a decision which is to be appealed under section 150. 80. I prefer the view of LinkedIn on this specific point (although not because of the need for a unitary appeal as LinkedIn suggests). The starting point is that the parties agree that there is no possibility of a decision other than a decision “to impose a fine” being subject to section 142 (while sharply diverging as to what a decision “to impose a fine” encompasses). As I have already discussed in the context of section 150(12), I am satisfied and agree with LinkedIn that an appeal against a decision to exercise the power to impose a fine may be brought under section 150(5). 81. Accordingly, the words “without prejudice to section 150” in section 142 serve a meaningful purpose: they confirm that the right of appeal under section 142 does not prejudice the right of a controller or processor to elect to challenge the imposition of a fine under section 150(5). These words would not be necessary unless there was otherwise a risk that section 142 would prejudice the scope of section 150. 82. The broader proposition which appears to be advanced by the DPC – that the words “without prejudice to section 150” confirm that section 150 is not to be generally “read down” but rather continue to apply to the infringement decision – involves a circularity of sorts. If the “decision to impose a fine” is limited to the fining decision as the DPC contends, there is no risk that section 142 could apply to the decision more generally and the words “without prejudice to section 150” would not be needed to confirm that the infringement decision falls under section 150. 83. The presumption against superfluous wording (Cork Co Council v. Whillock [1993] 1 IR 231) would lean against that interpretation. Somewhat ironically, it is only if LinkedIn was correct and both aspects of a DPC decision (infringement and fine) would otherwise come under section 142, that the carve-out for section 150 for which the DPC contends would make sense, but that cannot sensibly be the premise of the DPC’s interpretation of section 142(1). 84. In any event, I do not favour that interpretation (if it is the interpretation of the DPC) and repeat my view that the reason for the reference to section 142 being “without prejudice to section 150” is to confirm that a processor or controller retains the option to appeal a decision on the imposition of a fine under section 150(5), section 142(1) notwithstanding. 85. The next step is to interpret the words “adecision under section 111, 112, 113 or 133(9) to impose an administrative fine”. LinkedIn’s position is that the “decision.. to impose an administrative fine” 19 includes both findings of infringement and the corrective powers being exercised. LinkedIn also contends that, if section 142 was to be confined to sections 111(2) or 112(2) or 113(4) (which relate to corrective powers), that would have been set out, as it was in section 115, but this did not happen. As a matter of statutory language, I do not see that this point assists LinkedIn. If there was a reference to sections 111(2), 112(2) or 113(4) in section 142, that would bring all corrective measures within the scope of section 142 but would point more firmly towards the exclusion of the infringement decisions under section 111(1), 112(1) and 113(2(b) 86. The DPC’s view is that, if it was intended that section 142(1) would capture decisions on infringement as well as decisions on the imposition of fines, then the words “to impose an administrative fine” would be otiose. The presumption against redundancy in legislation is referenced to counter that interpretation of section 142(1). The DPC also contends – compellingly – that LinkedIn in fact reads section 142(1) as if it included the words “decision which includes the imposition of a fine” rather than decision “to impose an administrative fine”. 87. Weighing these contradictory positions, it seems to me that the plain language of section 142(1) does favour the view that it is the specific decision to impose a fine that is captured by that provision. The reference to the decision “to impose an administrative fine” is specific and unambiguous. If the Oireachtas intended the interpretation urged by LinkedIn, section 142(1) could have referenced “a controller or processor that is the subject of a decision under section 111, 112, 113 or 133(9) which includes the imposition of an administrative fine may, within 28 days from the date on which notice of the decision concerned was given to it under section 116 or, as the case may be, section 133(9)(b) appeal to the court against the decision.” That is not the wording of section 142(1). 88. Its interpretation of section 142(1) is supported, according to the DPC, by the focus on fines throughout Chapter 6. I agree that this is the relevant immediate context of section 142(1) and points towards the focus of the appeal under that provision being on the imposition of the fine. It must also be recalled that section 115(1) expressly subjects only the decision on the imposition of a fine to Chapter 6. 89. The primary answer by LinkedIn to these points of textual interpretation is that it does not dispute that the special appeal mechanism under section 142 is focussed on, and based on, the imposition of fines. However, it contends that the decision to impose a fine is interwoven with and indistinguishable from, the findings of infringement. I will return to these arguments below. Section 142(3) 90. Section 142(3) provides: 20 “Subject to subsections (4) and (5), the court may, on the hearing of an appeal under subsection (1)— (a) confirm the decision the subject of the appeal, (b) replace the decision with such other decision as the court considers just and appropriate, including a decision to impose a different fine or no fine, or (c) annul the decision.” 91. LinkedIn relies on the references in section 142(3) to “the decision” of the DPC in the singular. I do not regard this reliance on the singular form of “decision” as a compelling aid to the interpretation of the scope of section 142. As already seen, sections 111, 112, and 113 envisage separate decisions on infringement and corrective powers and the position of the DPC and the State – with which I agree – is that the plain language of section 142 only addresses the decision on the imposition of fines. 92. LinkedIn also argues that an appeal against a fining decision alone cannot result in no fine, unless the findings of infringement are examined. It is said that the power to annul “the decision” only makes sense if the decision includes findings of infringement and sanctions. It is pointed out that section 142(3) is not limited and in particular does not say that an order annulling the DPC decision or substituting it with a decision imposing no fine are only possible if the circumstances of infringement so warrant. I will return to these submissions and the response of the DPC and the State in respect of them, when I assess LinkedIn’s points about the overlap that exists between findings of infringement and fines. Section 142(4) 93. The DPC attaches particular weight to section 142(4): “The court shall, for the purposes of subsection (3), act in accordance with Article 83.” Article 83 is concerned with the conditions that govern the imposition of administrative fines. Accordingly, a court hearing an appeal under section 142 must – without qualification or carve-out – act in accordance with the rules of the GDPR governing the imposition of fines. According to the DPC, section 142(4) is extremely important as it applies Article 83 to the entirety of section 142(3). It is said that the interpretation urged by LinkedIn renders section 142(4) anomalous and that this is reinforced by sections 142(5) and (6) which deal with fines as opposed to infringement. The DPC also contends that, if section 142 was as all-inclusive as LinkedIn asserts, section 142(4) should refer in general terms to the court acting in accordance with the GDPR. 94. The reply by LinkedIn is that the reason for including section 142(4) is that Article 83 is directed to the SAs and, given the court has a broad power to replace or annul the DPC decision (including the decision to annul or replace the decision), it must also be so bound. 21 95. While there is of course merit to the proposition that the court must be bound by Article 83 when reviewing a decision of an SA to which Article 83 applies, Article 83 only pertains to the imposition of an administrative fine and so it is only insofar as the decision being appealed also pertains to the imposition of an administrative fine that Article 83 is activated. 96. I prefer the position advocated by the DPC that section 142(4) only makes sense if the court is engaged in an exercise of reviewing the imposition of fines. It does not properly sit with an appellate role of reviewing findings of infringement. This provision therefore favours the overall proposition that section 142 is concerned with, and specifically and logically addressed to, a decision as to the imposition of a fine and not other decisions of the DPC. Heading of section 142 97. Before leaving the language of section 142, the heading of that provision may be noted: “appeal against administrative fine”. The primary position of all parties is that there is no ambiguity in section 142 such as to warrant regard being had to that wording (applying sections 5 and 7 of the Interpretation Act 2005). However, the DPC also contends that, if there was such ambiguity the heading of that section can be considered and supports its interpretation as to the scope of section 142. I agree that there is no ambiguity in the language of section 142: it plainly only applies to a decision to impose an administrative fine and not a decision on infringement under sections 111(1), 112(1) or 113(2)(b). There is no basis to have regard to the heading of that provision. If there was ambiguity in section 142, the heading would however support the interpretation already arrived at. Section 143(1) 98. Section 143(1) was referenced by both the DPC and LinkedIn. It provides: “Where a controller or processor does not appeal in accordance with section 142(1) against a decision by the Commission to impose an administrative fine on the controller or processor, the Commission shall, as soon as is practicable after the expiration of the period referred to in that subsection, and on notice to the controller or processor concerned, make an application in a summary manner to the Circuit Court for confirmation of the decision…”. 99. This provision does fall to be read in light of Zalewski v. Adjudication Office [2022] 1 I.R. 421 ("Zalewski"). In Zalewski, the Supreme Court found that the Workplace Relations Commission was engaged in the administration of justice under Article 34, with the majority of the Court holding that the powers and functions of a judicial nature which were exercised were of a limited nature and permitted as such by Article 37 of the Constitution. I will address the reliance placed on Zalewski later in the judgment. 22 100. In the context of section 143(1), LinkedIn made the case in replying submissions that the confirmation function under that provision must be broader than a review of a decision to impose a fine, to ensure that the DPC is engaged in the exercise of limited functions and powers of a judicial nature within the meaning of Article 37 of the Constitution. 101. The interpretation of section 143(1), the impact of Zalewski and the question of whether the DPC is engaged in the exercise of limited powers and functions of a judicial nature within the meaning of Article 37 are all questions that will feature heavily in the separate judicial review proceedings which are pending. I am acutely conscious of the need not to trespass on that exercise and indeed it was emphasised repeatedly in oral submissions that I am not being asked to determine these important issues here. Moreover, the interpretation of section 143(1) is of somewhat tangential relevance to the issues before me and was not argued sufficiently to be determined. For these reasons, I do not make any findings as to the scope of section 143(1). (c) GDPR Article 83 Article 83 applies to appeals under section 142. It lists the factors to which regard must be had when determining whether and in what amount to impose an administrative fine. These include factors such as the nature, gravity and duration of the infringement; the intentional or negligent character of the infringement; any actions taken to mitigate damage; the degree of responsibility of the controller or processor. The overarching requirement is that fines must be “effective, proportionate and dissuasive” (Article 83(1)). 102. Article 83(8) mandates that, “[t]he exercise by the supervisory authority of its powers under this Article shall be subject to appropriate procedural safeguards in accordance with Union and Member State law, including effective judicial remedy and due process.” 103. This confirms that the requirements of procedural safeguards and an effective judicial remedy apply specifically to the exercise of the power to impose administrative sanctions and that it is for Member States to determine the appropriate procedures to achieve that end. 104. The State makes the point – with which I agree – that the GDPR does not itself dictate how a Member State should achieve the protections required by Article 83. Recital 143 to the GDPR confirms the autonomy of Member States on such questions: “Proceedings against a supervisory authority should be brought before the courts of the Member State where the supervisory authority is established and should be conducted in accordance with that Member State's procedural law.” 23 105. The GDPR is silent as to whether there should be a single decision or two decisions or a composite decision, provided the decision to impose an administrative fine meets the criteria of Article 83. The deference to Member States in this area is further confirmed by Article 83(9), a provision cited by both the DPC and LinkedIn. That provision permits fines to be initiated by a SA and imposed by a court, provided the requirements of equivalence and effectiveness are satisfied (which is how the GDPR has been implemented in Estonia and Denmark). 106. The DPC in turn places reliance on the specific provisions governing fines and other corrective measures in Articles 83 and 58 GDPR respectively, although the position adopted by the DPC is that the GDPR does not mandate that there can only be one decision or preclude the Oireachtas from providing for separate appeals. It is said that the GDPR does not dictate or influence how domestic legislation should be interpreted in this respect. As already noted, I agree with this view of the impact of the GDPR on Issue 1. Article 60 107. There are contrasting arguments made by reference to Article 60 GDPR, which sets out the process of cooperation that must take place between SAs when a lead supervisory authority(“LSA”) is investigating a complaint involving cross-border processing. This is the so-called "one-stop-shop" mechanism. Under Article 60, the LSA here, the DPC- is required to cooperate with concerned supervisory authorities ("CSAs") to endeavour to reach consensus; to exchange all relevant information with the CSAs; and to submit, without delay, a draft decision to the CSAs for their opinion. CSAs may raise reasoned and relevant objections to the draft decision, which must be resolved (if necessary by the dispute resolution procedure under Article 65(1)) before the decision can be adopted by the LSA. 108. LinkedIn emphasises that Article 60 (among other provisions of the GDPR) refers to a “draft decision” and “decision” as a singular term and asserts that the GDPR mandates or envisages that there be one decision only, which should be notified in its totality to other SAs and travel through the procedural steps of Article 60. LinkedIn identified a series of provisions of the GDPR which refer to a singular decision on which other SAs may comment under Article 60(7). This is said to support LinkedIn’s interpretation of the scope of section 142 as a single appeal provision. The DPC disputes this reliance on Article 60 and the references to “decision” generally in the GDPR, pointing out that the GDPR does not dictate how decisions of the SAs or appeals against those decisions are to be structured. 109. I note that there is no definition of “draft decision” or “decision” in Article 60 or in the GDPR and no limitation or prescription as to what a “draft decision” or “decision” should contain, whether it can consist of different decisions or segregated findings, or how it should be constituted. Recital 129 GDPR 24 provides some guidance as to presentation of legally binding measures, while deferring to Member States’ procedural law: “Each legally binding measure of the supervisory authority should be in writing, be clear and unambiguous, indicate the supervisory authority which has issued the measure, the date of issue of the measure, bear the signature of the head, or a member of the supervisory authority authorised by him or her, give the reasons for the measure, and refer to the right of an effective remedy. This should not preclude additional requirements pursuant to Member State procedural law.” 110. I do not accept the contention by LinkedIn that the fact that Article 60 refers in bald terms to “the decision” or “draft decision”, translates into a prescription or requirement as to how a supervisory authority is to structure its findings or that it could supplant the procedural autonomy of Member States as to how they implement the GDPR procedures and requirements. 111. On the contrary, there is a range of different permutations in which decisions may be made and different ways in which a Member State may transpose the requirements of the GDPR. As the DPC points out, a fine may be imposed by a Member State’s court as opposed to its supervisory authority, as facilitated by Article 83(9), for example, with the result that the decision on infringement could be made by the SA but the decision on the fine could only be made by the court. Article 60(8) addresses decisions rejecting complaints, which will clearly only involve findings on infringement. It seems plain from Article 60 that, regardless of the structure or composition of the findings and whether they are presented as individual or separate decisions or not, the key requirement is that they must all be communicated under Article 60. 112. Consequently, I agree with the State that the GDPR does not answer or even inform the questions of how a Member State can or should structure appeals against decisions of SAs. It is a matter within the “procedural autonomy” of Member States. The appellate structure that is in place (including whether there is a separate appeal against the decision as to the imposition of a fine) is a matter of interpretation of domestic legislation, provided the requirements of effectiveness and equivalence and the specific requirements of Article 83 as regards the imposition of fines are satisfied. I agree with the DPC and the State in this respect. 113. Accordingly, the GDPR does not cast light on the question of whether it is only a decision on the imposition of fines that is appealable under section 142 or whether that provision also applies to an appeal against a substantive infringement decision. This is not to say that the context of the GDPR is not relevant. Far from it: Article 83 of the GDPR is crucial to the exercise of the power to impose fines 25 and evidences a solid, principle-based reason as a matter of EU law for the differentiation between the imposition of fines and other measures that may be imposed by SAs. 114. In that regard, I agree with the submission by the State that Article 83 underlines that a decision and appeal on the imposition of a fine has a distinct character from an anterior finding of infringement. (d) Conclusions on the interpretation of the statutory language 115. According to the clear terms of sections 111(2), 112(2) and 113(4), there are separate decisions as to infringement and then as to the exercise of corrective powers and, insofar as the decision is to impose an administrative fine, that decision is distinguished from other corrective powers by section 115 and stated to be “subject to Chapter 6”. 116. It appears to me that the language of these provisions points firmly towards the decision to impose an administrative fine as a discrete decision, distinct from findings of infringement and from the exercise of other corrective powers. 117. This interpretation is not only consistent with the statutory language of each provision read in isolation, but is also the interpretation of the scope of section 142 that is most consistent with the cumulative reading of the relevant provisions of Chapters 2 and 6 of Part 6 of the 2018 Act. The parties to these proceedings all recognise the very particular context of administrative fines and the need – as a matter of EU, Charter, ECHR and Irish constitutional law - to ensure effective judicial remedies and oversight when administrative fines are imposed by the DPC. This further points towards a rationale for a differentiated treatment and regime for fining decisions alone, which is consistent with section 142 having the more focussed remit for which the DPC contends. 118. These are the conclusions I have reached from interpreting the language of sections 142 and 150, in their immediate and broader legal contexts. LinkedIn argues against the interpretation that section 142 addresses only the decision on the imposition of fines and points to considerations which it is asserted render that interpretation absurd, unworkable and unprecedented. As noted in Heather Hill, the onus is on LinkedIn to establish that these provisions do “not have the effect suggested by the plain meaning of the words chosen by the legislature” (at [218]). I will therefore deal next with the arguments of impracticability and absurdity advanced by LinkedIn. (e) Absurdity Arguments 119. There are several different dimensions to LinkedIn’s case regarding the interaction between findings as to infringement and fining. I will address the arguments made under the following headings: i. Overlap between infringement and fine 26 ii. Orders under section 142(3) iii. Consequences of separate appeals iv. Content of the LinkedIn Decision (i) Overlap between infringement and fine 120. The position of LinkedIn is that a decision on infringement is inextricably linked and intertwined with a decision on the imposition of a fine; that there is only one decision and section 142 must apply to the decision as a whole. It is said to be unstateable that the court could have the power to review and substitute a decision imposing a fine - including by deciding to impose no fine - without any power to review the infringement findings and the facts that subtend the fine. 121. Emphasis is placed on Article 83(2) GDPR, which applies to any court hearing an appeal under section 142: “When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following: (a) the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them; (b) the intentional or negligent character of the infringement; (c) any action taken by the controller or processor to mitigate the damage suffered by data subjects; (d) the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them pursuant to Articles 25 and 32; (e) any relevant previous infringements by the controller or processor; (f) the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement; (g) the categories of personal data affected by the infringement; (h) the manner in which the infringement became known to the supervisory authority, in particular whether, and if so to what extent, the controller or processor notified the infringement; (i) where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned with regard to the same subject-matter, compliance with those measures; (j) adherence to approved codes of conduct pursuant to Article 40 or approved certification mechanisms pursuant to Article 42; and (k) any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement.” 27 122. The position advanced by LinkedIn is that an assessment of these factors will inevitably involve examining the entire substratum, factual and legal, of the findings of infringement. It was said that the best example of this overlap is that negligence must be shown to justify the imposition of a fine, which (it is said) involves looking at the entire premise of the findings of infringement, including how the processing was carried out, to ascertain whether it was negligent. LinkedIn contends that it would be complex, tortuous, unworkable and unprecedented for the court to have to assess the decision as to the fine without any assessment of the underlying infringement findings. 123. The DPC’s position is that LinkedIn overstates the linkage between the grounds of infringement and the factors to be weighed in relation to fines. It is asserted that in an appeal, the findings of infringement would be assessed first by reference to the materials that were before the DPC and the analysis of the fines would then proceed on the basis of the findings of infringement (which would not be re-opened). The court may receive new material directed to the question of the fine and the factors relevant to it. In that second stage, the relevant factors are concerned with the scale, gravity and nature of the infringement and the damage caused, which are premised on there already having been a finding of infringement and are different to the issues which arise at the infringement stage. Counsel for the DPC outlined how the appeal would be run in practice and contended that there would be no difficulty or complexity in the exercise that would need to be undertaken. The DPC asserts that there is no impediment to a controller challenging a fine without challenging infringement and that this situation is not uncommon in civil or criminal proceedings. 124. The State similarly emphasises that it is not unusual to have separate appeals against findings of infringement and fines in other legislation and points to examples such as the Central Bank Act 1942, section 33AW in that respect. In the course of oral submissions, counsel for the State also opened Guidelines 04/2022 issued by the European Data Protection Board on the calculation of administrative fines under the GDPR (24 May 2023). He referred to Chapter 4 of that document, which identifies the factors relevant to the calculation of fines, including “the nature, gravity and duration of the infringement” (at [51]). The document states that SAs are required to “carry out a complete examination of all elements that constitute the infringement…” (at [53]). “The intentional or negligent character of the infringement” also falls to be determined when fixing the fine (at [56]). The point made by the State was that there is no impediment to, or difficulty with, a broad review of those factors in the context of an appeal against sanction, and that this is what is envisaged by the GDPR. It is pointed out that issues of culpability may well be raised in an appeal against sanction and could be a basis for a controller to argue for the imposition of no fine in such an appeal. 28 Assessment 125. The fundamental question is whether and to what extent it is workable for a court to hear and determine an appeal concerning only a decision as to the imposition of fine, without also hearing and determining the appeal about the underlying infringement. 126. I consider that it is apparent from section 142(4), which incorporates Article 83 into the analysis, that any assessment of the fines imposed will involve some assessment of features of the infringing acts, such as their gravity and scale. It may also involve detailed assessment of the specific knowledge and conduct of the controller and processor to assess whether and to what extent the infringement was negligent or intentional. The Guidelines opened by the State highlight the depth of the analysis of the facts surrounding the infringement that may need to be carried out. 127. However, I do not share the concern of the LinkedIn that a court could not practicably weigh such factors for the purpose of deciding an appeal on fines without deciding infringement, or that this exercise would be so complex or unworkable as to favour LinkedIn’s interpretation of the scope of section 142. 128. As the State points out, courts are quite accustomed to deciding liability and quantum separately in bifurcated hearings and I agree with the DPC that the assessment of the factors in Article 83 can proceed on the basis of, and without disturbing, the underlying finding that there was infringement. 129. I would also note that the right to bring appeals against the imposition of fines under section 142 is designed to enhance the protection of controllers and processors, which the 2018 Act envisages may result in a comprehensive, detailed appeal, with the introduction of new evidence and arguments on the topic of fines alone (quite apart from the right to appeal against the findings of infringement and pursue an effective judicial remedy in that respect). This does not mean that the two appeals cannot run in tandem in the same proceedings. Indeed, this is how the statutory appeal was prepared (by way of alternative) in this case. (ii) Orders under Section 143(3) 130. LinkedIn relies on th