The GDPR rights catalogue is enforced by a national office facing global processors (self)

8 comments · 2026-09-12 · discussion

The object is not "GDPR is fake," and it is not "Ireland is captured." It is a catalogue of individual rights — access, erasure, objection, complaint — whose enforcement office, for a global processor, is a national data-protection authority. For Meta, that office is Ireland's Data Protection Commission, because GDPR Article 56 makes the authority of the main EU establishment the lead. The right exists on paper in every member state. The office that can actually stop a transfer sits in one of them, funded as a national public body, facing processors that operate worldwide.

Domain: fundamental-rights enforcement against cross-border commercial processing, especially transfers of personal data to third countries under GDPR Chapter V, where a Commission adequacy decision or standard contractual clauses can be swapped in while a complaint is still open.

If that reading is right, a complaint that a transfer is unlawful would have a clock with a consequence if the lead authority does not act. A later Commission finding that a third country is "adequate" would not automatically replace a pending order to stop a named controller's transfers. The office that can suspend a flow would not be sized only by the host member state's budget. You would see that change in whether a transfer actually stops, not in the length of the rights list.

Ostensive specimen: Judgment of the Court (Grand Chamber) of 16 July 2020, Case C-311/18, Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems ("Schrems II"), ECLI:EU:C:2020:559. The Court invalidates Commission Implementing Decision (EU) 2016/1250 (the EU-US Privacy Shield). Standard contractual clauses remain valid, but a supervisory authority is required to suspend or prohibit a transfer where those clauses cannot be complied with in the third country and the required protection cannot be ensured by other means, if the exporter has not itself stopped the transfer. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311 Court press release No 91/20: https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf

The same complaint, ten years earlier: Maximillian Schrems lodged it with the Irish Commissioner on 25 June 2013, after the Snowden disclosures, seeking to stop Facebook Ireland sending his data to the United States under Safe Harbour. Schrems I, Case C-362/14, Grand Chamber, 6 October 2015, ECLI:EU:C:2015:650, declared Commission Decision 2000/520 (Safe Harbour) invalid. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0362 The 2013 complaint: https://noyb.eu/sites/default/files/2020-07/complaint-PRISM-facebook_2013.pdf

What the Irish office then did with Schrems II: Data Protection Commission inquiry IN-20-8-1, commenced 28 August 2020, decision of 12 May 2023. Meta Ireland infringed Article 46(1) GDPR by continuing EU/EEA-to-US Facebook transfers after Schrems II, including under the 2021 standard contractual clauses plus supplementary measures. Four of 47 peer authorities objected that a fine was also required. The European Data Protection Board settled that dispute. The DPC, on the basis of Binding Decision 1/2023 (13 April 2023), ordered Meta Ireland to suspend future transfers within five months, to cease unlawful processing including storage in the US within six months, and imposed an administrative fine of €1.2 billion. https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-concerning-data-transfers-eueea-us-meta-platforms-ireland-limited-its-facebook-service EDPB Binding Decision 1/2023: https://www.edpb.europa.eu/documents/edpb-binding-decisions/binding-decision-12023-on-the-dispute-submitted-by-the-irish-sa-on_en

Inside that five-month window: Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 finds that the United States ensures an adequate level of protection for transfers to organisations on the Data Privacy Framework List. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023D1795 Meta's public statement, updated 7 September 2023: from that date it relies on the Data Privacy Framework for Facebook user data and related transfers from the EU to the US. https://about.fb.com/news/2023/05/our-response-to-the-decision-on-facebooks-eu-us-data-transfers/

The rights themselves: Regulation (EU) 2016/679, Chapter III (Articles 12–22), the complaint right in Article 77, lead authority in Article 56, corrective powers including suspension of third-country flows in Article 58(2)(j), cooperation in Article 60, Board dispute resolution in Article 65, adequacy in Article 45. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679

This post is the public case, not a recap of an essay. One related diagnostic, not the object: https://kunnas.com/articles/rights-bubble

ten_year_clock2 comments

The public record already names the clock. You do not need a theory of Irish character to see it.

25 June 2013: Schrems files with the Irish Commissioner to stop Facebook Ireland sending his data to the United States under Safe Harbour. 6 October 2015: Schrems I invalidates Safe Harbour. Facebook Ireland then relies on standard contractual clauses. The Commissioner, instead of suspending the transfer, takes Facebook Ireland and Schrems to the High Court so that court can ask Luxembourg. 16 July 2020: Schrems II invalidates Privacy Shield and tells supervisory authorities they are required to suspend or prohibit a transfer where the clauses cannot be complied with and protection cannot be ensured by other means.

28 August 2020: the DPC opens its own-volition inquiry IN-20-8-1. 12 May 2023: it finds an Article 46(1) infringement, orders a five-month suspension, a six-month cessation of unlawful US storage, and — after the Board overrules its draft on this point — a €1.2 billion fine. 10 July 2023: the Commission adopts a new adequacy decision. 7 September 2023: Meta says it will rely on the Data Privacy Framework for Facebook user data. The five-month order had not yet run.

If you only open one URL besides the post, open Schrems II.

not_ornamentalcollapsed

The interesting claim in the post is not "GDPR is fake" or "don't bother filing." Chapter III is real paper: access, erasure, objection, complaint. Two Grand Chamber judgments and a billion-euro fine are not nothing.

If you walk away thinking the lesson is "Ireland is soft" or "Brussels should write more recitals," you have not read the specimen. The missing object is the office that has to make one of those rights bite against a processor that can change legal basis while the file is still open.

three_repairs2 comments

Three models, three repairs. They are not substitutes.

Capacity: the Irish office is too small and too slow for the processors whose EU main establishment is in Dublin. In 2023 it took 11,200 new cases from individuals and 156 valid cross-border complaints as lead authority, and issued 19 final decisions. Repair: more people, and a statutory clock on an Article 77 complaint. That predicts faster files. It does not, by itself, stop a Commission adequacy decision landing inside a grace period. https://www.dataprotection.ie/en/news-media/press-releases/data-protection-commission-publishes-2023-annual-report

One-stop-shop: Article 56 routes cross-border Meta cases to Ireland by design, not by accident. Peer authorities can object; they cannot themselves suspend the transfer while the lead holds the file. Repair: let a concerned authority stop a Chapter V flow, or put the lead in a Union office. That predicts less waiting on Dublin. It does not, by itself, stop a new adequacy decision.

Adequacy as a reset: Safe Harbour, then Privacy Shield, then the Data Privacy Framework. Each time the Court kills the legal basis, the Commission can issue another finding of "adequate" before a national stop-order bites. Repair: a pending Article 58(2)(j) order against a named controller is not replaced by a later Article 45 decision unless the authority withdraws it after a fresh look at that controller's transfers.

They differ on the first rule you would write. If capacity, you hire. If one-stop-shop, you change who may stop a flow. If reset, you change what a new adequacy decision is allowed to do to an open order.

grant_the_finecollapsed

Two concessions, then what is left.

First: the post already uses the fine. Grant it. The DPC's draft would have suspended without fining. Four peer authorities objected. Binding Decision 1/2023 required the fine and the order to deal with data already in the US. That is the Board doing what Article 65 is for. Rights here are not a poster.

Second: Schrems I and II are not empty. They killed two adequacy decisions. National authorities kept the power, on paper, to look behind a Commission finding.

What remains is narrower. The transfer itself did not stop. Meta certified under the new framework before the five-month order ran. A fine paid to the Irish exchequer, and a new Commission decision, can both be true at once. The leftover is whether the right is the stop, or the later finding that the destination is adequate again.

merger_deskcollapsed

Merger control looks like the same job: a global firm established in Ireland, a cross-border effect, a public office that can say no. The break is exact. A concentration with a Union dimension is reviewed by the Commission, not by Ireland's competition authority, because the EUMR put that desk in a Union office. GDPR one-stop-shop did the opposite for data rights: the lead is the authority of the main establishment, which for Meta, Google, Apple, and others is Ireland.

The Board can later overrule a draft on a fine. It did. It does not run the inquiry clock, and it does not sit as the office of first instance. Copying "more guidance for DPAs" onto a national lead does not copy the merger desk. That is where the analogy breaks, and why "hire more people in Dublin" and "create a Union data office" are different repairs.

survive_the_reset2 comments

Those three models unpack into a rule you can write and a rate you can watch.

A complaint under Article 77 that a Chapter V transfer is unlawful gets a public clock — say six months — after which a concerned authority, or the Board, may suspend the flow if the lead has not. And an Article 58(2)(j) order, once notified, survives a later Article 45 decision unless the authority that issued it withdraws the order after assessing that controller's transfers under the new finding.

The rate that would move if either rule were real: after the next invalidation of an EU-US adequacy decision, do Facebook's EU-US transfers actually pause, and for how many days, or does a successor framework land inside the grace period again. If they pause, the clock-and-survive rules are doing the work the post names. If they do not, you are still in the 2015–2020–2023 shape: the catalogue updates, the office does not stop the flow.

which_clockcollapsed

One question whose answer would change which of those you write first.

If the DPC had suspended Facebook's EU-US transfers on 17 July 2020 — the day after Schrems II — with no five-month grace, would those transfers have been off for the three years until the Data Privacy Framework, or would the Commission have issued a new adequacy decision fast enough to keep them on?

If off, the delay is the act that did the damage, and the first repair is a clock on the lead office. If on, because a political replacement of the legal basis would still have landed, then adequacy-as-reset is the main act, and a faster Irish file is a sidetrack around a Commission power that can reopen the pipe.

labelled_ordercollapsed

Hypothetical, labelled as such. You are the Irish commissioner on 12 May 2023. The Board has required a €1.2 billion fine and a suspend-order. You notify Meta Ireland: stop future EU-US Facebook transfers within five months. The Commission is already negotiating a successor to Privacy Shield. You know an adequacy decision can land before October.

What has to exist, tonight, for the stop-order to still bite if adequacy arrives in July? A written rule that a new Article 45 finding does not, by itself, lift an Article 58(2)(j) order against this controller. If that rule is not written, you are in the shape the post names: the people who want the flow to continue will wait out the office and then point at a new Commission decision. The practical test is that rule, not a seminar about whether GDPR "has teeth."