Dublin bottleneck blunts GDPR fines

When a Maltese user complains about Facebook, Instagram, WhatsApp or TikTok, the real decision is usually not taken in Malta. It goes to Dublin. The Irish Data Protection Commission handles nearly all major GDPR enforcement against global technology companies, and its former head has now said openly that the system does not work well for the problems that matter most. Helen Dixon told a Law Society event this month that the GDPR is "not always useful for systemic issues" (Law Society of Ireland).

Coming from the official who led Irish enforcement through its busiest years, that is more than a passing remark. It points to a weakness built into Europe’s privacy regime since the start.

How one city became Europe's privacy capital

The GDPR created the "one-stop-shop" mechanism under Article 56 (EUR-Lex). The idea was tidy enough: a company operating across the EU should not have to answer separately to 27 national regulators. The regulator in the country where it has its main EU office would take charge of cross-border cases.

That made Ireland unusually powerful. Apple, Google, Meta, TikTok, LinkedIn and Microsoft all placed their European headquarters there. The DPC became, in practice, the privacy regulator for much of Europe’s technology industry (anonym.community).

The process runs through Article 60 cooperation. The DPC, as Lead Supervisory Authority, investigates a complaint and writes a draft decision. It then sends that draft to the other national data protection authorities affected by the case, called Concerned Supervisory Authorities. If they object, as they often do, the dispute goes to the European Data Protection Board for a binding ruling (EUR-Lex).

For Malta, as for other smaller member states, this means the local regulator can object but cannot simply take over a cross-border case against one of these companies. Dublin writes the decision; the rest of Europe gets a say on whether it is strong enough.

The system was meant to stop companies choosing the softest regulator. What it produced instead was a different concentration of power: one mid-sized national agency became the main enforcement gate for a continent.

Big fines, slow collection

The DPC has issued roughly 80% of all major EU technology fines under the GDPR (anonym.community). The headline penalties are large: €1.2 billion against Meta for unlawful transfers of European user data to the United States, €530 million against TikTok for allowing Chinese engineers to access European data, and €310 million against LinkedIn for illegal behavioural profiling (anonym.legal).

But a fine announced is not the same as a fine collected. Companies appeal nearly every major decision, and Irish courts can freeze payment while litigation continues. The gap between the penalty in the press release and the money actually received remains wide.

Other national regulators face their own limits. Under Article 60, smaller authorities can challenge Dublin’s draft decisions, but they cannot act independently on cross-border cases involving these companies. They are inside the process, but not in control of it.

A fix with a deadline

A new GDPR Procedural Regulation, due to enter force in April 2027, introduces a 15-month deadline for lead authorities to issue draft decisions in cross-border cases (Netguardia). Under the current system, investigations have dragged on for years. Meta’s €1.2 billion fine took five years from the initial complaint to the final decision.

The reform also sets clearer timelines for when Concerned Supervisory Authorities must submit objections and when disputes must move to the EDPB (Netguardia).

That addresses delay. It does not address the deeper imbalance: one national agency, answerable to Irish courts and operating under Irish administrative law, carries the main regulatory burden for technology companies serving 450 million Europeans.

Dixon’s admission that the framework struggles with systemic issues (Law Society of Ireland) leaves Europe with the harder question. Faster decisions will still pass through the same narrow channel. At some point, the EU may have to decide whether the problem is traffic, or the road itself.