This guide brings together and replaces our earlier news posts on the GDPR in practice, from WHOIS redaction and Ireland's data protection rules to record fines, rewritten and expanded in October 2026 as a sourced reference.
The EU's General Data Protection Regulation (GDPR) was adopted in April 2016 and took full effect on 25 May 2018. On paper, its enforcement tools are formidable: for the most serious breaches, regulators can impose fines of up to €20 million or 4% of a company's total worldwide annual turnover, whichever is higher. In practice, how the law bites depends on decisions made by internet bodies, national governments and a handful of regulators who supervise the largest tech companies.
Ireland sits at the center of that story, because many big tech firms have their EU headquarters in Dublin. Its Data Protection Commission (DPC) issued the largest fine in its announcements to date, €1.2 billion against Meta in May 2023 over data transfers to the US. This page follows three moments that show the GDPR at work: the internet's WHOIS directory going dark in 2018, an Irish law in 2023 that let the DPC keep case information confidential, and the €310 million LinkedIn fine in 2024. Each is set out as a dated case file with what happened, the impact, the response and what happened next.
In this guide
- How cross-border GDPR enforcement works
- April to May 2018: GDPR ends the open WHOIS directory
- June to July 2023: Ireland's confidentiality law for DPC cases
- October 2024: LinkedIn fined €310 million over targeted advertising
- The largest fines from Ireland's DPC
- Timeline and summary table
- What this means for you, and for organizations
- FAQ
A note on sources: facts and figures here come from the GDPR text, regulator decisions, ICANN, Irish legislation and named organizations, linked at the end. Where a view belongs to an advocacy group, it is attributed to that group rather than presented as fact.
How cross-border GDPR enforcement works
Every EU and EEA country has its own data protection authority. When a company operates across borders, the GDPR's "one-stop shop" system makes the authority in the country of the company's main EU establishment the lead supervisory authority. That is why a complaint about LinkedIn made in France ended up with the Irish DPC: LinkedIn's EU controller is in Ireland.
The lead authority does not act alone. Under Article 60 of the GDPR, it shares a draft decision with the other "concerned" authorities, which can raise objections. If they cannot agree, the dispute goes to the European Data Protection Board (EDPB) under Article 65, and the EDPB's binding decision shapes the final outcome. This process has changed results more than once. In the 2021 WhatsApp case, the EDPB told the DPC to reassess and increase its proposed fine, which ended at €225 million. In the 2023 Meta transfers case, the EDPB's decision led to the €1.2 billion fine after four of the 47 concerned authorities objected that the DPC had not proposed one.
This structure explains why the cases below matter beyond Ireland. Rules about who can see a case file, how fast decisions are made and how disagreements are settled affect people across the EU whose data is handled by a company based in Dublin.
April to May 2018: GDPR ends the open WHOIS directory
What happened
For decades, anyone could look up who owned a domain name through WHOIS, a public directory that often listed the registrant's name, postal address, email address and phone number. ICANN, the nonprofit that coordinates domain names, required registries and registrars to publish this data under its contracts. With the GDPR about to apply, publishing individuals' contact details to the whole world became very hard to justify.
In the year before May 2018, ICANN consulted registries and registrars, European data protection authorities, legal experts and governments about the impact of the GDPR on registration data. In April 2018, as covered in our original post, ICANN was still seeking more time; reporting at the time by The Register said European regulators had told ICANN the GDPR contained no provision for an enforcement moratorium. With no exemption available, ICANN's Board adopted a Temporary Specification for gTLD Registration Data on 17 May 2018, effective from 25 May 2018, the day the GDPR applied.
Impact
The Temporary Specification kept the collection of registration data but moved most personal data behind "layered/tiered access." In ICANN's words, people with a legitimate and proportionate purpose could request non-public data through registrars and registry operators, and anyone could still contact a registrant through an anonymized email address or web form. Registrars were allowed to apply the rules worldwide where that was commercially reasonable or where limiting them to GDPR-covered data was not technically feasible, so many WHOIS records outside Europe became redacted too.
The change cut both ways. Domain owners, including individuals running personal sites, stopped having their home addresses and phone numbers published by default. Security researchers, law enforcement and brand-protection teams lost a quick, free way to identify who was behind a domain and had to request data instead.
Response
The Temporary Specification was meant as a stopgap. ICANN's community then worked on permanent rules through an Expedited Policy Development Process (EPDP) on the Temporary Specification. An Interim Registration Data Policy bridged the gap until the permanent Registration Data Policy took effect on 21 August 2025. That policy was revised again on 12 May 2026 to add a timeline for responding to urgent requests for the lawful disclosure of non-public data.
What happened next
Two practical changes followed. First, ICANN launched the Registration Data Request Service (RDRS) on 28 November 2023, a central place to request non-public data from participating registrars. It is aimed at those with a legitimate interest, such as law enforcement, intellectual property professionals, consumer protection advocates, cybersecurity professionals and government officials. After the two-year pilot ended in November 2025, ICANN's Board directed it to continue RDRS for up to two more years while policy work continues.
Second, the WHOIS protocol itself was retired for generic top-level domains. As of 28 January 2025, ICANN made the Registration Data Access Protocol (RDAP) the definitive source for gTLD registration information in place of WHOIS. RDAP supports secure access and differentiated access to registration data, which fits the GDPR model of showing different data to different requesters. ICANN's own lookup tool at lookup.icann.org now uses RDAP.
June to July 2023: Ireland's confidentiality law for DPC cases
What happened
In late June 2023, at the final stage of a broad courts bill, the Irish government added an amendment inserting a new Section 26A into the Data Protection Act 2018. The bill became the Courts and Civil Law (Miscellaneous Provisions) Act 2023, dated 5 July 2023.
Section 26A lets the DPC, by written notice, identify information it gives to a person in connection with an investigation, complaint, inquiry or audit as confidential, explain why, and direct the person not to disclose it. The law defines confidential information as commercially sensitive information, information given in confidence where disclosure would discourage future information, or information whose disclosure the DPC believes could prejudice its work. Disclosure is still allowed where it is required or permitted by law, or authorized by the DPC in writing. Breaking a direction is an offense punishable on summary conviction by a class A fine. Some confidentiality ends automatically once the DPC's relevant function is complete.
Impact
The provision drew strong criticism from privacy advocates. The privacy group noyb, founded by Max Schrems, which has brought many complaints to the DPC, said the amendment would make most reporting about DPC procedures a crime and described it as aimed at its own work. According to noyb, the Irish Council for Civil Liberties, Amnesty International, European Digital Rights (EDRi) and the European consumer group BEUC also objected, and Member of the European Parliament Sophie in 't Veld raised concerns. noyb said opposition parties pushed back in the Irish parliament, while the government's position was that the DPC could claim confidentiality only in specific circumstances and for specific information.
The dispute had a history. In October 2021, noyb reported that the DPC had asked it to remove documents about a pending procedure from its website, a demand noyb refused.
Response
noyb said it would not limit legitimate public speech about cases it is involved in. It argued that the law's "permitted by law" exception could cover freedom of expression, and that Irish criminal law cannot reach people outside Ireland, pointing to Article 55(1) of the GDPR, which limits each authority's competence to its own country. Those are noyb's legal views, not a court's.
What happened next
The wider question of how cross-border GDPR cases are run moved to the EU level. On 4 July 2023, the European Commission proposed a new regulation setting common procedural rules for cooperation between data protection authorities, including how parties are heard and access case files. noyb criticized the proposal as favoring companies over complainants. By May 2025, noyb reported that negotiations between the Parliament and Council were near their final meeting and that the new rules would apply after a transition period of 18 months from publication, meaning around the end of 2026 or the start of 2027. Organizations with cases before EU regulators should check the final text and its application date.
October 2024: LinkedIn fined €310 million over targeted advertising
What happened
On 24 October 2024, the Irish DPC announced its final decision in an inquiry into LinkedIn Ireland. The case began with a 2018 complaint by the French digital rights group La Quadrature du Net to France's data protection authority, the CNIL. Because LinkedIn's EU controller is in Ireland, the complaint passed to the DPC as lead authority, which opened its inquiry on 20 August 2018.
The inquiry examined how LinkedIn processed members' personal data for behavioral analysis and targeted advertising. That included data members gave LinkedIn directly (first-party data) and data about members that LinkedIn obtained from third-party partners (third-party data).
Impact
The DPC found that LinkedIn had no valid legal basis for the processing under GDPR Article 6, as summarized below, and also breached the transparency rules in Articles 13 and 14 and the fairness principle in Article 5(1)(a).
| Legal basis LinkedIn relied on | Data and purpose | DPC finding |
|---|---|---|
| Consent (Article 6(1)(a)) | Third-party data for behavioral analysis and targeted ads | Consent was not freely given, sufficiently informed or specific, or unambiguous |
| Legitimate interests (Article 6(1)(f)) | First-party data for behavioral analysis and targeted ads; third-party data for analytics | LinkedIn's interests were overridden by members' rights and freedoms |
| Contractual necessity (Article 6(1)(b)) | First-party data for behavioral analysis and targeted ads | Not a valid basis for this processing |
Source: Irish Data Protection Commission press release, 24 October 2024.
Deputy Commissioner Graham Doyle called processing without a proper legal basis "a clear and serious violation" of the fundamental right to data protection.
Response
The decision, notified to LinkedIn on 22 October 2024, included a reprimand, an order to bring its processing into compliance, and three administrative fines totaling €310 million. The DPC had sent its draft to other EU authorities in July 2024 under Article 60, and none objected, so the case did not need EDPB dispute resolution.
What happened next
The LinkedIn decision is a clear example of a regulator rejecting "contract" and "legitimate interests" as the legal basis for tracking-based advertising, and finding that the consent LinkedIn collected was not valid either. For anyone who uses LinkedIn in the EU, the practical result is that the company must have a valid legal basis for advertising profiles, and members can review advertising and data settings in their account. Whether LinkedIn appealed the decision was not something we could confirm from official sources, so check current reporting before citing its status.
The largest fines from Ireland's DPC
The LinkedIn fine is large, but not the largest. The chart below shows the eight biggest fines announced by the Irish DPC, all against companies with EU headquarters in Ireland. Several were set or raised after objections from other regulators.
Just below this list sit the €225 million WhatsApp transparency fine of 2021 and two Meta fines announced together in January 2023, €210 million for Facebook and €180 million for Instagram, in cases that began with complaints filed on 25 May 2018, the day the GDPR came into operation. The newest entry is the €403 million fine against Google, announced on 21 September 2026, over location data in Web & App Activity, Location History and Location Accuracy from 2018 to 2020.
Headline fines are not the same as money paid. The DPC says that more than €4 billion in fines have been levied as a result of its inquiries, but only about €20 million had been collected, because a fine cannot be collected while an appeal is pending in the Irish courts.
Two of the largest, the Meta and TikTok transfer cases, concern sending Europeans' data to countries whose laws the regulator found did not offer equivalent protection. In the TikTok case, the DPC also said that TikTok had told the inquiry it did not store EEA user data on servers in China, then informed the DPC in April 2025 that some had in fact been stored there. The other cases concern children's privacy settings, security design, transparency and, as with LinkedIn, the legal basis for advertising.
Timeline and summary table
- 17 May 2018
ICANN's Board adopts the Temporary Specification for gTLD registration data. - 25 May 2018
The GDPR takes full effect; WHOIS personal data moves behind tiered access. - 20 August 2018
The DPC opens its LinkedIn inquiry after La Quadrature du Net's complaint. - October 2021
noyb reports that the DPC asked it to take down documents about a pending case. - 22 May 2023
DPC announces the €1.2 billion Meta fine over EU-US data transfers. - Late June 2023
Irish lawmakers pass the Section 26A confidentiality amendment. - 4 July 2023
The European Commission proposes common GDPR procedural rules. - 5 July 2023
Courts and Civil Law (Miscellaneous Provisions) Act 2023 is enacted. - 28 November 2023
ICANN launches the Registration Data Request Service pilot. - 24 October 2024
DPC announces the €310 million LinkedIn fine. - 28 January 2025
RDAP replaces WHOIS as the definitive source for gTLD registration data. - 2 May 2025
DPC fines TikTok €530 million over transfers of EEA user data to China. - 21 August 2025
ICANN's permanent Registration Data Policy takes effect. - 12 May 2026
ICANN revises the policy to add a timeline for urgent disclosure requests. - 21 September 2026
DPC fines Google €403 million over location data.
| Case | When | Who decided | Outcome |
|---|---|---|---|
| WHOIS redaction | May 2018 | ICANN Board, under GDPR pressure | Personal data moved to tiered access; RDAP and RDRS followed |
| Section 26A confidentiality | June to July 2023 | Irish parliament and government | DPC can direct parties not to disclose case information; offense for breach |
| LinkedIn targeted ads | October 2024 | Irish DPC, no objections from peers | €310M in fines, reprimand and compliance order |
What this means for you, and for organizations
For individuals
- Use your access right. Article 15 of the GDPR lets you ask a company whether it processes your data, and for a copy. Many services offer a download tool in their privacy settings, which is the quickest route.
- Object to marketing. Under Article 21 you can object to your data being used for direct marketing, including profiling for it, and the company must stop.
- Ask for deletion where it applies. Article 17 gives a right to erasure in defined situations, for example when the data is no longer needed or you withdraw consent.
- Complain to a regulator. Article 77 lets you lodge a complaint with the data protection authority where you live or work. Your local authority passes cross-border cases to the lead authority, as happened with the LinkedIn complaint.
- Check what your domain shows. If you own a domain, look it up on ICANN's RDAP-based lookup to see what is public. Many registrars also offer privacy or proxy services.
For organizations
- Pick the right legal basis, and document it. The LinkedIn decision shows that consent must be freely given, specific, informed and unambiguous, and that "contract" and "legitimate interests" are not automatic fallbacks for advertising.
- Be transparent about each basis. LinkedIn was also found to have breached Articles 13 and 14 for how it explained its legal bases. Privacy notices need to say which basis covers which purpose.
- Plan for disclosure requests. If you rely on domain data for security or brand protection, use RDAP and RDRS and keep records of legitimate-interest justifications.
- Treat international transfers as a top risk. The two largest DPC fines both involved transfers outside the EEA.
- Watch the procedural rules. If you are a party to a case in Ireland, a Section 26A notice can restrict what you share. EU-wide procedural rules are also changing; take legal advice before publishing case material.
FAQ
Is WHOIS gone completely?
For generic top-level domains such as .com, ICANN made RDAP the definitive source for registration data on 28 January 2025, replacing WHOIS services. Country-code domains such as .ie or .de follow their own registries' rules. Personal data is generally redacted, with requests routed through registrars or the RDRS.
Why does the Irish DPC handle so many big tech cases?
Under the GDPR's one-stop shop, the authority where a company has its main EU establishment leads cross-border cases, and many large tech firms have EU headquarters in Ireland. Other authorities still review its draft decisions and can raise objections that go to the EDPB.
Does Section 26A stop people talking about GDPR complaints?
Only in specific cases. It applies when the DPC sends a written notice identifying particular information as confidential. Disclosure remains allowed where required or permitted by law, or authorized by the DPC. Critics such as noyb argue it could still chill public debate, while the Irish government described it as limited to specific circumstances.
What is the maximum GDPR fine?
For the most serious infringements, Article 83 allows fines of up to €20 million or 4% of a company's total worldwide annual turnover for the previous financial year, whichever is higher. The largest DPC fine to date, €1.2 billion against Meta in 2023, was set under this framework, although many large fines are tied up in appeals and the DPC says only about €20 million of more than €4 billion levied has been collected.
Sources
- GDPR Article 83: general conditions for imposing administrative fines
- GDPR Article 15: right of access
- GDPR Article 17: right to erasure
- GDPR Article 21: right to object
- GDPR Article 77: right to lodge a complaint
- ICANN: Temporary Specification for gTLD Registration Data
- ICANN: Registration Data Policy
- ICANN: Launching RDAP; sunsetting WHOIS (27 January 2025)
- ICANN: Registration Data Request Service
- Irish Statute Book: Courts and Civil Law (Miscellaneous Provisions) Act 2023, section 74
- noyb: Irish government amendment on DPC confidentiality (26 June 2023)
- noyb: Section 26A passed (29 June 2023)
- noyb: DPC requires noyb to take down documents (October 2021)
- noyb: on the Commission's GDPR procedures proposal (4 July 2023)
- noyb: on the procedural regulation trilogues (20 May 2025)
- Irish DPC: fines LinkedIn Ireland €310 million
- Irish DPC: conclusion of inquiry into Meta Ireland (€1.2 billion)
- Irish DPC: fines TikTok €530 million
- Irish DPC: decision in Instagram inquiry (€405 million)
- Irish DPC: €345 million fine of TikTok
- Irish DPC: decision in Facebook "data scraping" inquiry (€265 million)
- Irish DPC: fines Google €403 million over location data (September 2026)
- Irish DPC: conclusion of two inquiries into Meta Ireland (January 2023)
- Irish DPC: decisions and fines collected
- Irish DPC: fines Meta €251 million
- Irish DPC: decision in WhatsApp inquiry (€225 million)
Top image: "European Parliament Strasbourg Hemicycle - Diliff" by David Iliff, CC BY-SA 3.0, via Wikimedia Commons (resized). Charts by Thank You Robot.
0 Comments