Two United Nations human rights experts said on November 4, 2026 that independent data protection authorities and effective access to the courts are essential to protecting privacy rights, "particularly where powerful technology companies are involved." They aimed their concerns at Ireland. Margaret Satterthwaite, the Special Rapporteur on the independence of judges and lawyers, and Ana Brian Nougrères, the Special Rapporteur on the right to privacy, issued the statement in Geneva. It singles out two weak points: how members of Ireland's Data Protection Commission are appointed, and Irish legal restrictions that make large privacy lawsuits hard to fund.

In Short

Two UN experts said on November 4 that Ireland's privacy regulator, which handles many of Europe's privacy cases against big tech companies, must be clearly independent from the industries it oversees, starting with how its members are chosen. They also said Irish rules on who may pay for a lawsuit can make it too expensive for ordinary people to bring group cases against large companies. The experts cannot force Ireland to change anything, but they have taken the matter up with the Irish government, which adds weight to long-running questions about how Europe's biggest privacy cases are handled.

What the experts said

The statement is short and names no company, person or decision. Its argument starts from a principle. "Privacy rights cannot be protected by laws alone," the experts said. "People need to know that those deciding complaints are independent and impartial, and that they can obtain an effective remedy when their rights are violated."

Ireland is the focus because of where the technology industry has its European headquarters. "Because many multinational technology companies have their European headquarters in Ireland, the Irish Data Protection Commission (DPC) acts as lead supervisory authority for numerous cross-border cases under the EU General Data Protection Regulation (GDPR)," the experts said. "Its decisions can affect individuals across the European Union."

That role comes from the GDPR's one-stop-shop mechanism. Under Article 56(1), when a company processes data across borders, the authority where it has its main or single establishment in the EU becomes its lead supervisory authority. Article 56(6) makes that authority the company's sole interlocutor. Meta, Google, Microsoft, TikTok and LinkedIn all base their European operations in Ireland, so Dublin leads their cases. A complaint filed by a user in Lisbon or Warsaw about one of those platforms usually ends up on a desk at the DPC.

"This responsibility makes safeguards for independence and impartiality particularly important," the experts continued. "Regulatory authorities must be able to take decisions without undue influence, including from the powerful industries they oversee."

Neither author is a UN employee. According to the statement, Special Rapporteurs are independent experts appointed by the UN Human Rights Council. They work voluntarily, receive no salary and serve in their individual capacity. Their views are their own and do not necessarily represent those of the UN or its human rights office. The statement ends with one line on what comes next: "The experts are in contact with the Government of Ireland on their concerns."

Appointments and the revolving door

The experts said independence "begins with transparent and rigorous appointment procedures." According to the statement, under the GDPR "supervisory authorities must act with complete independence, and their members must be appointed through transparent processes." Those requirements come from Articles 52 and 53 of the regulation. Article 52 requires members to stay free from external influence and to avoid incompatible occupations during their term. Article 53 requires a transparent appointment procedure by parliament, government, head of state or an independent body, and requires appointees to have qualifications and experience in data protection.

The experts then set out what a sound selection process looks like. "Selection processes should use objective, specialised criteria, include impartial selection panels and identify potential conflicts of interest before an appointment is made," they said. "Safeguards must address not only actual influence, but circumstances that could reasonably undermine public confidence."

That last sentence matters. It sets the test at what a reasonable member of the public would think, not at whether anyone can prove an official was influenced. The same perception standard appears in judicial ethics, and the statement borrows from that field on purpose. It points to "risks associated with the 'revolving door' between regulators and regulated industries" and cites Satterthwaite's earlier work on economic influence over courts. It also cites her 2026 report, Principles for judicial appointments, which, according to the statement, explained that protections concerning independent and impartial appointments "may extend to officials outside the judiciary who exercise determinative adjudicatory powers."

That is the legal bridge in the statement. Judicial-independence standards normally apply to judges. DPC commissioners decide complaints and impose fines, and the experts argue the same appointment safeguards should cover them.

The experts did not argue that industry experience disqualifies anyone. "Previous private-sector employment does not automatically compromise independence, but professional relationships, financial interests and continuing obligations require effective scrutiny and, where appropriate, disclosure and recusal safeguards," they said.

An appointment the statement does not name

The statement does not say which appointment, if any, prompted it. It comes a little more than a year after Ireland's most debated DPC appointment. On September 17, 2025, the Irish government named Niamh Sweeney as the third commissioner at the DPC. The announcement was made by Minister for Justice Jim O'Callaghan after Cabinet approval. Sweeney had spent nearly eight years in public policy roles at Meta: head of public policy for Ireland at Facebook from December 2015 to April 2019, then director of public policy for Europe, the Middle East and Africa at WhatsApp until October 2021. She began a five-year term on October 13, 2025, joining Commissioners Des Hogan and Dale Sunderland, who were appointed in February 2024.

The appointment drew immediate criticism. noyb, the Vienna-based privacy group, described her as a former senior Meta lobbyist and questioned the regulator's independence. According to The Irish Times, the Irish Council for Civil Liberties filed a complaint with the European Commission over the appointment in late October 2025. The Irish Examiner reported that the government department responsible said it was fully satisfied with the process. Nothing in the November 4 statement says whether the experts consider that appointment improper. The language about private-sector employment, conflicts of interest and recusal is general.

Sweeney's term runs until October 2030. She was one of three commissioners who signed the €403 million fine against Google on September 21, 2026 over location data. That case does not involve Meta.

What the 2024 report says about the revolving door

The report the experts cite on economic influence is UN document A/79/362, "Justice is not for sale: the improper influence of economic actors on the judiciary." It is dated September 20, 2024, and the UN human rights office published it on October 23, 2024 for the General Assembly's 79th session. It deals with judges, not regulators. Its reasoning, though, carries over almost directly.

The report calls the revolving door "the phenomenon of individuals moving between employment in the public and the private sector, in the areas they previously regulated." It treats it as one item on a "sliding scale" of influence that also covers paid speaking engagements, corporate-sponsored training seminars and lavish hospitality. "If judges are focused on maximizing their future payoff in the private sector, they cannot serve as impartial arbiters in disputes where economic actors (i.e. businesses and the law firms that represent them) are themselves parties," it says.

The report's revolving-door section is about the outbound direction: judges courted with private-sector jobs while still in office. The November 4 statement is about the inbound one, where someone moves from a regulated company into the regulator. The safeguards the report lists apply either way. According to the report, consultations with judges found approaches ranging from rules against discussing post-judicial careers before leaving office, to bans on appearing in court after retirement, to mandatory "cooling off" periods. "However, in some States, there are no formal rules concerning judges' post-retirement work," it says.

The report has figures on how much disclosure lags behind the risk. Only 6 of the 41 OECD countries that have lobbying disclosure requirements include the judicial branch, it says, citing research by Dieter Zinnbauer. It also warns that recusal, the standard fix for a conflict of interest, "is undermined when the ultimate source of funding is hidden." Among its recommendations: mandatory lobbying registers with a definition of "lobbyist" that includes judicial lobbying, published financial disclosures, clear rules on which gifts and financial gains require disclosure or recusal, and consideration of "whether regulations should govern employment following exit from judicial office."

The cost of going to court

The second half of the statement is about money. The experts said they were "concerned about financial barriers to obtaining judicial remedies," and they named a specific statute. According to the statement, Ireland's Representative Actions for the Protection of the Collective Interests of Consumers Act 2023 "created a framework for collective consumer redress, yet certain forms of third-party litigation funding remain restricted under Irish law, including rules on maintenance and champerty."

"When legal proceedings require substantial resources, a remedy available on paper may be inaccessible in practice," the experts said. They warned that such obstacles may also undermine equality of arms, "particularly when claimants face well-resourced corporate defendants." Then came the point most relevant to data protection: "Collective actions are especially important where violations affect large numbers of individuals who cannot realistically bear the costs and risks of litigation alone."

A single privacy violation by a large platform can affect millions of people, while each person's loss may be worth only a few hundred euros. Nobody sues alone over that. Group actions exist for this kind of case, and they need someone to pay the lawyers and carry the risk of losing.

Maintenance and champerty

Maintenance and champerty are old common law doctrines that most of the common law world has dropped or narrowed. Maintenance means supporting someone else's lawsuit without a legitimate interest in it. Champerty means doing so in return for a share of what the case recovers, which is how commercial litigation funders make money. In Ireland both remain civil wrongs and criminal offences. In a 2017 judgment in Persona Digital Telephony, the Supreme Court held that third-party funding of that kind is still unlawful. It said any change was a matter for the Oireachtas, Ireland's parliament.

The 2023 Act implements the EU's collective redress directive, Directive (EU) 2020/1828, which has applied since June 25, 2023. The directive allows third-party funding where national law permits it, and Article 10 lets courts check funding arrangements for conflicts of interest. The GDPR is among the EU laws listed in its annex, so data protection violations can be the subject of representative actions. Ireland's version, fully in force since April 30, 2024, leaves those claims to non-profit bodies designated as a qualified entity. Those bodies must find the money themselves, under funding rules the experts describe as restrictive. noyb received qualified entity status in Ireland in October 2024.

Collective claims in Ireland so far

The best-known Irish test of the new system is an ad tech case. On May 26, 2025, the Irish High Court granted the Irish Council for Civil Liberties permission to bring a class action against Microsoft, described as the first of its kind, over real-time bidding data. The case is led by Johnny Ryan, director of ICCL's Enforce unit. It concerns data flows through Xandr, the ad tech business Microsoft bought from AT&T in June 2022. ICCL's analysis of the Xandr data marketplace from May 2021 found 651,463 audience segments, and the claim says real-time bidding data reaches 1,647 entities.

That case went ahead through a civil liberties organisation, not a commercial funder. Elsewhere, the funding model the Irish rules restrict is what drives large consumer claims against technology companies. In London, a February 5, 2026 Court of Appeal hearing examined funded collective claims against Amazon brought on behalf of about 52 million UK consumers and more than 200,000 sellers, where the funder pays all legal costs. Amazon raised concerns about the funders.

The 2024 report on economic influence treats procedural rules as one of the ways economic actors shape justice systems, even though it does not focus on them. Among the strategies it lists are "lobbying political and justice bodies to alter court rules and procedures to benefit economic actors, for example by restricting the grounds for class action lawsuits," and inserting arbitration clauses in consumer contracts that move disputes into less transparent forums. The report does not mention Ireland. Its point is that rules on who can sue, and who can pay for it, are not neutral.

"Access to justice must be real, not theoretical," the experts said. "Independent regulation and genuinely accessible judicial remedies are essential to ensuring that economic power does not determine whose rights can be vindicated."

Remedies on paper: the privacy rapporteur's 2024 comparison

Nougrères had already studied remedies on paper in a report to the Human Rights Council. UN document A/HRC/55/46, "Legal safeguards for personal data protection and privacy in the digital age," is dated January 18, 2024, written originally in Spanish and prepared for the Council's 55th session, which ran from February 26 to April 5, 2024. It compares five data protection laws on five continents: Australia's Privacy Act 1988 and the Australian Privacy Principles, Ecuador's Organic Act on Personal Data Protection, Spain's application of the GDPR alongside Organic Act No. 3/2018, Singapore's Personal Data Protection Act and South Africa's Protection of Personal Information Act. Ireland was not one of them.

Its premise is the same as the November 4 statement. "The mere recognition of a legal standard on the right to personal data protection does not guarantee the effectiveness or enjoyment of that right without the existence of an accessible and effective protection system," the report says. Later it adds: "Legal recognition alone is not enough, as these rights are often ignored, disregarded or not respected." It says the problem is "exacerbated in cases that involve the use of emerging technologies such as artificial intelligence."

The comparison shows how much remedies differ between laws that recognize similar rights. The report counts eleven data subject rights across the five laws. Here is how the procedures differ:

  • Cost of complaining. Spain is the only one of the five countries where complaints to the supervisory authority are free of charge. Australian law does not say, but there are indications that charges apply in some cases.
  • Deadlines for regulators. Spain is also the only country that sets a time limit for resolving an administrative complaint: three months to decide admissibility, then six months from notification of admissibility, with preliminary investigations capped at 18 months. If the Spanish authority misses the deadline, the complaint can be treated as upheld.
  • Deadlines for companies. Response times for rights requests vary from 10 days in Ecuador to one month under the GDPR, which can be extended by two further months. South African law requires a response "as soon as is reasonably practicable" for correction and deletion. Singapore sets no time limit.
  • Going straight to court. Only the Ecuadorian and Spanish laws provide for judicial proceedings without first going through the regulator.
  • Appeals. Only Australia and Singapore allow appeals against a regulator's decision to a higher administrative body.
  • Liability. Only Spain, through the GDPR, makes data controllers, processors and representatives jointly and severally liable for damage. The report presents this as a way "to ensure the effective compensation of data subjects."

The report also notes that the GDPR, under Article 80, lets not-for-profit bodies lodge complaints and seek compensation on behalf of data subjects. The November 4 statement implies that Irish law makes this route hard to use at scale. Australia's law stands out for the damage it recognizes: redress can be sought for any loss, "including injury to feelings and humiliation."

The 2024 report's recommendations are broad. It urges states to adopt laws "that provide accessible and appropriate remedies for the effective protection, reparation and restitution of the right to personal data protection, including compensation for damage caused." It also urges them to consider borrowing stronger guarantees from other countries' laws and to fund public education so people know they can use those remedies.

Ireland's weight in European enforcement

The experts' concern is about scale as much as principle. Ireland issues most of Europe's GDPR fines by value. An Alliance Risk analysis published on May 29, 2026 put the Irish DPC's total at about €4.04 billion, roughly 66 percent of €7.1 billion in announced GDPR fines, from 37 actions. The same analysis found that close to 40 percent of the total had been annulled or was under challenge. In 2025 alone, Ireland accounted for €530,773,000 of €1,145,760,374 in fines recorded by the European Data Protection Board, about 46 percent by PPC Land's calculation. Most of that came from one decision.

That decision was the €530 million TikTok fine announced on May 2, 2025 over data transfers to China. Before it came the €310 million LinkedIn fine of October 24, 2024, which concerned how LinkedIn processed members' data for behavioural analysis and targeted advertising. Earlier still was the €1.2 billion fine on Meta in May 2023, which remains under appeal. The most recent large decision, against Google, came 2,951 days after the DPC first asked Google for an urgent answer about location tracking on August 15, 2018.

Speed and independence are separate questions, but the DPC's record has drawn criticism on both, often from the same people. The courts have also been involved. On January 29, 2025, the EU General Court dismissed the DPC's challenges to a European Data Protection Board decision directing it to investigate Meta's use of sensitive data. On February 10, 2026, the Court of Justice ruled in WhatsApp's favour that companies can challenge the board's binding decisions directly in EU courts. On May 21, 2026, the Irish High Court dismissed Meta's challenge to a DPC inquiry that began with a single access request sent by Michael Veale on May 25, 2018, the day the GDPR took effect. The DPC's preliminary draft decision in that case, issued on October 10, 2025, proposed fines of €360 million to €430 million. Eight years after the request, there is still no final decision.

That timeline is the gap between the law on paper and in practice that both 2024 reports describe. An individual's right of access under Article 15 is clear. Getting it enforced against one of the world's largest companies took one complainant most of a decade, and the case is still open.

The rules for these cases are about to change. EU Regulation 2025/2518, which sets common procedures for cross-border GDPR cases, entered into force on January 1, 2026 and applies from April 2, 2027. It was hard-fought. During negotiations, noyb published analysis showing that data protection authorities averaged about eight months per case, and about 4.5 months where national deadlines exist. The European Parliament proposed limits of three months for simple cases and nine for complex ones. The Council suggested 33 months.

The statement also comes while Ireland holds the rotating presidency of the Council of the EU, from July 1 to December 31, 2026. Foreign Affairs Minister Helen McEntee met Meta in Dublin on June 4, 2026, ahead of that presidency.

Why this matters for the marketing community

For advertisers, agencies and ad tech companies, how the DPC is staffed is a practical question. The DPC's decisions set the terms for how the largest advertising platforms in Europe can process personal data. The LinkedIn decision concerned the legal basis for advertising-related processing. In the Google location case, DPC Deputy Commissioner Graham Doyle said users could have been unaware that their location was being used to influence them with ads or to infer their interests. When the lead authority for Meta, Google, Microsoft, TikTok and LinkedIn rules on consent or legitimate interest, the result affects targeting, measurement and audience products used by every advertiser on those platforms in the European Economic Area.

Questions about appointment safeguards cut both ways. Privacy groups argue that a regulator seen as close to industry will be too lenient. Companies facing fines have their own interest in decisions that cannot be attacked on grounds of bias or procedure, since a fine that is annulled years later settles nothing for anyone. The Alliance Risk finding that about 40 percent of announced GDPR fine value has been annulled or challenged shows how much depends on decisions holding up in court.

The litigation funding point may matter more over time. Regulators are not the only way the GDPR gets enforced. Collective actions, such as ICCL's claim against Microsoft over real-time bidding data, are a second route that does not depend on the DPC's pace or priorities. If Irish law keeps commercial funders out, the number of such claims will depend on how many non-profit groups can raise money and how much risk they can carry. The experts said that limits private enforcement against the companies most likely to be sued.

What the statement does and does not do

The statement is not a finding, a ruling or a recommendation with legal force. Special Rapporteurs have no enforcement powers. What they have is the attention of a government and a public record. According to the statement, country-specific observations from UN human rights mechanisms are collected in the Universal Human Rights Index, and the experts say they are in contact with the Government of Ireland. The statement does not include a response from the Irish government.

The statement also does not claim any particular DPC decision was influenced, name any commissioner, or say that Ireland has breached the GDPR's independence requirements. It sets out standards: objective selection criteria, impartial panels, conflict checks before appointment, disclosure and recusal for past ties, and funding rules that make collective claims workable. It then says Ireland's role makes those standards "particularly important." Whether Dublin changes its appointment procedures or its rules on maintenance and champerty is a matter for the Irish government and the Oireachtas.

Timeline

Summary

Who: Margaret Satterthwaite, UN Special Rapporteur on the independence of judges and lawyers, and Ana Brian Nougrères, UN Special Rapporteur on the right to privacy. Their statement concerns Ireland's Data Protection Commission and the Government of Ireland.

What: The two experts said independent data protection authorities and effective access to the courts are essential to protecting privacy, especially where large technology companies are involved. They called for objective and transparent appointment processes at the DPC, with impartial panels and conflict checks, and for disclosure and recusal safeguards covering previous private-sector ties. They also said Irish restrictions on third-party litigation funding, including the rules on maintenance and champerty, can make collective privacy claims inaccessible in practice despite the Representative Actions Act 2023. The statement draws on Satterthwaite's 2024 report on economic influence over courts and her 2026 report on judicial appointments. A 2024 report by Nougrères comparing privacy remedies in five countries addresses the same gap between rights in law and rights in practice.

When: The statement was issued on November 4, 2026. The background reports are dated January 18, 2024 (A/HRC/55/46) and September 20, 2024 (A/79/362), plus Satterthwaite's 2026 report on judicial appointments.

Where: Geneva, where the statement was issued, and Ireland, where the DPC acts as lead supervisory authority for many cross-border GDPR cases involving companies with European headquarters in Dublin.

Why: The DPC's decisions apply to people across the European Union, so the experts argue its independence and the availability of court remedies carry extra weight. For the marketing community, the DPC's rulings set the data processing terms for the largest advertising platforms in Europe. Collective actions, such as the ICCL claim against Microsoft over real-time bidding data, depend on how such claims can be funded.