Two United Nations human rights experts have taken up with the Irish government a question that privacy campaigners in Europe have been asking for years: is the regulator that oversees most of the world’s largest technology companies in the EU sufficiently insulated from them? In a statement issued in Geneva on November 4, 2026, the experts said the independence of data protection authorities and effective access to the courts are “essential to safeguarding the right to privacy, particularly where powerful technology companies are involved,” and that they are in contact with Dublin about their concerns.
The statement comes from Margaret Satterthwaite, the Special Rapporteur on the independence of judges and lawyers, and Ana Brian Nougrères, the Special Rapporteur on the right to privacy. It covers two separate problems. The first is how members of Ireland’s Data Protection Commission are selected. The second is whether people harmed by large platforms can realistically go to court together, given Irish restrictions on outside funding for litigation. The DPC rejected any suggestion that it lacks independence.
Why Ireland, and why now
Under the GDPR’s one-stop-shop system, a company that processes data across borders is supervised mainly by the authority in the member state where it has its main EU establishment. Many of the largest U.S. technology companies have their European headquarters in Ireland, so the DPC is lead supervisory authority for a long list of cross-border cases. “Its decisions can affect individuals across the European Union,” the experts said. “This responsibility makes safeguards for independence and impartiality particularly important.”
That reach is visible in the DPC’s own record, from the €530 million TikTok decision on transfers to China to the €403 million fine against Google over location data in September. It is also why critics argue that the regulator’s pace and posture shape privacy enforcement for 450 million people, not just Irish residents.
The statement does not name any commissioner or decision. But it follows the most contested appointment in the DPC’s recent history. In September 2025, the government announced Niamh Sweeney as a third Data Protection Commissioner. She previously held senior public policy positions at Facebook and WhatsApp, both owned by Meta. Privacy groups, including the Irish Council for Civil Liberties, complained to the government and to the European Commission about the recruitment process, RTÉ reported. Sweeney has said she would not investigate matters at Meta that occurred during the years she worked there, and the Department of Justice has said it is fully satisfied with the process that led to her appointment.
Four things the experts say a credible appointment process needs
The experts’ starting point is the GDPR itself, which requires supervisory authorities to act with “complete independence” and their members to be appointed through transparent processes. They then set out what that should mean in practice, drawing on Satterthwaite’s work on judicial appointments, which argues that appointment protections may extend to officials outside the judiciary who exercise decisive adjudicatory powers. DPC commissioners decide complaints and impose fines, so the experts treat them in a similar way. The UN statement lists, in substance:
- Objective, specialized criteria. Candidates should be measured against published standards tied to the job.
- Impartial selection panels. The people choosing should themselves be free of conflicts.
- Conflict checks before appointment. Potential conflicts of interest should be identified before someone takes office, not managed after.
- Disclosure and recusal safeguards. “Previous private-sector employment does not automatically compromise independence,” the experts said, “but professional relationships, financial interests and continuing obligations require effective scrutiny and, where appropriate, disclosure and recusal safeguards.”
One line carries particular weight. The experts said safeguards “must address not only actual influence, but circumstances that could reasonably undermine public confidence.” That is a perception standard, familiar from judicial ethics, and it does not require proof that anyone was improperly influenced. The statement also warns of risks from the “revolving door” between regulators and the industries they supervise.
The DPC’s answer
Asked about the statement, DPC spokesperson Evan O’Leary said the commission is independent of the Irish government and that its “independence is reflected in its enforcement record,” including fines totaling more than €4.4 billion following its investigations, Politico reported. He said the personal and professional relationships of the three commissioners are governed by the Ethics in Public Office, Official Secrets and Regulation of Lobbying Acts, as well as provisions of the Data Protection Act. The government did not immediately respond to Politico’s request for comment.
Both positions can be true at once. A regulator can have a large fines record and still face questions about whether its appointment procedures meet the standard the experts describe. The statement is aimed at the process, not at any particular decision.
The second problem: who pays to sue
The other half of the statement concerns remedies in court. The experts said they were concerned about financial barriers to obtaining judicial remedies. Ireland adopted the Representative Actions for the Protection of the Collective Interests of Consumers Act 2023 to implement the EU’s collective redress directive, and GDPR violations are among the matters such actions can cover. But the experts noted that certain forms of third-party litigation funding remain restricted in Ireland, including through the old common law rules on maintenance and champerty, which treat funding someone else’s lawsuit for a share of the proceeds as unlawful. Ireland’s Supreme Court confirmed in 2017 that the prohibition still applies and that any change is for the legislature.
For privacy claims, that matters because harm is often spread thin. A single platform practice may affect millions of people, each with a loss too small to justify a lawsuit. Elsewhere in Europe, commercial funders often carry the cost and risk of collective privacy claims. In Ireland, designated non-profit bodies have to find the money elsewhere. Some have tried anyway: the Irish Council for Civil Liberties has pursued a representative action against Microsoft over real-time bidding data. Other member states have taken different routes, including allowing public bodies to act, as Luxembourg did when its data protection authority became a qualified entity.
What the statement is, and what it is not
Special Rapporteurs are independent experts appointed by the UN Human Rights Council. They serve unpaid, in their individual capacity, and their views do not necessarily represent the UN. They have no enforcement powers. Their statement is not a finding that Ireland has breached the GDPR, that any appointment was improper, or that any DPC decision was influenced. It records concerns and sets out standards, and it puts those concerns on the public record while the experts engage with the government.
For companies regulated by the DPC, the practical points are narrower but real:
- Decisions that survive challenge are worth more. Questions about appointment procedures give parties another argument when contesting decisions. A fine annulled years later settles nothing for the company or for complainants.
- Private enforcement may grow. If Ireland loosens funding rules, more group claims could follow, adding a second channel of risk alongside regulatory action.
- Procedure is already changing. The EU’s new procedural rules for cross-border GDPR cases will standardize how lead authorities handle complaints, including timelines and the rights of the parties.
- Records still decide outcomes. Regardless of who sits on the commission, the evidence in a case comes from a company’s own documentation of legal bases, transfers and retention.
Frequently asked questions
Can the UN force Ireland to change how DPC commissioners are appointed?
No. Special Rapporteurs can raise concerns with governments and report publicly, but they cannot issue binding orders. Any change would be up to the Irish government and the Oireachtas.
Did the experts accuse a specific commissioner of bias?
No. The statement names no individual, company or decision. It addresses appointment standards in general terms.
Are class actions possible in Ireland for GDPR violations?
Representative actions by designated qualified entities are possible under the 2023 Act, and individuals can bring their own claims. The concern is that limits on third-party funding make large group claims hard to finance.
Does the EU have a say in how national data protection authorities are staffed?
The GDPR sets requirements for independence and transparent appointment. The European Commission can open infringement proceedings against a member state that fails to meet them, and the Court of Justice has ruled against member states on regulator independence before.
A question of confidence
Ireland’s privacy regulator has spent a decade arguing that its fines speak for themselves. The UN experts are making a different point: a regulator’s authority rests not only on what it decides, but on whether the public believes the people deciding were chosen fairly. The DPC handles the complaints of people in Madrid, Vienna and Helsinki who never had a say in who sits in Dublin. Whether the Irish government answers with a new appointment process or a polite letter will say a good deal about how seriously it takes that distinction.
