...FROM DUBLIN... After the announcement by the Ministry of Youth and Childhood of opening a case file to temporarily block TikTok services in Spain, following the disclosure of an investigation by Maldita.es, the Spanish Data Protection Agency (AEPD) has referred the case to Irish authorities. The decision again brings to the table one of the main particularities of the European regulatory model: oversight of much of the major digital platforms is concentrated in the country where they have established their main headquarters within the European Union, regardless of where any possible infringements may occur.
By locating TikTok’s European headquarters in Dublin, the Irish Data Protection Commission (DPC, for its acronym in English) is the principal supervisory authority for monitoring the company’s compliance with European data protection regulations. Therefore, it is the institution that must process actions related to the processing of personal information that may arise from complaints filed in other Member States.
Moncloa even considered the possibility of blocking access to certain links and specific content on the platform that could involve an unlawful processing of minors’ data. The Executive argued that it would be a limited intervention justified by the seriousness of the facts. “A specific measure, proportionate and appropriate with full respect for freedom of expression,” sources from the government said.
However, the Spanish Data Protection Agency has reminded that its powers do not allow it to unilaterally agree on a general restriction of access to a platform whose principal supervisory authority is located in another Member State. “It corresponds to the Public Prosecutor’s Office and to the judicial bodies, which also constitute the natural seat to propose and, where appropriate, agree judicially, in general, the removal of content that is unlawfully criminal and any restriction on access to a service,” the Spanish agency adds.
The distinction is especially relevant at a time when national governments seek faster answers to the risks that digital platforms can generate for younger users. Protecting minors, removing illicit content, and processing personal data are related areas, but subject to different legal instruments and supervisory authorities. A circumstance that requires coordinating national and Community actions before adopting measures that could affect the operation of these services.
The single window that leads to Dublin
European regulations establish a harmonized data protection framework for the entire Community bloc. Its implementation is structured, to a large extent, through the single-window mechanism, designed to prevent the same company from having to respond to independent and potentially contradictory procedures in each of the Member States where it operates.
In this way, when a company carries out data processing activities in several countries of the Union, the data protection authority of the State where it has its main establishment assumes the role of lead supervisory authority. This institution coordinates investigations and decisions, although it must maintain close cooperation with the affected national authorities.
In the case of TikTok, Ireland thus becomes the institutional gateway for a large part of the European complaints related to the platform’s data protection. This does not mean that Spanish authorities are completely left out. The AEPD can investigate matters within its remit, request information, and convey its conclusions to the Irish authority, which will have to coordinate its response with the rest of the agencies involved.
The system also includes mechanisms to resolve disagreements between national authorities. If there is no consensus on a proposed resolution, the European Data Protection Committee (CEPD) can step in through a consistency procedure and adopt a binding decision. The goal is to prevent the application of the same European rule from depending exclusively on the criterion of the authority of the country where a multinational has decided to establish its headquarters.
This framework is supplemented by the Digital Services Act (DSA, for its English-language acronym), which introduces specific obligations for platforms regarding transparency, content moderation, risk management, and the protection of users. The regulation requires intermediaries to have mechanisms in place to act against unlawful content when they become aware of it, in accordance with the obligations that correspond to each category of service.
In the case of very large platforms (VLOPs, for their English-language acronym), such as TikTok, oversight of the systemic obligations provided for in the DSA falls directly to the European Commission. Brussels has powers to investigate possible breaches, require information, order corrective measures, and impose sanctions when appropriate. For this reason, the AEPD also anticipates transferring the information gathered to the Community institution so that it can act within the scope of its digital competences.
The case therefore shows that the same dispute can simultaneously trigger several levels of European oversight: data protection, the regulation of digital services, and, where appropriate, the intervention of national judicial authorities.
The European refuge of big tech
Ireland’s particularity is understood not only from the functioning of Community legislation. For decades, the country has structured much of its economic model around attracting foreign investment and large multinational technology companies. Dublin has become one of Europe’s main technological and fiscal centers, with the presence of companies such as Google, Meta, Apple, TikTok, or Microsoft, which have established their European headquarters or major operations centers there.
Ireland’s strategy has historically combined competitive corporate taxation with an environment favorable to international investment—a policy that has enabled the country to attract some of the biggest companies in the world. The result is a high concentration of economic activity, skilled employment, and corporate operations linked to the technology sector.
This position also has regulatory consequences. The concentration of the headquarters of major platforms in Ireland has transferred to its authorities a supervisory responsibility that far exceeds the size of their national market. The Irish Data Protection Commission must manage investigations that affect hundreds of millions of European users and some of the world’s most economically and technologically capable companies.
Brussels has maintained a recurring debate about the risks involved in this concentration of powers. An excessively slow oversight or a lackluster enforcement of the rules can create differences in the level of protection afforded to European citizens. At the same time, decisions by national authorities can have far-reaching economic repercussions, especially in countries where the activity of these multinationals represents an important share of employment, investment, and tax revenues.
For Ireland, the presence of these companies constitutes one of the pillars of its economic model. Any eventual relocation of their operations to other territories would have consequences for employment, tax collection, and the weight of the technology sector in its gross domestic product. This dependence introduces an institutional tension that is difficult to resolve: the country must guarantee compliance with European legislation that may require forceful measures against some of the largest companies established in its territory, while it maintains an economic model closely tied to their presence.
An authority overwhelmed by the big platforms
To this equation is added an administrative capacity problem. Concentration in the Irish Data Protection Commission of a substantial portion of major European investigations has, for years, prompted criticism regarding the availability of resources and the speed of procedures. Community sources have, on different occasions, questioned the timelines of Irish investigations, which can last for years before reaching a final resolution. There have also been discrepancies regarding the proportionality of the sanctions initially proposed and about the ability of the authorities to impose corrective measures quickly enough.
The difficulty is not exclusively technical. Investigations against the large platforms require analyzing massive volumes of information, complex corporate structures, and data processing that affects different markets at the same time. In addition, companies have important legal and regulatory teams to defend their positions during administrative proceedings. Irish case law and supervisory practice have, in certain cases, prioritized compliance agreements and prolonged investigation procedures over more immediate interim interventions. An approach that has sometimes clashed with the stance of other national authorities, including the Spanish one, which are in favor of faster responses to certain risks for citizens.
The European system, however, includes mechanisms to prevent these differences from ending up weakening the enforcement of the rules. When a national authority submits a draft resolution that other institutions consider insufficient, the European Data Protection Board may intervene to resolve the discrepancies and adopt binding decisions. This allows, among other things, to require modifications to resolutions and to adjust the measures or sanctions provided for when there is no agreement between the bodies involved.
The case concerning TikTok again puts this balance between national competence, community supervision, and the ability of European institutions to respond to the test. Spain calls for a response to the possible risks affecting minors, but the decision on much of the platform’s data protection obligations depends on an authority located more than 1,500 kilometers from Madrid.
From Dublin, where a substantial part of European technological power is concentrated, the issue already goes beyond the specific case of TikTok. The European Union has built a common regulatory framework to control the large platforms, but its application continues to depend on an institutional architecture in which competences and resources are not always distributed in a balanced manner. And it is precisely that distance between Brussels’ regulatory ambition and the effective capacity of its national authorities that is once again being put under scrutiny.