Arthur Cox UnLimited

Arthur Cox is an Irish corporate law firm headquartered in Dublin, with offices in Belfast, London, New York City, and San Francisco. Rob Corbet is a Partner and Head of Technology & Innovation at Arthur Cox. He leads a market leading team dedicated to specialist data protection, IT and Intellectual Property law. He acts for many of the world’s highest profile internet and technology companies, particularly on privacy, data protection and cyber-security matters. He is a leading authority on the GDPR and has represented many clients in their dealings with the Data Protection Commission, including responding to formal domestic and cross border investigations and personally defending clients in criminal prosecutions before the courts.

Representatives

Rob Corbet

partner

Contact

Publications

• Brillen Rottler – A review of the DSAR mechanismOn 19 March 2026, the Court of Justice of the European Union (CJEU) delivered its judgment in Brillen Rottler GmbH & Co KG v TC (Case C-526/24) addressing key issues surrounding data subject access requests (DSAR) and abusive practices. This decision has been anticipated as a potential opportunity to provide further guidance on balancing the right of access under Article 15 GDPR with controllers’ competing rights.2 July 2026
• The Right to Compensation Under the GDPR: Key Takeaways from Recent Case Law of the Court of Justice of the European UnionOver the course of several preliminary references during 2023 and 2024, the Court of Justice of the European Union (“CJEU”) has clarified the circumstances in which data subjects will be entitled to compensation under Article 82 of the General Data Protection Regulation (“GDPR”). The following six decisions wilal be of interest to controllers who are concerned about litigation by data subjects claiming compensation for an infringement of the GDPR, particularly in cases where the controller claims that they are not responsible for the breach and where the claimant suffers non-material damage.4 July 2024
• Processing Children’s Data Correctly: Takeaways from the Recent TikTok DecisionIn September 2023, the Irish Data Protection Commission (“DPC”) adopted its final decision in an own-volition inquiry into the processing by TikTok Technology Limited (“TikTok”) of personal data relating to child users of the TikTok platform. The sanctions imposed on the social media platform include an administrative fine totalling €345 million, a reprimand and an order to bring processing into compliance within a period of three months.31 January 2024
• The Data Protection Commission’s 2022 Annual ReportOn 7 March 2023, the Data Protection Commission (“DPC”) released its 2022 Annual Report. We have summarized the key points from the 90-page Report below.11 May 2023
• ‘Mere Upset’ Not Sufficient for GDPR Compensation ClaimsOn 6 October 2022, Advocate General Manuel Campos Sánchez-Bordona issued an opinion concerning the right to compensation for non-material damage under the GDPR (the “Opinion”). The Advocate General found that data subjects are not entitled to compensation for non-material damage by showing “mere upset” at an infringement of the GDPR. Article 82(1) GDPR provides that a data subject has the right to receive compensation for material or non-material damage suffered as a result of a breach of the GDPR.7 February 2023
• Seven Key figures from the Irish Data Protection Commission’s 2021 Annual ReportOn 24 February 2022, the Data Protection Commission released its 2021 Annual Report (the “Report”) running to over one hundred pages. We pick seven figures from the Report that provide an insight into the work of the Ireland’s Data Protection Commission (“DPC”), the challenges it faces, and its focus for 2022.6 June 2022