Since GDPR, Ireland's Data Protection Commission says it has launched 19 cross-border investigations, 11 of which focus on Facebook, WhatsApp, and Instagram
Social media giant Facebook and its subsidiaries Instagram and WhatsApp have been the subject of most data investigations in the Republic …
Context & Ripple Effects
Ireland is where Facebook, WhatsApp, and Instagram base their EU operations, which makes the Data Protection Commission their lead regulator under GDPR's one-stop-shop mechanism. The DPC had already opened a probe into Facebook's 2018 data breach, and this tally shows that case was not an outlier: 11 of its 19 cross-border investigations target the Facebook family alone.
The docket kept growing after this report — the DPC's own review counted 21 major cross-border probes with no decisions yet, and the pipeline eventually produced a €225M fine against WhatsApp, the second-largest under GDPR to that point. The question this story frames is whether the volume of investigations converts into enforceable outcomes.
First-order effects
- Facebook, WhatsApp, and Instagram now face the majority of the DPC's cross-border caseload, meaning their EU privacy practices are effectively audited by a single Irish authority rather than 27 national regulators.
- The DPC's resources are being concentrated on one corporate family, stretching its capacity to move the other cross-border investigations toward decisions.
Second-order effects
- Other multinationals headquartered in Ireland — the group the DPC exists to regulate — wait longer for outcomes as Facebook-related inquiries absorb the commission's bandwidth.
- The slow decision pipeline pressures the EU's cooperation mechanism: other national regulators can weigh in on cross-border cases, raising the stakes of how the DPC resolves the Facebook family inquiries.
Third-order effects
- If the pattern holds, GDPR enforcement consolidates around Ireland as de facto privacy regulator for Big Tech, making the DPC's staffing, pace, and independence a structural determinant of how strictly the entire EU regime bites.
- The eventual WhatsApp fine shows investigations do convert to penalties, pointing toward a regime where large GDPR fines become a recurring, budgeted cost of operating social platforms in Europe rather than a one-off shock.
The trend: GDPR enforcement is centralizing in Ireland, where the DPC's caseload — dominated by Facebook, WhatsApp, and Instagram — will determine whether Europe's privacy regime delivers decisions or backlog.