A Rare Admission of Convergence
When European Data Protection Board (EDPB) chair Anu Talus met her fellow commissioners in Dublin on 16-17 July 2026, hosted by Ireland's Data Protection Commission (DPC), she offered an unusually candid assessment: national regulators are now "more and more in line with each other" on how large a GDPR fine should be (RTÉ). The EDPB's own readout of the meeting focused on a narrower but related ask — a legal basis for regulators to share information across competences, and closer cooperation as complaint volumes and AI-driven cases strain national authorities (EDPB).
The convergence Talus described has a specific origin story, and it runs directly through Dublin. In 2021, the DPC's draft decision proposed fining WhatsApp €30-50 million for transparency failures. Eight other EU authorities objected, and under the GDPR's Article 65 dispute-resolution procedure, the EDPB ordered the fine raised to €225 million — a more than four-fold increase (National Law Review). It was not an isolated episode. In the Meta transfers case, the DPC's draft decision initially proposed no financial penalty at all; only after EDPB intervention did the fine become the record €1.2 billion sanction announced in May 2023.
The Numbers Behind the Friction
Those two cases are not outliers so much as the visible tip of a pattern. A 2023 report by the Irish Council for Civil Liberties found that in the first five years of GDPR, the DPC's decisions in cross-border cases were overruled by fellow EU authorities 75% of the time — compared with a single overruled decision across the rest of the EU combined (Freevacy/ICCL). That asymmetry is the empirical backbone of the case against Dublin as lead regulator: it isn't that the DPC never acts, but that when it does, peer regulators have repeatedly judged its proposed remedies too lenient.
The DPC's own defenders have a real point, and it deserves to be stated plainly before it's dismissed. Ireland regulates a disproportionate share of the world's largest technology companies — Meta, Google, Apple, TikTok, X and Microsoft's European operations all fall under its lead-authority jurisdiction under the GDPR's one-stop-shop mechanism — while running an agency sized for a country of 5 million people. In its pre-budget submission for 2026, the DPC noted that the European Commission had assigned 270 staff and a €55 million budget to enforce the Digital Services Act alone, while the DPC's entire workforce of 280 people covered every GDPR case in the country on €29.4 million (Irish Times). Ireland's government ultimately granted a 10% budget increase — about €3 million — well short of the €10 million the DPC had sought. A structurally under-resourced regulator asked to police the world's most valuable companies will produce exactly the kind of conservative draft decisions that trigger Article 65 disputes; that is a resourcing failure as much as a willingness failure, and Brussels bears some responsibility for not funding the one-stop-shop it designed.
Why the Presidency Makes It Worse
What changes the calculus this year is not the enforcement record alone — it is Ireland's simultaneous role as holder of the rotating EU Council presidency, which it assumed in July 2026. Days after taking the chair, more than fifty academics — including Shoshana Zuboff, Mariana Mazzucato and Trinity College Dublin's Abeba Birhane — published an open letter arguing Ireland should recuse itself from chairing Council discussions on digital and tax policy, citing what they called "insurmountable conflicts of interest" arising from the country's economic dependence on the same multinationals its regulators oversee (Irish Times). Taoiseach Micheál Martin rejected the characterization, insisting Ireland would act as an "honest broker" in all Council debates, tech policy included.
Both things can be true at once, and that is precisely the problem. Ireland's low-tax, high-FDI model was a legitimate and successful industrial strategy that helped make it one of Europe's most prosperous states — this publication has consistently argued that jurisdictions should compete to attract investment rather than regulate it away. But holding the gavel on Council negotiations over the AI Act's implementation, the Digital Markets Act's enforcement architecture, or the ePrivacy Regulation, while also functioning as lead GDPR regulator for the exact firms those files target, is a different kind of arrangement than merely hosting their headquarters. A presidency chair sets agendas, brokers compromise text and decides which member states' objections get airtime — functions where the appearance of an unlevel playing field carries real cost, even absent any proven instance of favoritism.
The Fix Is Structural, Not Punitive
The EDPB's fine-convergence story is genuinely good news: it shows the GDPR's dispute-resolution machinery working as designed, correcting outlier decisions without requiring new legislation. That is the proportionate, evidence-based model of enforcement this publication favors over blunter interventions like breaking up the one-stop-shop system entirely, which would fragment compliance for smaller firms that lack Big Tech's resources to manage 27 separate regulators.
The presidency question calls for a narrower, comparably proportionate fix: Ireland retaining the chair generally, but delegating specifically the digital and tax dossiers to a deputy presidency arrangement — the same recusal model already used in some Council configurations where a member state has a declared national interest. That preserves Ireland's legitimate role as the GDPR's most experienced cross-border enforcer while removing the one lever — agenda control over EU tech legislation — that the DPC's enforcement record alone can't justify Dublin holding this year.