OK, from 2018 so they were even more under-resourced (if that's possible).
Additionally, the Irish DPC got involved from other data authorities, which may have caused delays.
That being said, they were dead wrong not to take on that case, as it was clear violation of GDPR. I actually worked for Meta/Facebook at this point and got drunk and bitched about this exact screen with one of their privacy lawyers. It was total non-compliance and should have been punished much harder.
Note also that the Hamburg DPA is crazy, they kept pushing compliants that were never supported by anyone else. I'm a little annoyed at noyb for not putting their complaints to the appropriate authority, but they appear to have learned better in the intervening years.
> https://archive.ph/20230123014444/https://www.irishtimes.com...
This on the other hand, is a work of opinion by a Berlin correspondent for a pretty poor newspaper. There probably is a bunch of pressure/lobbying on the DPC to avoid massive, massive fines which shouldn't happen but does everywhere.
The conceptual difference here is important. The goal should be to preserve privacy, not fine arbitrary large amounts of money. Like, sometimes you do need to fine people but personally I'd prefer auditing requirements for Meta/Google et al rather than fines.
I'm gonna need to think about this, tbh. I do have a certain amount of sympathy for the Irish DPC given the resourcing constraints and the size of their opponents. I'm not sure where the right balance is, tbh.