Court Confirms WhatsApp’s Right to Contest EDPB GDPR Fine Decision
The Court of Justice has ruled that WhatsApp Ireland’s challenge against the European Data Protection Board (EDPB) Binding Decision 1/2021 is admissible. The Court found that the EDPB decision is a legal act that can be contested and directly affects WhatsApp. As a result, the Court annulled the previous order by the General Court and sent the case back for a detailed examination of the facts.
The case originated after the enforcement of the GDPR, when the Irish Data Protection Commission received complaints regarding WhatsApp’s handling of personal data. An investigation was launched in December 2018 focusing on WhatsApp’s transparency and information obligations. After the Irish authority’s draft decision did not gain consensus among other national authorities, the matter was referred to the EDPB to resolve the disagreement.
The EDPB issued Binding Decision 1/2021, which determined that WhatsApp had violated certain GDPR provisions and instructed the Irish authority to revise its corrective measures, including the fines. Consequently, the Irish authority imposed fines totaling €225 million on WhatsApp. WhatsApp challenged the EDPB decision before the General Court, which initially dismissed the case as inadmissible, stating the decision was an intermediate act and not directly concerning WhatsApp.
The Court of Justice disagreed, ruling that the EDPB’s binding decision is a final act that legally affects WhatsApp without discretion for the supervisory authorities. The decision directly changes WhatsApp’s legal position and is therefore open to challenge. The case has been referred back to the General Court for a full ruling on whether WhatsApp violated the GDPR provisions.
