An EU court has dismissed an action brought by messaging service WhatsApp that sought an annulment of a decision by the European Data Protection Board (EDPB).

The General Court of the Court of Justice of the European Union (CJEU) ruled that the action taken by WhatsApp, which is owned by Meta, was inadmissible.

The legal action arose after Ireland’s Data Protection Commission (DPC) last year imposed a record €225 million fine on WhatsApp for breaches of its obligations under the EU’s GDPR data-privacy rules.

After an investigation that began in late 2018, the DPC submitted a draft decision to other European data regulators in December 2020.

After objections from eight of these regulators, and subsequent discussions, the DPC triggered the GDPR’s dispute-resolution process.

This led to a binding ruling by the EDPB, which ordered the DPC to increase its fine.

WhatsApp, in parallel, challenged the final decision before an Irish court, and asked the CJEU to annul the contested decision.

Decision ‘not directly enforceable’

The EU court decided, however, that the WhatsApp action was inadmissible, as it was not directed against an act that was open to challenge under EU law, and that the company could take legal action against the DPC’s final decision in the Irish court.

The EU court decided that the EDPB decision did not, in itself, change WhatsApp’s legal position, as it was not directly enforceable against the company.

The EDPB decision “constitutes a preparatory act in a procedure which must be closed by the adoption of a final decision of a national supervisory authority addressed to that undertaking,” the court stated.

It added that, even though the board’s decision was binding on the DPC, it left “a measure of discretion” to that Irish authority as to the content of the final decision.