---

WhatsApp can challenge EDPB decision

The EU’s highest court has ruled that WhatsApp Ireland can challenge a fine imposed on it for breaching the GDPR in the EU courts. 

The fine of €225 million had been imposed by the European Data Protection Body (EDPB) after European data watchdogs failed to agree on a draft decision submitted by Ireland’s Data Protection Commission (DPC) after an investigation. 

WhatsApp, owned by Meta, had sought the annulment of the fine before the lower General Court, which had dismissed the challenge as inadmissible. 

‘Intermediate act’  

The lower court found that the EDPB’s decision was not an act open to challenge and that it was not of direct concern to WhatsApp. 

According to the General Court, the EDPB’s decision was an intermediate act, and WhatsApp could challenge only the final decision of the DPC before a national court. 

In its ruling, however, the Court of Justice found that the EDPB's decision was an act open to challenge before the EU courts. 

The judges stated that the decision was an act that emanated from an EU body and was binding on the DPC and all the other supervisory authorities. 

“Moreover, that decision definitively determines the position of that body and deals exhaustively with all the issues referred to it. Consequently, such a decision cannot be regarded as an intermediate act not open to challenge,” the court held. 

‘Direct concern’ 

It also noted that the decision was of direct concern to WhatsApp, since it brought about a distinct change in the legal position of the company. 

“That decision unconditionally binds the supervisory authorities concerned, in particular as regards the finding of infringement of certain provisions of the GDPR, and those authorities cannot change its result,” the judges stated. 

The court set aside the General Court’s order and referred the case back to the lower court to rule on its merits – including whether WhatsApp infringed the GDPR.