The Court of Justice of the European Union (CJEU) on Tuesday found that a legal action brought by WhatsApp Ireland against a 2021 binding decision of the European Data Protection Board (EDPB) is admissible, directing the lower tribunal to examine the substance of the case rather than dismiss it on procedural grounds.
The dispute stems from an order by the EDPB that the Irish Data Protection Commission (DPC) increase a fine related to WhatsApp's handling of personal data to 225 million euros - roughly $268 million at the exchange rate cited in the case file. That directive, issued in 2021, followed complaints about WhatsApp's use of personal data in Ireland and prompted the DPC to raise the penalty.
WhatsApp appealed the penalty to a lower-level tribunal after the DPC acted, but judges at that tribunal previously decided the company lacked legal standing to sue the authority because it concluded WhatsApp was not directly affected by the EDPB's decision. The CJEU has now overturned that procedural conclusion and ordered the tribunal to consider WhatsApp Ireland's challenge on its merits.
A WhatsApp spokesperson said the company welcomed the ruling, adding that it supported the principle that businesses and individuals should be able to challenge EDPB decisions so that the board can be held accountable by the EU courts.
The case is one among several involving Ireland's DPC, which serves as the lead EU privacy regulator for many major U.S. technology companies because of the location of their European headquarters in Ireland. Since 2020 the DPC has imposed penalties exceeding 4 billion euros on large tech firms for violations of the General Data Protection Regulation, but it has collected only 17.5 million euros in fines to date, largely because most completed investigations have been tied up in protracted legal appeals.
The CJEU's determination is likely to affect other pending appeals in which the EDPB intervened to increase fines. Several of those challenges cannot advance until European courts provide clarity on the legal basis and calculation of the 2021 WhatsApp penalty. The case is recorded as C-97/23P WhatsApp Ireland v EDPB. ($1 = 0.8403 euros)