The EDPB welcomes today’s CJEU’s General Court ruling stating that the action for annulment brought by WhatsApp Ireland Ltd (WhatsApp IE) against binding decision 01/2021 of the EDPB is inadmissible. The Irish Data Protection (DPA) adopted a final decision based on this binding decision. It is now up to the Irish court to review the legality of the final decision of the Irish DPA, which is enforceable against WhatsApp IE.
On 28 July 2021, the EDPB resolved a dispute on a draft decision of the Irish DPA concerning WhatsApp IE’s GDPR transparency obligations to both users and non-users of the service. In particular, the EDPB instructed the Irish DPA to amend its draft decision regarding infringements of transparency and increase its proposed fine. Following this, the Irish DPA imposed a fine of €225 million on WhatsApp IE.
The Court’s decision confirms the EDPB’s position, namely that WhatsApp IE was not directly concerned by the EDPB decision. The fact that the EDPB decision contains a definitive analysis of certain aspects of the final decision does not necessarily mean that it, in itself, brings about a distinct change in the applicant’s legal position. According to the General Court, the two conditions for a measure to be of direct concern to persons others than addressees are not met in this case.
First, the EDPB decision did not in itself change WhatsApp IE’s legal position and it constitutes only a preparatory or intermediate act to the decision of the IE DPA. Second, even if the EDPB decision was binding on the IE SA, it left a measure of discretion to that authority as to the content of the final decision.
WhatsApp IE also challenged the IE SA decision before Irish courts and, according to the General Court, it may, in that action, contest the validity of the EDPB decision. It will be for the Irish court to review the legality of the final decision of the IE SA and, where appropriate, if it has doubts on the validity of the EDPB decision, it may refer a question for a preliminary ruling to the Court of Justice of the European Union.