General Court: WhatsApp annulment action inadmissible

Dec 7, 2022

Source: European Data Protection Board

The EDPB welcomes today’s CJEU’s General Court ruling stating that the action for annulment brought by WhatsApp Ireland Ltd  (WhatsApp IE) against binding decision 01/2021 of the EDPB is inadmissible. The Irish Data Protection (DPA) adopted a final decision based on this binding decision. It is now up to the Irish court to review the legality of the final decision of the Irish DPA, which is enforceable against WhatsApp IE.

On 28 July 2021, the EDPB resolved a dispute on a draft decision of the Irish DPA concerning WhatsApp IE’s GDPR transparency obligations to both users and non-users of the service. In particular, the EDPB instructed the Irish DPA to amend its draft decision regarding infringements of transparency and increase its proposed fine. Following this, the Irish DPA imposed a fine of €225 million on WhatsApp IE.

The Court’s decision confirms the EDPB’s position, namely that WhatsApp IE was not directly concerned by the EDPB decision. The fact that the EDPB decision contains a definitive analysis of certain aspects of the final decision does not necessarily mean that it, in itself, brings about a distinct change in the applicant’s legal position. According to the General Court, the two conditions for a measure to be of direct concern to persons others than addressees are not met in this case.

First, the EDPB decision did not in itself change WhatsApp IE’s legal position and it constitutes only a preparatory or intermediate act to the decision of the IE DPA. Second, even if the EDPB decision was binding on the IE SA, it left a measure of discretion to that authority as to the content of the final decision.

WhatsApp IE also challenged the IE SA decision before Irish courts and, according to the General Court, it may, in that action, contest the validity of the EDPB decision. It will be for the Irish court to review the legality of the final decision of the IE SA and, where appropriate, if it has doubts on the validity of the EDPB decision, it may refer a question for a preliminary ruling to the Court of Justice of the European Union.

 

Recent news

Data Protection Day 2023

On the occasion of Data Protection Day, we invite you to take a look back at GDPR enforcement over the last few years and explore how the EDPB helps all EEA DPAs act as one to safeguard your rights, today and tomorrow. Join us to see how European data protection...

read more

EDPB publishes Binding Decision concerning WhatsApp

Following the EDPB’s binding dispute resolution decision of December 5th, WhatsApp IE was issued a 5.5 million euro fine by the Irish Data Protection Authority (DPA). In its Binding Decision, the EDPB instructed the IE DPA to amend its draft decision with respect to...

read more
Generated by Feedzy