CJEU dismisses WhatsApp challenge to fine
An EU court has dismissed an action brought by messaging service WhatsApp that sought an annulment of a decision by the European Data Protection Board (EDPB).
The General Court of the Court of Justice of the European Union (CJEU) ruled that the action taken by WhatsApp, which is owned by Meta, was inadmissible.
The legal action arose after Ireland鈥檚 Data Protection Commission (DPC) last year imposed a record 鈧225 million fine on WhatsApp for breaches of its obligations under the EU鈥檚 GDPR data-privacy rules.
After an investigation that began in late 2018, the DPC submitted a draft decision to other European data regulators in December 2020.
After objections from eight of these regulators, and subsequent discussions, the DPC triggered the GDPR鈥檚 dispute-resolution process.
This led to a binding ruling by the EDPB, which ordered the DPC to increase its fine.
WhatsApp, in parallel, challenged the final decision before an Irish court, and asked the CJEU to annul the contested decision.
Decision 鈥榥ot directly enforceable鈥
, however, that the WhatsApp action was inadmissible, as it was not directed against an act that was open to challenge under EU law, and that the company could take legal action against the DPC鈥檚 final decision in the Irish court.
The EU court decided that the EDPB decision did not, in itself, change WhatsApp鈥檚 legal position, as it was not directly enforceable against the company.
The EDPB decision 鈥渃onstitutes a preparatory act in a procedure which must be closed by the adoption of a final decision of a national supervisory authority addressed to that undertaking,鈥 the court stated.
It added that, even though the board鈥檚 decision was binding on the DPC, it left 鈥渁 measure of discretion鈥 to that Irish authority as to the content of the final decision.