On Tuesday, the Court of Justice of the European Union (CJEU) ruled that WhatsApp Ireland’s challenge against a 2021 decision by the European Data Protection Board (EDPB) is admissible, overturning a previous judgment that dismissed the case on procedural grounds.
The dispute began in 2019 when Ireland’s Data Protection Commission (DPC) — the lead regulator for many U.S. tech firms operating in the EU — imposed an initial fine on WhatsApp over complaints related to its handling of personal data. The DPC later increased the penalty to €225 million ($268 million) after the EDPB intervened.
WhatsApp appealed the decision to a lower tribunal, but the case was dismissed on the basis that the company lacked legal standing to sue the EDPB, as it was not directly affected by the board’s decision. The CJEU disagreed with that assessment, sending the matter back for review on its merits.
“The action brought by WhatsApp Ireland against Binding Decision 1/2021 of the European Data Protection Board is admissible,” the Luxembourg-based court stated.
WhatsApp welcomed the ruling, arguing that it supports the principle that businesses and individuals should be able to challenge EDPB decisions in court. A spokesperson said the decision ensures that the EDPB can be held accountable through EU legal channels.
The case is part of a wider backlog facing Ireland’s DPC, which has issued more than €4 billion in GDPR fines since 2020. However, only €17.5 million has been collected so far, as most sanctions are tied up in lengthy legal challenges.
Several of the DPC’s fines were increased through EDPB interventions similar to the one in the WhatsApp case, meaning that many appeals may hinge on how European courts interpret and calculate penalties under the GDPR.
The case is registered as C-97/23P WhatsApp Ireland v EDPB.