Continue reading on DataGuidance with:
Free Member
Limited ArticlesCreate an account to continue accessing select articles, resources, and guidance notes.
Already have an account? Log in
Create an account
Join our community for free to access exclusive whitepapers, reports, and regulatory information.
EU: CJEU dismisses action brought by Whatsapp to annul EDPB binding decision on €225M fine
The Court of Justice of the European Union ('CJEU') announced, on 7 December 2022, that it had issued its judgment in Case T-709/21, WhatsApp Ireland v EDPB, following Whatsapp's appeal against the European Data Protection Board's ('EDPB') binding dispute resolution decision, adopted on 28 July 2021, which resulted in the Data Protection Commission ('DPC') issuing a fine of €225 million against Whatsapp.
In particular, the CJEU highlighted that the judgment in question represents the first ruling by the CJEU on an application for annulment of a binding decision of the EDPB, adopted on the basis of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR').
More specifically, the CJEU explained that it had dismissed the action brought by Whatsapp as inadmissible on the ground that it is not directed against an act that is open to challenge under Article 263 of the Treaty on the Functioning of the European Union ('TFEU') and that WhatsApp is not directly concerned by the contested decision, within the meaning of the criteria for locus standi laid down by Article 263 of the TFEU. However, according to the CJEU, the validity of the contested decision may be challenged before a national court, which would be able to make a request to the CJEU for a preliminary ruling.
You can read the press release here and the judgment here.
UPDATE (8 December 2022)
EDPB welcomes CJEU judgment
The European Data Protection Board ('EDPB') issued, on 7 December 2022, a press release welcoming the CJEU's ruling that annulled the action brought by Whatsapp. In particular, the EDPB explained that its binding decision did not in itself change WhatsApp's legal position and it constituted only a preparatory or intermediate act to the decision of the DPC. Moreover, the EDPB continued, according to the CJEU, the two conditions for a measure to be of direct concern to persons others than addressees were not met in the present case.
Further to this, the EDPB specified that it will be for the competent Irish court to review the legality of the DPC decision and, if appropriate, refer a question for a preliminary ruling to the CJEU in relation to the EDPB's binding decision.
You can read the press release here.
