The Court of Justice of the European Union has dismissed as inadmissible an action brought by WhatsApp against a decision of the European Data Protection Board (EDPB).
The court ruled however that the validity of the EDPB's decision may be challenged before the national court, which is able to make a request to the Court of Justice for a preliminary ruling.
The case related to a fine of €225 million imposed on WhatsApp by the Irish Data Protection Commission (DPC) in September 2021.
The DPC acts as the lead supervisory authority for WhatsApp across the EU as Ireland is the location of the European headquarters of its parent company Meta.
The fine followed an investigation which examined whether WhatsApp had met its obligations under the General Data Protection Regulation (GDPR) regarding the provision of information and the transparency of that information to both users and non-users of WhatsApp's services.
In December 2020, having concluded its investigation, the DPC sent its draft decision to other European data regulators for consideration, as required by the GDPR.
However, eight of around 40 of those authorities disagreed with the draft conclusions, including the DPC’s proposed fine of up to €50m.
Because the DPC was not able to reach a consensus with the other regulators on how to proceed, the case was referred to the European Data Protection Board (EDPB) and it made its binding ruling in July 2021.
WhatsApp appealed the ruling to the Irish High Court and also requested that the EU court of Justice annul the contested decision.
