The European Court of Justice (ECJ) has found in favour of WhatsApp Ireland in a case related to a €225m fine levied by Ireland's Data Protection Commission (DPC).
The fine was imposed by the Irish DPC after users complained that the WhatsApp messaging service was processing personal data.
The data protection commission had launched an investigation into the issue in 2018 to assess whether WhatsApp had been complying with transparency rules under the EU's General Data Protection Regulation (GDPR).
In December 2020, the Irish DPC concluded there was a breach of the GDPR, and, under the rules, circulated its opinion to the other 26 national data protection regulators.
Ireland was the pre-eminent regulator since WhatsApp's European headquarters is in Dublin.
However, since no consensus was reached by all 27 regulators on certain aspects of the case, it was referred to the European Data Protection Board (EDPB).
In 2021, the EDPB issued a binding decision that WhatsApp had infringed certain aspects of the GDPR. It asked the Irish regulator to amend the fines to be imposed on the company; as such the regulator imposed a fine of €225m.
However, WhatsApp Ireland challenged the decision before the General Court of the ECJ, seeking an annulment of the EDPB’s binding decision.
In December 2022, the General Court dismissed WhatsApp's action on the basis that the EDPB’s decision was not open to challenge, and that that decision was not of direct concern to WhatsApp.
The Court had ruled that EDPB’s decision was merely an intermediate act. WhatsApp could only challenge the final decision of the Irish regulator before the Irish courts.
WhatsApp then challenged the General Court’s ruling at the higher European Court of Justice.
Today the ECJ found in favour of WhatsApp Ireland.
It ruled that the EDPB's decision was indeed open to challenge before European courts since its decision had emanated from an EU body.
Furthermore, the EDPB ruling had been binding on both the Irish Data Protection Commission and all 26 other data protection regulators.
The ECJ found that the EDPB's decision "definitively determines the position of that body and deals exhaustively with all the issues referred to it," according to an ECJ statement.
As such, the court held, such a decision could not be regarded as an "intermediate act", one not open to challenge.
The ECJ also found that the decision was of direct concern to WhatsApp, since it had brought about a distinct change in the legal position of the company.
The EDPB decision had unconditionally bound the national supervisory authorities concerned, in particular when it came to the conclusion that aspects of the GDPR had been infringed by WhatsApp, and those authorities could not change the result.
The ECJ therefore found WhatsApp's action admissible and the earlier ruling by the General Court was overturned.
The ECJ has now referred the case back to the General Court for it to rule on the merits of the case, including whether WhatsApp infringed the relevant provisions of the GDPR.
