Following the receipt of complaints from users (and non-users) of “WhatsApp” concerning the processing of personal data by WhatsApp Ireland Ltd, the Data Protection Commission (Ireland), as the lead supervisory authority, launched an investigation into WhatsApp’s compliance with the obligation of transparency and the obligation to provide information regarding individuals under the GDPR.

Under Article 56(1) of the GDPR, the Irish supervisory authority then submitted a draft decision to all relevant Member State supervisory authorities for their consideration. No consensus was reached on the draft, so the Irish supervisory authority referred the matter to the European Data Protection Board (EDPB). On 28 July 2021, the EDPB adopted a decision that was binding on all the supervisory authorities concerned. The Irish supervisory authority then adopted a final decision on 20 August 2021, in which it found that WhatsApp had infringed the GDPR and issued it with fines totalling €225 million.

WhatsApp challenged the Irish supervisory authority’s final decision in the Irish court. It also applied to the General Court requesting that the EDPB’s decision be annulled. This is the first time the GC has had to consider a request for annulment of a binding decision from the EDPB.

The GC dismissed WhatsApp’s request as inadmissible on the ground that it did not comply with Article 263 of the Treaty on the Functioning of the EU (TFEU) as: (i) it was not directed against an act that was open to challenge under Article 263; and (ii) WhatsApp did not have locus standi under Article 263 because it was not directly and individually involved in the EDPB’s decision. Under Article 263, the validity of the EDPB’s decision can only be assessed by a national court in proceedings concerning a subsequent final decision that has been adopted at national level and that brings proceedings to an end.

The GC said that, under Article 263, for a decision to be open to challenge by an applicant other than a Member State, the European Parliament, the Council and the European Commission, that decision must be legally binding in relation to the applicant and bring about a distinct change in its legal position. This requirement overlapped with the need for the applicant to be directly and individually affected by that decision in order to have standing to bring proceedings where, as in this case, the applicant is not the addressee of the decision under challenge.

In the GC’s view, the EDPB’s decision did not change WhatsApp’s legal position since, unlike the Irish supervisory authority’s final decision, the EDPB’s decision was not directly enforceable against WhatsApp in that it did not, without further steps being taken, impose any obligations on WhatsApp or confer rights on other individuals; it was merely a preparatory act in enabling the final decision of the Irish national supervisory authority against WhatsApp and was not the final step in the procedure set out in the GDPR.

Further, the EDPB’s decision had no legal effect on WhatsApp independent of the final decision of the Irish supervisory authority, as all assessments made in the EDPB’s decision were repeated in the final decision. The GC said that the fact that an intermediate decision expresses the definitive position of a supervisory authority in its final decision does not necessarily mean that the intermediate decision has itself caused a distinct change to the applicant’s legal position.

In addition, the GC said, the decision in question must leave no discretion to the addressees who must implement it. Here, although the EDPB’s decision was binding on the Irish supervisory authority, it gave it a measure of discretion as to the content of the final decision, e.g. the amount of the fines.

Finally, the GC noted that ruling WhatsApp’s application inadmissible was consistent with the logic of the system of judicial remedies established by the TFEU. Under that system, where someone cannot directly challenge an EU decision before the courts of the EU, they can challenge such decision in the national courts which can then request a preliminary ruling from the CJEU. In this way, the CJEU and the national courts complement each other and concurrent rulings on the same matter are avoided. (Case T-709/21 WhatsApp Ireland Ltd v European Data Protection Board (7 December 2022) — to read an abstract of the full judgment, click here).