An advocate general for the Court of Justice of the European Union (CJEU) has issued a supportive opinion for WhatsApp in its ongoing legal challenge against the European Data Protection Board (EDPB). This development could potentially allow companies to more openly contest decisions passed down by the EDPB. As per the opinion, which carries no binding authority, Advocate General Tamara Ćapeta indicated that WhatsApp’s challenge to the EDPB decision is admissible and should be referred back to the General Court for further deliberation on the merits.
According to Ćapeta, the General Court of the EU had erred in deeming the EDPB’s decision as preparatory and incapable of judicial review. She underscored that the decision by the EDPB has binding legal effects, particularly for the Irish supervisory authority, which was mandated to alter its draft decision, leading to a higher fine for WhatsApp. The advocate general emphasized these legal effects are significant enough for the decision to be considered a “challengeable act” under Article 263(1) of the Treaty on the Functioning of the European Union (TFEU).
Ćapeta contended that WhatsApp is “directly concerned” by the EDPB’s decision under Article 263(4) of the TFEU as the Irish authority was unable to deviate from the board’s directives. She criticized the lower court for imposing extra conditions that required the EDPB’s act to be “enforceable” against WhatsApp or to represent the “final step” in the administrative process. These conditions were not in the treaty and unnecessarily restricted access to judicial review.
The advocate general also cautioned against potential procedural gaps in the EU judicial remedy system. If companies like WhatsApp are denied the ability to challenge the EDPB decision directly, they may also be barred from contesting the decision in national court proceedings due to EU’s prohibition on indirect challenges when a direct action is feasible. This interpretation, she argued, could undermine the effectiveness of EU judicial protection.
The origins of this case lie in a €225 million fine levied by Ireland’s Data Protection Commission (DPC) on WhatsApp. This penalty was for breaches of the General Data Protection Regulation (GDPR), specifically regarding the transparency of data transfers between WhatsApp and its parent company, Meta. The EDPB later intervened, issuing a binding decision compelling WhatsApp to halt its GDPR violations.
WhatsApp initially contested the EDPB’s involvement, but a lower tribunal, in 2022, ruled that the platform lacked legal standing to directly sue the board. Instead, WhatsApp was advised to pursue the issue through a national court by objecting to the Irish-imposed fine. Subsequently, the company appealed to the CJEU, the highest court in the EU. For more details about the case and its implications, read the full article on JURIST.