After the GDPR came into force, the Irish Data Protection Commission received complaints concerning the processing of personal data by WhatsApp Ireland Ltd. The DPC, in its capacity as lead supervisory authority, began an investigation into WhatsApp’s compliance with its obligation of transparency to both users and non-users of the service.
Following that investigation, under the cooperation mechanism in the GDPR, the DPC sent a draft decision to the other member state supervisory authorities for their opinion, as the processing happened in their jurisdictions as well. Because no consensus was reached on that draft, the Irish supervisory authority referred the matter to the European Data Protection Board as provided for by the GDPR. On 28 July 2021, the EDPB adopted a decision that was binding on all the supervisory authorities concerned, in which it ruled on the matters which, in its view, had been the subject of relevant and reasoned objections by some of those authorities.
After receiving that decision, the Irish supervisory authority adopted a final decision on 20 August 2021, in which it found that WhatsApp had infringed certain provisions of the GDPR, and imposed corrective measures on it, in particular administrative fines for a cumulative amount of €225 million.
WhatsApp, in parallel, challenged the final decision before an Irish court and requested that the General Court annul the EDPB decision.
In the General Court case T-709/21 WhatsApp Ireland v Comité européen de la protection des données, the General Court dismissed the action brought by WhatsApp as inadmissible on the ground that it is not directed against an act that is open to challenge under Article 263 TFEU and that WhatsApp is not directly concerned by the contested decision, within the meaning of the criteria for locus standi in Article 263. It states that the validity of the contested decision may be examined by a national court hearing an action against the subsequent final decision that closes the procedure and is adopted at national level.
The EDPB decision did not in itself change. WhatsApp’s legal position and it constitutes only a preparatory or intermediate act to the decision of the DPC. Second, even if the EDPB decision was binding on the DPC, it left a measure of discretion to that authority as to the content of the final decision.
It will be for the Irish court to review the legality of the final decision of the DPC and, where appropriate, if it has doubts on the validity of the EDPB decision, it may refer a question for a preliminary ruling to the CJEU.
The decision was the first ruling of the General Court for an application to annul a binding decision of the EDPB.
The EDPB has welcomed the ruling.
