Скачать или смотреть Judgment WhatsApp Ireland v European Data Protection Board explained

Protection of personal data - Action for annulment

Can a company challenge before the EU courts a binding decision of the European Data Protection Board (EDPB) adopted under the GDPR dispute resolution mechanism?

That is the question examined by the ECJ in today’s judgment in Case C-97/23 P.

After several supervisory authorities received complaints concerning WhatsApp’s compliance with the GDPR (in particular as regards transparency) the Irish Data Protection Commission launched an investigation. As no consensus emerged on its draft decision, the matter was referred to the EDPB.

The Board adopted a final and binding decision identifying infringements and requiring changes to the proposed corrective measures, including the level of the fines. On that basis, the Irish authority imposed fines totalling €225 million on WhatsApp.

WhatsApp challenged the Board’s decision before the EUGeneralCourt, which dismissed the action as inadmissible. WhatsApp appealed to the hashtag#ECJ.

In his short explainer, Vice-President von Danwitz walks you through the key elements of the case.