CJEU rules WhatsApp may directly challenge EDPB decisions

The Court of Justice of the European Union has ruled that WhatsApp is entitled to challenge a decision of the European Data Protection Board directly before the EU courts, rather than relying exclusively on national procedures.

The case concerned a 2021 binding decision in which the EDPB instructed Ireland’s Data Protection Commission on how to proceed in its enforcement action against WhatsApp under the General Data Protection Regulation. European regulators had argued that such EDPB decisions are formally addressed only to national supervisory authorities, and therefore not directly challengeable by companies at EU level.

The Court found that where a binding EDPB decision directly affects a company’s legal position, that company may have standing to seek annulment before the EU courts. Judges confirmed that firms should not be required to depend solely on subsequent national proceedings if their commercial rights are directly impacted.

The ruling establishes a precedent for how businesses may defend their interests in cross-border GDPR cases. Companies subject to binding EDPB decisions will now be able to contest those decisions at EU level, potentially bypassing the need to wait for final national enforcement measures before seeking judicial review.

Legal analysts suggest the judgment could lead to an increase in direct actions before the EU courts and may influence the dynamics between national supervisory authorities and the EDPB.