Communications Directorate
Press and Information Unit curia.europa.eu
PRESS RELEASE No 196/22
Luxembourg, 7 December 2022
Order of the General Court in Case T-709/21 | WhatsApp Ireland v European Data Protection Board
The General Court dismisses as inadmissible the action brought by
WhatsApp against a decision of the European Data Protection Board
The validity of the EDPB’s decision may, however, be challenged before the national court, which is able to
make a request to the Court of Justice for a preliminary ruling
Following the entry into force of the GDPR,
1
the Data Protection Commission (Ireland) received complaints from
users and non-users of the ‘WhatsApp’ messaging service concerning the processing of personal data by WhatsApp
Ireland Ltd (‘WhatsApp’). Against that background, that Irish supervisory authority, in its capacity as lead supervisory
authority,
2
initiated of its own volition a general investigation into WhatsApp’s compliance with the obligation of
transparency and the obligation to provide information with regard to individuals.
Following that investigation, under the cooperation mechanism established by the GDPR, the Irish supervisory
authority submitted a draft decision to all the other supervisory authorities of the Member States concerned by the
processing of personal data at issue for their opinion. Since no consensus was reached on that draft, the Irish
supervisory authority referred the matter to the European Data Protection Board (EDPB)
3
as provided for by the
GDPR. On 28 July 2021, the EDPB adopted a decision that was binding on all the supervisory authorities concerned,
in which it ruled on the matters which, in its view, had been the subject of relevant and reasoned objections by
some of those authorities (‘the contested decision’).
4
After receiving that decision, the Irish supervisory authority
adopted a final decision on 20 August 2021, in which it found, inter alia, that WhatsApp had infringed certain
provisions of the GDPR, and imposed corrective measures on it, in particular administrative fines for a cumulative
amount of €225 million.
WhatsApp, in parallel, challenged the final decision before an Irish court and requested that the General Court annul
the contested decision.
In this case, the General Court rules, for the first time, on an application for annulment of a binding decision of the
EDPB, adopted on the basis of the GDPR. The General Court, ruling in extended composition, dismisses the action
brought by WhatsApp as inadmissible on the ground that it is not directed against an act that is open to challenge
under Article 263 TFEU and that WhatsApp is not directly concerned by the contested decision, within the meaning
1
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016
L 119, p. 1; ‘the GDPR’).
2
Under Article 56(1) of the GDPR, which grants, inter alia, competence to act on the supervisory authority of the main establishment of the controller
for the cross-border processing carried out by that controller.
3
Under Article 68(3) of the GDPR, the EDPB is composed of the head of one supervisory authority of each Member State and of the European Data
Protection Supervisor, or their respective representatives.
4
Binding Decision 1/2021 of the EDPB.
Communications Directorate
Press and Information Unit curia.europa.eu
of the criteria for locus standi laid down in that article. It states that the validity of the contested decision may be
examined by a national court hearing an action against the subsequent final decision that closes the procedure and
is adopted at national level.
Findings of the Court
As a preliminary point, the General Court notes that, in order for an act to be open to challenge by an applicant
other than the ‘privileged’ applicants,
5
that act must have binding legal effects capable of affecting the interests of
the applicant by bringing about a distinct change in his legal position. That condition overlaps, where an applicant is
not the addressee of an individual act which he is challenging, as in the present case, with the need for the applicant
to be directly and individually concerned by that act in order to have standing to bring proceedings.
In that regard, the General Court considers, first, that the contested decision does not in itself change WhatsApp’s
legal position, since, unlike the final decision of the Irish supervisory authority, the contested decision is not directly
enforceable against WhatsApp and constitutes a preparatory act in a procedure which must be closed by the
adoption of a final decision of a national supervisory authority addressed to that undertaking.
Moreover, the contested decision has no legal effect vis-à-vis WhatsApp that is independent of the final decision of
the Irish supervisory authority. All the assessments made in the former decision are repeated in the latter and the
former has no effect that is independent of the content of the latter. Thus, the fact that an intermediate act
expresses the definitive position of an authority that will have to be taken up in the final decision closing the
procedure at issue – as in the present case, since the contested decision contains a definitive analysis of certain
aspects of the final decision – does not necessarily mean that that intermediate act itself brings about a distinct
change in the applicant’s legal position.
Next, the General Court observes that WhatsApp is not directly concerned by the contested decision. In order to be
of direct concern to an applicant who is not an addressee of a measure, that measure must, first, directly affect that
applicant’s legal situation and, second, leave no discretion to its addressees, who are entrusted with the task of
implementing it, such implementation being automatic and resulting from EU rules without the application of other
intermediate rules.
As regards the first of those conditions, the General Court recalls that the contested decision is not enforceable
against WhatsApp in a way that would allow it, without further procedural steps, to be a source of obligations for
WhatsApp or, as the case may be, rights for other individuals. In the present case, the contested decision is not the
final step of the full procedure provided for by the GDPR.
With regard to the second of those conditions, the General Court finds that, even though the contested decision was
binding on the Irish supervisory authority as regards the aspects to which it related, it left a measure of discretion to
that authority as to the content of the final decision, which also covers other aspects, in particular as regards the
amount of the administrative fines.
Lastly, the General Court notes that the inadmissibility of WhatsApp’s action before it against the contested decision
is consistent with the logic of the system of judicial remedies established by the TEU and the TFEU. More specifically,
the TFEU, in particular by providing for the possibility of bringing a direct action for annulment before the Court of
Justice of the European Union or of making a request to the latter for a preliminary ruling, has established a
complete system of legal remedies designed to ensure judicial review of the legality of acts of the European Union,
in which the national courts also participate. Under that system, where persons cannot, by reason of the conditions
for admissibility, directly challenge EU acts before the Courts of the European Union, they are able to plead, by way
of a plea of illegality, the invalidity of such an act before the national court, which, in turn, is able to make a request
to the Court of Justice for a preliminary ruling.
5
Under the second paragraph of Article 263 TFEU, the ‘privileged’ applicants are the Member States, the European Parliament, the Council and the
European Commission.
Communications Directorate
Press and Information Unit curia.europa.eu
Stay Connected!
The General Court states that the logic of that system, which explains in particular the interpretation of the
conditions for the admissibility of direct actions,
6
is that the judicial action of the Court of Justice of the European
Union and that of the national courts complement each other effectively and that the Courts of the European Union
and the national courts are not required to rule concurrently, in parallel proceedings, on the validity of the same EU
act, either directly or, in the case of the national court if it has doubts as to the validity of the act in question,
following a question referred for a preliminary ruling.
NOTE: An appeal, limited to points of law only, may be brought before the Court of Justice against the decision of
the General Court within two months and ten days of notification of the decision.
Unofficial document for media use, not binding on the General Court.
The full text of the order is published on the CURIA website.
Press contact: Jacques René Zammit (+352) 4303 3355
6
Set out in Article 263 TFEU.
