CJEU - C‑97/23 - WhatsApp Ireland Ltd

CJEU - C‑97/23 WhatsApp Ireland Ltd

Court:	CJEU
Jurisdiction:	European Union
Relevant Law:	Article 65 GDPR 263(1) TFEU 263(4) TFEU
Decided:
Parties:	WhatsApp Ireland Ltd European Data Protection Board
Case Number/Name:	C‑97/23 WhatsApp Ireland Ltd
European Case Law Identifier:	ECLI:EU:C:2025:210
Reference from:
Language:	24 EU Languages
Original Source:	AG Opinion
Initial Contributor:	tjk

The AG opined, that WhatsApp's challenge of the EDPB's binding decision before the European General Court was admissible under Article 263 TFEU. Specifically, the challengeability is not hindered by the fact that the binding decision requires implementation by the DPA's final decision as WhatsApp is nevertheless directly concerned.

English Summary

Facts

Following the entry into force of the GDPR, the Irish DPA received complaints from users and non-users (the data subjects) of the ‘WhatsApp’ messaging service concerning the processing of personal data by WhatsApp Ireland Ltd (the controller). The Irish DPA, in its capacity as lead DPA, started an investigation into the controller’s compliance with the obligation of transparency and the obligation to provide information with regard to individuals.

Following that investigation, the Irish DPA submitted a draft decision to all the other supervisory authorities of the Member States concerned. Since no consensus was reached on that draft, the Irish DPA referred the matter to the European Data Protection Board (EDPB).

On 28 July 2021, the EDPB adopted a binding decision, in which it ruled on the matters which, in its view, had been the subject of relevant and reasoned objections by some of those authorities. After receiving that decision, the Irish DPA adopted a final decision on 20 August 2021, in which it found that the controller had infringed certain provisions of the GDPR. The Irish DPA imposed corrective measures on the controller, in particular administrative fines for a cumulative amount of €225 million.

The controller, in parallel, challenged the Irish DPA's final decision before an Irish court and requested that the General Court (GC) annul the EDPB's binding decision in its entirety or, in the alternative, annul the relevant parts of that decision.

On 7 December 2022, the GC rejected the controller’s action as inadmissible. In that order, the General Court considered, in essence, that the binding decision did not constitute a challengeable act for the purpose of Article 263(1) TFEU and that the controller was not directly concerned with that decision, within the meaning of Article 263(4) TFEU.

By its appeal lodged on 17 February 2023, the controller requests that the Court of Justice set aside the order under appeal, find the action admissible, refer the case back to the General Court to decide on the substance of the matter, and order the EDPB to pay the costs. The German Government intervened in support of the EDPB.

The controller put forward two grounds of appeal:

The GC misinterpreted the concepts of challengeable act, as arising from 263(1) TFEU, and of direct concern, as contained in Article 263(4) TFEU. That error resulted in the misapplication of Article 263 TFEU in the case at hand, leading the GC to incorrectly qualify the contested decision as not being an act challengeable by the controller.
The GC misinterpreted and incorrectly applied Article 65(1) GDPR in relation to the contested decision.

Advocate General Opinion

The contested decision is a challengeable act

The AG opined, the EDPB's decision was final, and produced binding legal effects vis-à-vis the Irish DPA. Thus, the GC should have concluded that the contested decision is a challangeable act under Article 263(1) TFEU. The AG held, that the GC confused that the question of whether a measure is a challengeable act is an analytically separate issue from the question of whether a concrete applicant can challenge that act – provided it is a challengeable act – in the first place.

Whether a measure is changeable requires an assessment of whether that act has binding legal effects for someone outside of that institution.
it is irrelevant that that act constitutes an ‘intermediary’ or 'enforcable' step of a composite procedure
Whether a person has the capacity to challenge that act is resolved under the fourth paragraph of Article 263 TFEU and not under the first paragraph thereof.

Regarding this distinction, the AG suggested that the CJEU revisits especially the judgments in CJEU, C-60/81, IBM and CJEU C‑463/10 and C‑475/10, Deutsche Post to clarify that the court did not add to the conditions established by the TFEU and to draw a clear distinction between the two analytical steps underlying the conditions for admissibility under Article 263 TFEU.

The controller is directly concerned by the contested decision

The AG opined, that the GC had also confused the conditions for establishing whether the contested decision is a challengeable act with the conditions for finding whether the controller is directly concerned.

The GC wrongly based its assessment on non-existing conditions that the challenged act be directly enforceable towards the applicant in annulment procedures and not entail implementing measures.
The GC erred in the assessment that the contested decision left discretion to the implementing authority, in this case the Irish DPA.
The GC erred in concluding that the presence of parts not covered by the contested decision in the Irish DPA’s final decision was relevant for the question of whether the contested decision left no discretion to that authority.

The logic of the EU system of judicial remedies requires admissibility of the action in the present case

The AG agreed, that the GC's consideration, that challenges to DPA's final decisions must be brought before national court, would resolve the current procedural inconvenience that effectively requires an applicant to introduce two separate actions, one before the GC and another before a national court, to ensure the effective safeguard all of its rights under EU law.

However, the AG opined, that at least in its current structure, the EU system of judicial protection provides for no other solution.

If national courts consider that an EU act is invalid, they must initiate the preliminary ruling procedure before the CJEU.
a national court cannot question the validity of an EU act if the party did not challenge that act within the time limit provided for by Article 263(6) TFEU.
The direct action before the GC, in which the EU body is a party to the proceedings, is the more appropriate avenue as otherwise the procedural role of that body would depend on the relevant national procedural rules.

The case was not brought out of time

The AG rejected that the controller’s action was brought out of time, because the Irish DPA had informed the controller already of ‘the relevant content’ of the contested decision prior to the EDPB’s publication thereof on its website. The AG held, that the publication of binding decisions of the EDPB is mandated by the third sentence of Article 65(5) GDPR thus making the fact that it may also have been aware of the material content of that decision prior to its mandated publication is irrelevant for the purposes of the admissibility of the present action for annulment.

The AG's conclusion

The contested decision constitutes a challengeable act, for the purpose of Article 263(1) TFEU.
The controller is directly concerned by that decision, within the meaning of Article 263(4) TFEU.
The contested decision is of individual concern to the controller, as the General Court itself found in the order under appeal.

Thus, the AG found the controller's action before the GC admissible. However, given that the GC did not consider the merits, the AG opined that the state of proceedings does not permit the CJEU to rule on the merits of the controller’s action. Accordingly, the case must be referred back to the GC and the costs reserved.

Holding

TBD

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!