CJEU - C‑97/23 - WhatsApp Ireland Ltd

CJEU - C‑97/23 WhatsApp Ireland Ltd

Court:	CJEU
Jurisdiction:	European Union
Relevant Law:	Article 65 GDPR 263(1) TFEU 263(4) TFEU
Decided:
Parties:	WhatsApp Ireland Ltd European Data Protection Board
Case Number/Name:	C‑97/23 WhatsApp Ireland Ltd
European Case Law Identifier:	ECLI:EU:C:2025:210
Reference from:
Language:	24 EU Languages
Original Source:	AG Opinion
Initial Contributor:	tjk

The AG opined that WhatsApp could challenge the EDPB's binding decision before the European General Court under Article 263 TFEU. Specifically, the AG considered WhatsApp to be directly concerned by the binding decision.

English Summary

Facts

Following the entry into force of the GDPR, the Irish DPA received complaints from users and non-users (the data subjects) of the ‘WhatsApp’ messaging service concerning the processing of personal data by WhatsApp Ireland Ltd (the controller).

After receiving an European Data Protection Board (EDPB) 'binding decision' (28 July 2021) within the framework of the GDPR's consistency mechanism, the Irish DPA adopted a final decision on 20 August 2021, in which it found that the controller had infringed certain provisions of the GDPR. The Irish DPA imposed corrective measures on the controller, in particular administrative fines for a cumulative amount of €225 million.

The controller, challenged the EDPB's binding decision before the European General Court (GC) and in - in parallel - the implementing final decision by the Irish DPA before an Irish court.

On 7 December 2022, the GC rejected the controller’s action as inadmissible. In that order, the GC considered, in essence, that the binding decision did not constitute a challengeable act for the purpose of Article 263(1) TFEU and that the controller was not directly concerned with that decision, within the meaning of Article 263(4) TFEU. Additionally, the GC considered the controller’s action brought out of time, because the Irish DPA had informed the controller already of ‘the relevant content’ of the contested decision prior to the EDPB’s publication thereof on its website, thus the term under Article 263(5) had already commenced then and not only with the publication.

By its appeal lodged on 17 February 2023, the controller requested that the CJEU in essence to reject the GC's order and find the action admissible. The controller put forward two grounds of appeal:

The GC misinterpreted the concepts of challengeable act, as arising from 263(1) TFEU, and of direct concern, as contained in Article 263(4) TFEU. That error resulted in the misapplication of Article 263 TFEU in the case at hand, leading the GC to incorrectly qualify the contested decision as not being an act challengeable by the controller.
The GC misinterpreted and incorrectly applied Article 65(1) GDPR in relation to the contested decision.

Advocate General Opinion

Overview: The AG's conclusion

The contested decision constitutes a challengeable act, for the purpose of Article 263(1) TFEU.
The controller is directly concerned by that decision, within the meaning of Article 263(4) TFEU.
The contested decision is of individual concern to the controller, as the GC itself found in the order under appeal.

Thus, the AG found the controller's action before the GC admissible.

However, given that the GC did not consider the merits, the AG opined that the state of proceedings does not permit the CJEU to rule on the merits of the controller’s action. Accordingly, the case must be referred back to the GC and the costs reserved.

1. The contested decision is a challengeable act, Article 263(1) TFEU

AG Ćapeta opined, that the EDPB's decision was final, and produced binding legal effects vis-à-vis the Irish DPA. Thus, the GC should have concluded that the contested decision is a challangeable act under Article 263(1) TFEU.

The AG held, that the GC confused that the question of whether a measure is a challengeable act is an analytically separate issue from the question of whether a concrete applicant can challenge that act – provided it is a challengeable act – in the first place.

Whether a measure is challangeable requires an assessment of whether that act has binding legal effects for someone outside of that institution.
it is irrelevant that that act constitutes an ‘intermediary’ or 'enforcable' step of a composite procedure
Whether a person has the capacity to challenge that act is resolved under the fourth paragraph of Article 263 TFEU and not under the first paragraph thereof.

Regarding this distinction, the AG suggested that the CJEU revisits especially the judgments in CJEU, C-60/81, IBM and CJEU C‑463/10 and C‑475/10, Deutsche Post to clarify that the CJEU did not add to the conditions established by the TFEU and to draw a clear distinction between the two analytical steps underlying the conditions for admissibility under Article 263 TFEU.

2. The controller is directly concerned by the contested decision, Article 263(4) TFEU

The AG opined, that the GC had also confused the conditions for finding whether the controller is directly concerned. The AG held, that

The GC wrongly based its assessment on non-existing conditions that the challenged act be directly enforceable towards the applicant in annulment procedures and not entail implementing measures.
The GC erred in the assessment that the contested decision left discretion to the implementing authority, in this case the Irish DPA.
The GC erred in concluding that the presence of parts not covered by the contested decision in the Irish DPA’s final decision was relevant for the question of whether the contested decision left no discretion to that authority.

The logic of the EU system of judicial remedies requires admissibility of the action in the present case

The AG agreed with the GC's consideration, that challenges to DPA's final decisions should be brought before national court because this would resolve the current procedural inconvenience that effectively requires an applicant to introduce two separate actions, one before the GC and another before a national court, to ensure the effective safeguard all of its rights under EU law.

However, the AG opined, that at least in its current structure, the EU system of judicial protection provides for no other solution. Specifically, the AG held, that:

if national courts consider that an EU act is invalid, they must initiate the preliminary ruling procedure before the CJEU.
a national court cannot question the validity of an EU act if the party did not challenge that act within the time limit provided for by Article 263(6) TFEU.
the direct action before the GC is the more appropriate avenue when EU bodies are a party as otherwise the procedural role of them depend on national procedural rules.

The case was not brought out of time

The AG held, that the publication of binding decisions of the EDPB is mandated by the third sentence of Article 65(5) GDPR thus rendering the fact irrelevant that the EDPB may also have been aware of the material content of a DPA's final decisoin prior to its mandated publication.

Holding

TBD

Comment

Appeal against GC - T-709/21 - WhatsApp Ireland v European Data Protection Board

Further Resources

Share blogs or news articles here!