On 20 August 2021, the Irish Data Protection Commission ordered WhatsApp Ireland Limited to pay a monster fine of EUR 225 million. WhatsApp appealed the decision of the European Data Protection Board that led to the Irish supervisory authority’s decision, but on 7 December 2022, the General Court declared the appeal inadmissible (T-709/21).
To refresh your memory
In December 2018, the Irish Data Protection Commission (DPC) launched an investigation into WhatsApp Ireland Limited – now a subsidiary of Meta Platforms Ireland Limited. The Irish DPC examined whether WhatsApp complied with the transparency and information obligations laid down in Articles 12, 13 and 14 of the General Data Protection Regulation (GDPR) as regards both users and non-users of the application. As WhatsApp has its main establishment in Ireland, the Irish supervisory authority acted as the lead watchdog.
In September 2020, the Irish DPC submitted its investigation report and draft decision to the other supervisory authorities of the EU Member States in accordance with Article 60 GDPR. Eight of those authorities objected to the draft decision. Since the authorities failed to reach a consensus, the Irish DPC triggered the dispute resolution mechanism of Article 65 GDPR and referred the matter to the European Data Protection Board (EDPB). The EDPB issued a binding decision on 28 July 2021, ordering the Irish DPC to review its draft decision. The EDPB considered that the Irish DPC should amend the decision regarding WhatsApp's breaches of the GDPR, the calculation of the fine and the deadline for WhatsApp's compliance. WhatsApp submitted its comments in 2021, which were taken into account by the Irish DPC in formulating its final decision.
In its final decision of 20 August 2021, the Irish DPC found that WhatsApp (inter alia) failed to provide users with information laid down by Articles 13 and 14 GDPR, making it impossible for them to adequately consider and exercise their rights. The Irish DPC fined WhatsApp a total of EUR 225 million. The EDPB’s decision was attached to the Irish DPC’s final decision.
WhatsApp marches to the General Court
WhatsApp challenged the Irish DPC's decision before an Irish court and sought the annulment of the EPDB’s binding decision before the EU General Court. The General Court therefore had to rule, for the first time, on an application for annulment of a decision of the EDPB under Article 65 GDPR.
In line with Article 263 of the Treaty on the Functioning of the European Union (TFEU), the General Court first noted that the contested decision adopted by the EDPB is an act of a body of the Union and is intended to produce legal effects vis-à-vis third parties, since it is a ‘binding decision’ with respect to the supervisory authorities concerned. However, in order to constitute an act open to challenge by WhatsApp, the act must have binding legal effects capable of affecting the interests of WhatsApp by bringing about a distinct change in WhatsApp’s legal position.
In this regard, the General Court held that WhatsApp is individually concerned by the decision of the EDPB, since this decision relates to certain aspects of a draft final decision of the Irish supervisory authority concerning it specifically. However, the General Court found that the EPDB's decision does not in itself change WhatsApp’s legal position. The decision is a preparatory act in a procedure which must end with the adoption of a final decision of the Irish DPC, and is therefore not directly enforceable against WhatsApp. In addition, WhatsApp is afforded effective judicial protection in respect of the contested decision by means of the remedy available to it before the national court against the final decision of the Irish supervisory authority, making it possible to assess the validity of the contested decision.
The General Court also noted that the EDPB’s decision is not enforceable against WhatsApp in a way that would allow it, without further procedural steps, to be a source of obligations for WhatsApp. In addition, the General Court found that, even though the contested decision was binding on the Irish supervisory authority as regards the aspects to which it related, it left a measure of discretion to the Irish DPC as to the content of its final decision.
In conclusion, the General Court considered that accepting that WhatsApp’s action against the contested decision was admissible would mean that two parallel judicial proceedings would be ongoing, with significant overlap: one before the General Court challenging the EDPB’s decision and the other before an Irish court challenging the final decision, part of the grounds of which are based on the EDPB’s decision.
For the above reasons, the General Court, ruling in extended composition, dismissed the action brought by WhatsApp as being inadmissible.
What’s next?
In its ruling, the General Court reiterated the principles of the system of judicial remedies established by the Treaty on European Union (TEU) and the TFEU. The TFEU ensures judicial review of the legality of acts of the European Union, in which the national courts also participate. Under this system, WhatsApp cannot, by reason of the conditions for admissibility, directly challenge the decision of the EDPB before the General Court, but it can indirectly plea the invalidity of this act before the national court by introducing an action against the subsequent final decision of the Irish DPC. In turn, this national court is able, where appropriate, to make a request to the Court of Justice for a preliminary ruling.
In line with this system of judicial review, we now await the judgment of the competent Irish court following WhatsApp’s challenge of the final decision of the Irish DPC.
To be continued!
For the sake of comprehensiveness, we note that WhatsApp can also bring an appeal, limited to points of law only, before the Court of Justice, against the decision of the General Court, within two months and 10 days of being notified of the decision.
Please contact Karel Janssens for further information about this topic and/or for general legal advice relating to privacy and data protection.