EU court rejects WhatsApp challenge against EU Data Protection Board
Article continues below
The validity of the EDPB’s decision may, however, be challenged before the national court, which is able to make a request to the Court of Justice for a preliminary ruling Following the entry into force of the GDPR, 1 the Data Protection Commission (Ireland) received complaints from users and non-users of the ‘WhatsApp’ messaging service concerning the processing of personal data by WhatsApp Ireland.
Against that background, that Irish supervisory authority, in its capacity as lead supervisory authority, 2 initiated of its own volition a general investigation into WhatsApp’s compliance with the obligation of transparency and the obligation to provide information with regard to individuals.
Following that investigation, under the cooperation mechanism established by the GDPR, the Irish supervisory authority submitted a draft decision to all the other supervisory authorities of the Member States concerned by the processing of personal data at issue for their opinion.
Since no consensus was reached on that draft, the Irish supervisory authority referred the matter to the European Data Protection Board (EDPB) 3 as provided for by the GDPR.
On 28 July 2021, the EDPB adopted a decision that was binding on all the supervisory authorities concerned, in which it ruled on the matters which, in its view, had been the subject of relevant and reasoned objections by some of those authorities (‘the contested decision’).
4 After receiving that decision, the Irish supervisory authority adopted a final decision on 20 August 2021, in which it found, inter alia, that WhatsApp had infringed certain provisions of the GDPR, and imposed corrective measures on it, in particular administrative fines for a cumulative amount of €225 million.
WhatsApp, in parallel, challenged the final decision before an Irish court and requested that the General Court annul the contested decision.
In this case, the General Court rules, for the first time, on an application for annulment of a binding decision of the EDPB, adopted on the basis of the GDPR.
The General Court, ruling in extended composition, dismisses the action brought by WhatsApp as inadmissible on the ground that it is not directed against an act that is open to challenge under Article 263 TFEU and that WhatsApp is not directly concerned by the contested decision, within the meaning of the criteria for locus standi laid down in that article.
It states that the validity of the contested decision may be examined by a national court hearing an action against the subsequent final decision that closes the procedure and is adopted at national level.
As a preliminary point, the General Court notes that, in order for an act to be open to challenge by an applicant other than the ‘privileged’ applicants, 5 that act must have binding legal effects capable of affecting the interests of the applicant by bringing about a distinct change in his legal position.
That condition overlaps, where an applicant is not the addressee of an individual act which he is challenging, as in the present case, with the need for the applicant to be directly and individually concerned by that act in order to have standing to bring proceedings.
In that regard, the General Court considers, first, that the contested decision does not in itself change WhatsApp’s legal position, since, unlike the final decision of the Irish supervisory authority, the contested decision is not directly enforceable against WhatsApp and constitutes a preparatory act in a procedure which must be closed by the adoption of a final decision of a national supervisory authority addressed to that undertaking.
Moreover, the contested decision has no legal effect vis-à-vis WhatsApp that is independent of the final decision of the Irish supervisory authority.
All the assessments made in the former decision are repeated in the latter and the former has no effect that is independent of the content of the latter.
Thus, the fact that an intermediate act expresses the definitive position of an authority that will have to be taken up in the final decision closing the procedure at issue – as in the present case, since the contested decision contains a definitive analysis of certain aspects of the final decision – does not necessarily mean that that intermediate act itself brings about a distinct change in the applicant’s legal position.
Next, the General Court observes that WhatsApp is not directly concerned by the contested decision.
In order to be of direct concern to an applicant who is not an addressee of a measure, that measure must, first, directly affect that applicant’s legal situation and, second, leave no discretion to its addressees, who are entrusted with the task of implementing it, such implementation being automatic and resulting from EU rules without the application of other intermediate rules.
As regards the first of those conditions, the General Court recalls that the contested decision is not enforceable against WhatsApp in a way that would allow it, without further procedural steps, to be a source of obligations for WhatsApp or, as the case may be, rights for other individuals.
In the present case, the contested decision is not the final step of the full procedure provided for by the GDPR.
With regard to the second of those conditions, the General Court finds that, even though the contested decision was binding on the Irish supervisory authority as regards the aspects to which it related, it left a measure of discretion to that authority as to the content of the final decision, which also covers other aspects, in particular as regards the amount of the administrative fines.
Lastly, the General Court notes that the inadmissibility of WhatsApp’s action before it against the contested decision is consistent with the logic of the system of judicial remedies established by the TEU and the TFEU.
More specifically, the TFEU, in particular by providing for the possibility of bringing a direct action for annulment before the Court of Justice of the European Union or of making a request to the latter for a preliminary ruling, has established a complete system of legal remedies designed to ensure judicial review of the legality of acts of the European Union, in which the national courts also participate.
Under that system, where persons cannot, by reason of the conditions for admissibility, directly challenge EU acts before the Courts of the European Union, they are able to plead, by way of a plea of illegality, the invalidity of such an act before the national court, which, in turn, is able to make a request to the Court of Justice for a preliminary ruling.
The General Court states that the logic of that system, which explains in particular the interpretation of the conditions for the admissibility of direct actions, 6 is that the judicial action of the Court of Justice of the European Union and that of the national courts complement each other effectively and that the Courts of the European Union and the national courts are not required to rule concurrently, in parallel proceedings, on the validity of the same EU act, either directly or, in the case of the national court if it has doubts as to the validity of the act in question, following a question referred for a preliminary ruling. ■