GDPR: the action brought by WhatsApp Ireland against Binding Decision 1/2021 of the European Data Protection Board is admissible

11 February 2026

The Court of Justice of the European Union has ruled that a binding decision of the European Data Protection Board (EDPB) settling a dispute between several national supervisory authorities concerning whether a data controller has infringed the General Data Protection Regulation (GDPR) and, if that is the case, as appropriate, to amend the corrective measures envisaged against that controller constitutes an act open to challenge before the Courts of the European Union.

That decision emanates from an EU body and is intended to produce legal effects vis-à-vis third parties. In addition, in the present case, the Court holds that the decision at issue is of direct concern to WhatsApp Ireland Ltd (‘WhatsApp’). Since WhatsApp’s action for annulment is admissible but the General Court of the European Union has not yet examined the merits of the case, the Court sets aside the order under appeal and refers the case back to the General Court.

Following the entry into force of the GDPR, the Irish supervisory authority, namely, the Data Protection Commission, received complaints from users and non-users of the ‘WhatsApp’ messaging service concerning the processing of personal data by that undertaking. That authority initiated ex officio, in December 2018, a general investigation into WhatsApp’s compliance with its obligation of transparency and its obligation to provide information with regard to individuals.

In December 2020, the Irish supervisory authority submitted a draft decision to all the other national supervisory authorities concerned for their opinion. Since no consensus was reached on certain aspects of that draft, it referred the matter to the EDPB for it to resolve the dispute between the supervisory authorities concerned, by adopting a position on the matters which had been the subject of relevant and reasoned objections.

The EDPB issued a decision 3 binding on all of the supervisory authorities concerned, namely Decision 1/2021, in which it found, inter alia, that certain provisions of the GDPR had been infringed and required the Irish supervisory authority to amend the corrective measures envisaged, including the amount of the fines. On that basis, that authority issued its final decision, which was addressed to WhatsApp and which imposed on it, in particular, fines for a total amount of Eur225 million.

WhatsApp brought an action for annulment of the EDPB’s decision before the General Court. However, by its order of 7 December 2022, the General Court dismissed that action as inadmissible on the ground that the EDPB’s decision was not an act open to challenge and that that decision was not of direct concern to WhatsApp. According to the General Court, the EDPB’s decision was merely an intermediate act and WhatsApp could challenge only the final decision of the Irish supervisory authority before a national court. WhatsApp then challenged the order of the General Court by bringing an appeal before the Court of Justice.

In today's judgment, the Court of Justice declares that the EDPB's decision is indeed an act open to challenge before the Courts of the European Union. That decision is an act which emanates from an EU body and which is binding vis-àvis third parties, namely, in the present case, the Irish supervisory authority and all the other supervisory authorities concerned. Moreover, that decision definitively determines the position of that body and deals exhaustively with all the issues referred to it. Consequently, such a decision cannot be regarded as an intermediate act not open to challenge.

Read more here