On Wednesday, 29 January 2025, the General Court of the EU Court of Justice dismissed a legal challenge brought by the Irish Data Protection Commission (DPC) in three joined cases: T‑70/23, T‑84/23 and T‑111/23, against the European Data Protection Board (EDPB).
In a victory for the EDPB, the General Court ruled in favour of its 2023 binding decision, which led to the DPC issuing a €5.5 million fine to Meta-owned WhatsApp for EU General Data Protection Regulation (GDPR) violations concerning transparency and user consent.
The issue at hand relates to a decision by the EDPB directing the DPC to further investigate three specific areas of WhatsApp's data processing, rather than combining the issues without addressing the alleged individual violations.
In its January 2023 press release announcing the conclusion of its investigation into WhatsApp, the DPC stated that the "EDPB does not have a general supervision role akin to national courts in respect of national independent authorities and it is not open to the EDPB to instruct and direct an authority to engage in open-ended and speculative investigation."
The DPC went on to say that "to the extent that the direction may involve an overreach on the part of the EDPB, the DPC considers it appropriate that it would bring an action for annulment before the Court of Justice of the European Union in order to seek the setting aside of the EDPB's direction."
In this week's ruling in favour of the EDPB, the General Court confirms that the DPC must carry out the three separate investigations. Whether or not the DPC abides by the ruling or appeals the case to the CJEU is yet to be determined. In a statement given to IAPP, a DPC spokesperson said, "We note the court's decision and are currently reviewing it."
Meanwhile, in a separate statement, Austrian lawyer, privacy activist and honorary chair of the not-for-profit organisation NOYB, Max Schrems, said, "This case already has been going on for more than six years, with the DPC refusing to take action, which benefits US Big Tech. We are happy about the Court's decision to dismiss the DPC's claims, but it also means that the cases starts again from square one. Any final decision will take years before the DPC and before the Irish courts. The DPC is a master of grotesque sidesteps and loops in procedures – with the consequence that US Big Tech is never receiving a penalty."
What is this page?
You are reading a summary article on the Privacy Newsfeed, a free resource for DPOs and other professionals with privacy or data protection responsibilities helping them stay informed of industry news all in one place. The information here is a brief snippet relating to a single piece of original content or several articles about a common topic or thread. The main contributor is listed in the top left-hand corner, just beneath the article title.
The Privacy Newsfeed monitors over 300 global publications, of which more than 5,750 summary articles have been posted to the online archive dating back to the beginning of 2020. A weekly roundup is available by email every Friday.
