In a significant development for the EU data protection enforcement landscape, the Court of Justice of the European Union ruled Meta can continue its litigation against the European Data Protection Board's decision to enforce a 225 million euro fine. The ruling paves the way for Meta to more easily challenge billions of euros worth of EU General Data Protection Regulation fines while setting precedent for other companies to more easily litigate penalties of their own.
The CJEU decision stems from Meta's challenge of a 2021 fine from Ireland's Data Protection Commission over WhatsApp transparency and data processing allegations. A binding decision by the EDPB confirmed the GDPR violations, though an Article 65 dispute resolution procedure resulted in the DPC bumping the original proposed 30 million euro penalty to 225 million euros.
The EDPB's decisions are binding for supervisory authorities. However, the CJEU found the board's decision "cannot be regarded as an intermediate act not open to challenge" because it "emanates from an EU body and which is binding vis-à-vis third parties."
Despite the EDPB's claims that its binding order did not impact the level of enforcement brought upon WhatsApp, the CJEU indicated the order "was of direct concern to WhatsApp, since it brought about a distinct change in the legal position of that undertaking, without leaving any discretion to its addressees."
Meta previously lost its initial appeal on the matter in the European General Court, which dismissed the case on both points the CJEU now confirmed. The General Court will now take up the appeal again and render a decision over enforcement penalties and whether WhatsApp's practices violated the GDPR.
In a statement to Politico, a WhatsApp spokesperson said the CJEU's decision "upholds our argument that those businesses and people should be able to challenge decisions the EDPB makes against them, so that it can be held fully accountable by the EU courts." Politico also reported that the EDPB "takes note" of the ruling and "stands ready to defend its decision on the merits."
Lexie White is a staff writer for the IAPP.