WhatsApp privacy fine appeal sent back to lower EU tribunal

WhatsApp’s legal challenge against a EUR 225 million ($268 million) privacy fine has been sent back to a lower tribunal, extending a five-year dispute over one of the European Union’s largest data protection penalties.

The ruling, delivered on Tuesday by the Court of Justice of the European Union (CJEU), concerns a decision by the European Data Protection Board (EDPB) that instructed Ireland’s Data Protection Commission (DPC) to increase a fine imposed on Meta Platforms’ messaging service. 

The case stems from complaints related to WhatsApp’s handling of personal data in the EU.

Ireland’s DPC, which acts as the lead privacy regulator for many US technology firms because their European headquarters are based in the country, initially fined WhatsApp before raising the penalty in 2021 following the EDPB’s intervention.

Meta later appealed the decision at a lower tribunal but lost after judges ruled that WhatsApp did not have legal standing to challenge the EDPB’s binding decision directly.

The EU’s top court disagreed with that assessment, ruling that WhatsApp’s challenge is admissible and instructing the tribunal to examine the case on its merits. 

The CJEU said companies must be able to contest EDPB decisions in EU courts to ensure accountability.

WhatsApp welcomed the ruling, saying it supported its position that businesses affected by EDPB decisions should have access to judicial review. 

The outcome could have broader implications, as many large GDPR fines issued by Ireland’s DPC have been increased following EDPB involvement.

Since 2020, the DPC has imposed more than EUR 4 billion in GDPR fines but has collected only a fraction due to prolonged legal appeals.