In a landmark procedural ruling, the Court of Justice of the EU has declared that Binding Decision 1/2021 by the European Data Protection Board (EDPB) is an act that can be directly challenged in EU courts. The decision set aside a previous ruling by the General Court, which had dismissed WhatsApp's case as inadmissible.
The case stems from a 2021 EDPB ruling that settled a dispute between national data authorities, concluding WhatsApp had violated GDPR transparency rules. This binding decision led the Irish Data Protection Commission to issue a final ruling against WhatsApp, including a €225 million fine. The Court of Justice found the EDPB's decision was not a mere intermediate step but a definitive act that directly and unconditionally changed WhatsApp's legal position, allowing the company to challenge it directly before the EU's General Court.
In short: The Court did NOT decide if WhatsApp violated the GDPR. It decided that WhatsApp has the right to sue the EDPB over its decision, and now the lower court must hear that lawsuit on its factual and legal substance.
Read more: https://curia.europa.eu/site/upload/docs/application/pdf/2026-02/cp260011en.pdf
Facts to takeaway
• Broadened Legal Recourse: The ruling confirms that binding EDPB decisions are open to direct legal challenge by companies, strengthening judicial oversight of the EU's data protection governance.
• EDPB Accountability Elevated: The EDPB's rulings are now firmly established as reviewable acts of an EU body, increasing its accountability but also potentially inviting more litigation.
• Case Continues: The substantive issue of whether WhatsApp actually infringed GDPR transparency rules has not been decided. The case is referred back to the General Court to rule on the merits.
