CJEU ruling on challenging EDPB decisions

The Court of Justice of the European Union (“CJEU”) has overturned a finding by the General Court of the European Union (the “General Court”) that WhatsApp’s challenge to a 2021 fine by the DPC was inadmissible.

This matter dates back to a 2018 investigation commenced by the DPC on foot of a cross border complaint in relation to possible breaches of transparency obligations under the GDPR. The DPC was the Lead Supervisory Authority and was required to submit its draft decision to all Concerned Supervisory Authorities, several of which disagreed with the DPC’s calculation of the fine to be imposed. The matter was therefore referred to the European Data Protection Board “(EDPB”) for dispute resolution under Article 65 of the GDPR.1 The EDPB instructed the DPC to increase the fine to €225 million (from an original range of €30-€50 million suggested by the DPC). More specific details on EDPB’s decision can be found in our previous publication DPC fines WhatsApp €225 million for transparency failing.

Whatsapp then appealed the EDPB’s decision to the General Court in WhatsApp v EDPB. The General Court found that the action was inadmissible because the decision of the EDPB was not of direct concern to WhatsApp and therefore could not be challenged directly before an EU Court. The General Court was of the view the EDBP’s decision was a decision addressed to the DPC (not to WhatsApp) which left discretion to the DPC on the implementation of the measures.

The General Court’s finding was appealed to the CJEU and a ruling was delivered on 10 February 2026. The CJEU found that General Court had erred in its decision. It found that the EDPB decision was of direct concern to WhatsApp, that it ‘brought about a distinct change in the legal position’ of Whatsapp and that it was binding on the DPC, with no opportunity for it to amend or vary the measures to be imposed. As such, the CJEU was of the view that the appeal was admissible before the General Court and referred the case back to the General Court to be heard on its merits.

Going forward, this means that data controllers who are the affected by binding decisions issued by the EDPB may be entitled to challenge these EDPB decisions directly before EU Courts.

For further information on this, please contact Partner Sean O'Donnell or Associate Saidhbhe Corbett from the Litigation and Regulation Team.