EU Court Adviser Sides with WhatsApp in Privacy Watchdog Dispute Over 2021 Penalty

• The CJEU Advocate General backed WhatsApp in an ongoing dispute regarding an alleged GDPR breach.
• Meta’s messaging company questions the balance of powers between national data protection authorities and the overarching EDPB framework.
• CJEU said the lower tribunal erred in its analysis, and the company’s challenge of the EDPB decision is admissible.

Meta Platforms' WhatsApp received support in its ongoing legal battle with the European Union's privacy watchdog over a 2021 fine amounting to €225 million ($242.2 million) for alleged data privacy violations. 

The fine was imposed by Ireland's Data Protection Commission (DPC) following complaints about WhatsApp's misuse of personal data in Ireland. Subsequently, the European Data Protection Board (EDPB) intervened, urging the DPC to impose a stricter penalty.

After a lower tribunal ruled in 2022 that WhatsApp could not directly challenge the EDPB due to a lack of legal standing, the company pursued its case with the Court of Justice of the European Union (CJEU), according to Reuters. 

The stakes intensified as WhatsApp sought to address what it viewed as procedural overreach by the EDPB.

This week, the CJEU Advocate General backed WhatsApp, asserting that the lower tribunal erred in its analysis, saying the company’s challenge of the EDPB decision is admissible.  

The opinion bolsters WhatsApp’s standing in the case, although a final ruling from the CJEU, expected in the coming months, will ultimately determine the outcome. Historically, the CJEU adheres to the recommendations of its advisers in approximately 80% of cases.  

WhatsApp’s argument revolves around the process through which the enhanced penalty was determined, questioning the balance of powers between national data protection authorities and the overarching EDPB framework.

With an evolving regulatory landscape, rulings like this one could significantly shape the future of privacy oversight for enterprises operating within the EU. A ruling in favor of WhatsApp might redefine how companies challenge penalties enacted under GDPR while potentially limiting the EDPB’s role in influencing national-level decisions.