On 10 February 2026, the Court of Justice of the European Union (CJEU) delivered a landmark judgment in WhatsApp Ireland v European Data Protection Board (Case C-97/23 P), fundamentally reshaping how GDPR enforcement decisions may be challenged within the European Union.
The judgment marks a significant development in EU data protection law, as it confirms that binding decisions of the European Data Protection Board (EDPB) may, under certain conditions, be challenged directly before the EU courts.
A. Background to the Case
The dispute originates from an investigation launched in 2018 by the Irish Data Protection Commission (DPC) into WhatsApp Ireland’s compliance with the General Data Protection Regulation (GDPR). Acting as lead supervisory authority, the Irish DPC circulated a draft decision to other EU supervisory authorities under the GDPR’s cooperation and consistency mechanism.
As disagreements persisted among the authorities, the matter was referred to the EDPB for dispute resolution. In July 2021, the EDPB adopted a binding decision finding that WhatsApp had infringed several GDPR provisions and instructing the Irish DPC to increase the proposed administrative fines. This ultimately resulted in a €225 million fine imposed on WhatsApp.
B. The Procedural Question
WhatsApp sought to challenge the EDPB’s binding decision directly before the EU General Court. However, the General Court dismissed the action as inadmissible, holding that the EDPB’s decision did not directly produce legal effects vis-à-vis WhatsApp and could only be challenged indirectly through national enforcement proceedings.
This approach reflected the long-standing position that companies affected by GDPR enforcement had to contest national supervisory authority decisions before domestic courts, even where those decisions were strictly dictated by the EDPB.
C. The CJEU’s Ruling
The CJEU overturned the General Court’s order, holding that the EDPB’s binding decision did directly affect WhatsApp’s legal position.
The Court emphasised that:
- The EDPB definitively determined that WhatsApp had breached GDPR obligations;
- National supervisory authorities had no discretion to depart from the EDPB’s conclusions;
- The decision required WhatsApp to alter its contractual and data-processing arrangements with users.
As a result, the CJEU concluded that WhatsApp was directly concerned within the meaning of EU procedural law and was therefore entitled to bring an annulment action directly before the EU courts. The case has now been referred back to the General Court for a ruling on the merits.
D. Why This Decision Matters
This judgment has far-reaching implications for GDPR enforcement and regulatory litigation:
- Direct judicial scrutiny of the EDPB: Binding EDPB decisions are no longer shielded from direct EU court review.
- Enhanced procedural rights for organisations: Companies may challenge the legal reasoning and proportionality of EDPB decisions without first litigating at national level.
- Increased accountability and consistency: The ruling reinforces judicial oversight over EU-level regulatory bodies exercising decisive enforcement powers.
For multinational organisations subject to cross-border GDPR investigations, this decision fundamentally alters enforcement strategy and litigation risk assessment.
E. How We Can Assist You
At Andria Papageorgiou Law Firm, we advise businesses on all aspects of data protection and regulatory compliance, with particular focus on GDPR governance, cross-border enforcement, and regulatory risk management. We support clients in navigating complex interactions with supervisory authorities, assessing enforcement exposure, and implementing robust data protection frameworks aligned with EU requirements.
In addition to advisory and compliance services, our Managing Director, Mrs Andria Papageorgiou, is a certified trainer by the Human Resource Development Authority (HRDA) and delivers GDPR training programmes tailored to management, compliance teams, and operational staff. Through a combination of legal expertise and practical training, we assist organisations in strengthening internal procedures, enhancing accountability, and maintaining sustainable GDPR compliance in an evolving regulatory landscape.
Should you wish to discuss how these developments may affect your organisation, please do not hesitate to contact us.
Disclaimer: The information contained in this article is provided for informational purposes only, and should not be construed as legal advice on any matter. Andria Papageorgiou Law Firm is not responsible for any actions (or lack thereof) taken as a result of relying on or in any way using information contained in this article and in no event shall be liable for any damages resulting from reliance on or use of this information.
