On 7 December 2022, the EU Court of Justice (ECJ) issued its judgment in Case C-709/21, (WhatsApp Ireland Ltd v. EDPB), dismissing as inadmissible the claim by WhatsApp against a decision of the European Data Protection Board (EDPB). Following an investigation, the Irish Data Protection Authority (DPA) submitted a draft decision to all the other supervisory authorities (SAs) of the EU Member States concerned by the processing and, since no consensus was reached, the matter was referred to the EDPB. Therefore, the EDPB adopted a decision, binding on all the SAs concerned, in light of which the Irish DPA, on 20 August 2021, imposed corrective measures and sanctions on WhatsApp for a cumulative amount of 225 million euros for infringing the principle and the obligations of transparency laid down in Article 5(1)(a), Article 12(1), Article 13(1)(c), (d), (e) and (f), Article 13(2)(a), (c) and (e) and Article 14 of the GDPR. The ECJ declared the action brough by WhatsApp inadmissible on the ground that, on the one hand, EDPB decisions do not fall within the scope of Article 263 TFUE (i.e. acts eligible for GC legality review) and, on the other hand, the EDPB decision is not directly enforceable against WhatsApp since it was not addressed to WhatsApp but rather to the Irish DPA. The ECJ also specified that, according to the TFEU system of judicial remedies, the Irish DPA decision may be pleaded before a national court which, in turn, is able to make a request to the ECJ for a preliminary ruling.
