(AGENPARL) - Roma, 10 Febbraio 2026 - (AGENPARL) – Tue 10 February 2026 PRESS RELEASE No 11/26
Luxembourg, 10 February 2026
Judgment of the Court in Case C-97/23 P | WhatsApp Ireland v European Data Protection Board
GDPR: the action brought by WhatsApp Ireland against Binding
Decision 1/2021 of the European Data Protection Board is admissible
That decision being an act open to challenge which is of direct concern to that undertaking, the Court of Justice
sets aside the order of the General Court and refers the case back to that court so that it may rule on the
merits
The Court of Justice finds that a binding decision of the European Data Protection Board (EDPB) settling a dispute
between several national supervisory authorities concerning whether a data controller has infringed the General
Data Protection Regulation (GDPR) 1 and, if that is the case, as appropriate, to amend the corrective measures
envisaged against that controller constitutes an act open to challenge before the Courts of the European Union.
That decision emanates from an EU body and is intended to produce legal effects vis-à-vis third parties. In addition,
in the present case, the Court holds that the decision at issue is of direct concern to WhatsApp Ireland Ltd
(‘WhatsApp’). Since WhatsApp’s action for annulment is admissible but the General Court of the European Union has
not yet examined the merits of the case, the Court sets aside the order under appeal and refers the case back to the
General Court.
Following the entry into force of the GDPR, the Irish supervisory authority, namely, the Data Protection Commission,
received complaints from users and non-users of the ‘WhatsApp’ messaging service concerning the processing of
personal data by that undertaking. That authority initiated ex officio, in December 2018, a general investigation into
WhatsApp’s compliance with its obligation of transparency and its obligation to provide information with regard to
individuals.
In December 2020, the Irish supervisory authority submitted a draft decision to all the other national supervisory
authorities concerned for their opinion. 2 Since no consensus was reached on certain aspects of that draft, it
referred the matter to the EDPB for it to resolve the dispute between the supervisory authorities concerned, by
adopting a position on the matters which had been the subject of relevant and reasoned objections.
The EDPB issued a decision 3 binding on all of the supervisory authorities concerned, namely Decision 1/2021, in
which it found, inter alia, that certain provisions of the GDPR had been infringed and required the Irish supervisory
authority to amend the corrective measures envisaged, including the amount of the fines. On that basis, that
authority issued its final decision, which was addressed to WhatsApp and which imposed on it, in particular, fines for
a total amount of € 225 million.
WhatsApp brought an action for annulment of the EDPB’s decision before the General Court. 4 However, by its order
of 7 December 2022, 5 the General Court dismissed that action as inadmissible on the ground that the EDPB’s
decision was not an act open to challenge and that that decision was not of direct concern to WhatsApp. According
to the General Court, the EDPB’s decision was merely an intermediate act and WhatsApp could challenge only the
final decision of the Irish supervisory authority before a national court. WhatsApp then challenged the order of the
Communications Directorate
Press and Information Unit
curia.europa.eu
General Court by bringing an appeal before the Court of Justice.
In today’s judgment, the Court of Justice declares that the EDPB’s decision is indeed an act open to challenge
before the Courts of the European Union. That decision is an act which emanates from an EU body and which is
binding vis-à-vis third parties, namely, in the present case, the Irish supervisory authority and all the other
supervisory authorities concerned. Moreover, that decision definitively determines the position of that body and
deals exhaustively with all the issues referred to it. Consequently, such a decision cannot be regarded as an
intermediate act not open to challenge.
Furthermore, the Court notes that that decision was of direct concern to WhatsApp, since it brought about a
distinct change in the legal position of that undertaking, without leaving any discretion to its addressees. That
decision unconditionally binds the supervisory authorities concerned, in particular as regards the finding of
infringement of certain provisions of the GDPR, and those authorities cannot change its result.
WhatsApp’s action is thus declared admissible and the order of the General Court is set aside. The Court refers
the case back to the General Court for it to rule on the merits, including on whether WhatsApp infringed the relevant
provisions of the GDPR.
NOTE: An appeal, on a point or points of law only, may be brought before the Court of Justice against a judgment or
order of the General Court. In principle, the appeal does not have suspensive effect. If the appeal is admissible and
well founded, the Court of Justice sets aside the judgment of the General Court. Where the state of the proceedings
so permits, the Court of Justice may itself give final judgment in the case. Otherwise, it refers the case back to the
General Court, which is bound by the decision given by the Court of Justice on the appeal.
Unofficial document for media use, not binding on the Court of Justice.
The full text and, as the case may be, an abstract of the judgment is published on the CURIA website on the day of
delivery.
Stay Connected!
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data (General Data Protection Regulation).
In accordance with Article 60(3) of the GDPR.
Under Article 65(1) of the GDPR.
Under Article 263 TFEU.
Order of 7 December 2022, WhatsApp Ireland v European Data Protection Board T-709/21 (See also Press release No 196/22).
Communications Directorate