WhatsApp v EDPB: a binding EDPB dispute resolution decision can be challenged directly before the EU courts

What it is about

Question: can a company directly challenge before the General Court a binding EDPB decision (Article 65) that settled a dispute between supervisory authorities and required the Irish authority to increase the fine (ultimately EUR 225 million)? Ruling: yes. Such a decision emanates from an EU body, is intended to produce legal effects for third parties and is of direct concern to WhatsApp. The General Court's order declaring the action inadmissible is set aside and the case referred back for a decision on the merits.

What this means in practice

For organisations under the one-stop-shop mechanism there is an extra route: besides appealing the national final decision you can challenge the binding EDPB decision itself before the General Court. Watch the two month time limit after notification or publication of such a decision. This makes the EDPB's role in cross-border enforcement subject to judicial review and may affect the outcome of pending fine cases.

The GDPR articles concerned

• Article 60: Cooperation between the lead supervisory authority and the other supervisory authorities concerned
• Article 63: Consistency mechanism
• Article 65: Dispute resolution by the Board
• Article 78: Right to an effective judicial remedy against a supervisory authority