WhatsApp v EDPB: Companies can bring a direct EU-level court challenge against a binding Board decision—rather than being forced to wait and fight only through national court proceedings.

2025-11-28 · Source: Pascal’s Substack · Field: Legal & Regulatory — Compliance & Risk Management, Litigation & Dispute Resolution, Regulatory Affairs & Government Relations · Depth: Intermediate, short

Summary

The Court of Justice of the European Union (CJEU) has ruled that companies can directly challenge binding decisions made by the European Data Protection Board (EDPB) in EU courts, rather than waiting to appeal national regulatory decisions. This ruling stems from a case where WhatsApp Ireland Ltd. sought to challenge an EDPB decision that shaped a €225 million fine imposed by the Irish Data Protection Commission for GDPR transparency breaches. The CJEU overturned an earlier General Court decision, stating that EDPB binding decisions are challengeable EU acts because they definitively settle disputed issues and directly affect a company's legal position, leaving national regulators no discretion. This procedural shift provides large multinationals with an additional litigation route at the EU level.

Key takeaway

For legal teams managing cross-border GDPR compliance, this CJEU ruling significantly alters enforcement strategy. You now have the option to directly challenge EDPB binding decisions in EU courts, potentially offering a more strategic and direct route to contest key findings before national enforcement. Be prepared for increased litigation complexity and longer resolution times, but also for clearer EU-level precedent on GDPR interpretation.

Key insights

Companies can now directly challenge EU Data Protection Board binding decisions in EU courts.

Principles

• Binding EU acts are subject to direct judicial review.
• Accountability requires challenging the real decision-maker.

In practice

• Multinationals gain a new EU-level litigation route.
• Regulators may face increased workload and legal risk.

Topics

• GDPR Enforcement
• European Data Protection Board
• EU Judicial Review
• Cross-border Data Protection
• Data Privacy Litigation

Best for: CTO, Executive, Legal Professional, Policy Maker, Business Analyst

Related on AIssential

• The EU’s Online Safety Moonshot Is Losing Altitude — Internal EU challenges, not just external opposition, are hindering the Digital Services Act's intended impact on online safety.
• When National Security Becomes a Shield for Evading AI Accountability — National security exemptions in EU AI legislation create significant regulatory gaps, enabling unchecked AI deployment.
• Europe expands regulatory crackdown on Big Tech — European regulators are actively challenging Big Tech's market dominance and privacy practices, particularly concerning AI and emerging technologies.
• Reaffirming our commitment to child safety in the face of European Union inaction — The ePrivacy derogation's expiry jeopardizes child safety by removing legal clarity for CSAM detection.
• European Digital Market: Collision of Deregulation and Defense — Europe's dual regulatory push simplifies sustainability while tightening cybersecurity, creating a complex compliance paradox.
• Getting Digital Fairness Right: EFF's Recommendations for the EU's Digital Fairness Act — Digital fairness requires prioritizing privacy and user sovereignty over expanded surveillance.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Pascal’s Substack.