WhatsApp clears fast track to EU court, reshaping how privacy cases are fought

(CN) — A clash over how WhatsApp handles personal data reached a new stage in Europe on Tuesday, after judges in Luxembourg said the messaging app can go straight to EU courts to challenge a binding decision by Europe’s data watchdog, rather than waiting for national regulators.

In its ruling, the Court of Justice of the European Union said the watchdog’s decision in a transparency dispute against WhatsApp was not just procedural but a measure that set out binding legal findings with concrete effects. Because those conclusions were fixed at the EU level, judges rejected the idea that WhatsApp had to wait for a final national enforcement decision before seeking judicial review.

The judges did not weigh in on whether WhatsApp broke Europe’s privacy rules. Instead, they redrew the procedural map, sending the dispute back to the EU’s General Court and opening the door for closer scrutiny of the bloc’s data protection board in WhatsApp’s case.

At stake is a simple but far-reaching question: How much room companies have to push back when EU bodies step in to guide enforcement of Europe’s flagship privacy law.

WhatsApp’s handling of user data came under scrutiny in 2018, after the EU’s new data protection rules, the General Data Protection Regulation, or GDPR, came into force. Later that year, Ireland’s data protection authority opened an inquiry into whether the company was complying with transparency obligations.

The regulation’s framework, designed to give people more control over their personal information, put WhatsApp’s disclosures under the microscope. Regulators questioned whether users were clearly told what data was collected, what it was used for, and how it moved within the Meta group. They also doubted whether WhatsApp’s layered notices and policy documents clarified a key regulatory distinction: The difference between data needed to run the messaging service and data processed for wider business purposes.

Because WhatsApp’s European base is in Ireland, that nation’s Data Protection Commission led the investigation. It initially found WhatsApp had fallen short of transparency rules, particularly in explaining internal data sharing. Several other national regulators disagreed, triggering a formal dispute and pushing the case to the European Data Protection Board, which steps in when regulators across the bloc clash.

In a 2021 binding decision, the board largely sided with those critics. It said WhatsApp’s explanations did not meet privacy standards and ruled so-called “lossy hashed” data, information transformed into shortened or scrambled forms that can still be linked to individuals, must be treated as personal data. The board also ordered Ireland to raise the proposed penalty.

Rather than waiting for Ireland to wrap up, WhatsApp went straight to the EU’s General Court, seeking to overturn the EU board’s decision. The lower court shut the door, treating the ruling as a preliminary step that did not change WhatsApp’s legal position, and saying any objections could be raised before Irish courts.

Europe’s highest court disagreed.

Judges at the Court of Justice of the European Union said Tuesday the EU board’s decision carried real legal force and directly affected WhatsApp’s legal situation, because it locked in EU-wide conclusions national regulators couldn’t revisit — even though Ireland would ultimately impose the final fines and corrective measures.

The court also rejected the idea that only national proceedings could guarantee effective judicial protection, noting the data privacy regulation itself allows direct challenges to board decisions before EU courts.

Gianclaudio Malgieri, an associate professor of law and technology at Leiden University, said the ruling makes the enforcement system more robust by ensuring binding EU decisions can be tested directly before EU judges.

“This judgment makes the GDPR enforcement system more defensible from an effective remedy standpoint,” Malgieri said, noting the court was aligning practice with the regulation’s own logic that some board decisions are of direct concern to companies.

At the same time, he cautioned, the ruling raises the procedural stakes. Once the board publishes a decision, if companies miss the deadline to act they could later be restricted in challenging those findings through national courts.

Others backed the court’s logic but warned it could strain enforcement of the privacy regulation.

Irene Kamara, an associate professor focusing on law and technology at Tilburg University, said the ruling sits comfortably within the EU’s broader administrative law approach but comes with trade-offs.

“EDPB decisions do have external legal effects and are therefore challengeable; from an EU law perspective this should not come as a surprise,” Kamara said. But she cautioned that because those decisions are binding on national regulators, the system needs to guard against overload. “We need to make sure that the EDPB will still be able to perform and continue doing its invaluable work, without being overwhelmed with actions from companies in bad faith.”

Not everyone welcomed the shift.

Christopher Docksey, honorary director general at the European Data Protection Supervisor and a former legal adviser on data protection to the European Commission, said the ruling could complicate how the privacy laws are enforced in practice.

“I do not think this ruling is very helpful for the consistency mechanism,” Docksey said, noting the system was built to deliver a single, enforceable outcome through nationally led supervision at the EU level.

Instead, he warned, the judges openly accept their ruling “does indeed give rise to two parallel sets of proceedings,” before EU and national courts. That, Docksey said, will “judicialize the consistency mechanism” in a way EU lawmakers likely never intended.

Others welcomed the ruling as a win for accountability.

Cédric Burton, a Brussels-based partner focusing on data, privacy and cybersecurity at global law firm Wilson Sonsini Goodrich & Rosati, called the ruling “a pivotal moment for GDPR enforcement,” saying it closes off a structural blind spot.

“The alternative the General Court endorsed would have created a serious accountability gap: An EU body making binding infringement findings shielded from direct judicial review,” Burton said. The judgment, he added, makes clear that companies must have a direct path to challenge binding conclusions with legal consequences by the European Data Protection Board.

The impact will extend beyond WhatsApp, he noted, pointing to pending cases involving Meta’s Instagram and Facebook, TikTok’s data transfer rules and challenges brought by national regulators against the board.

WhatsApp welcomed the ruling.

“The EDPB is an unelected authority whose decisions can directly impact businesses and people across the EU,” a WhatsApp spokesperson said. “The court’s judgment upholds our argument that those businesses and people should be able to challenge decisions the EDPB makes against them, so that it can be held fully accountable by the EU courts.”

The European Data Protection Board said in a statement it “stands ready to defend its decision on the merits.”

The case now returns to the General Court, where judges will take up the substance of WhatsApp’s claims about the EU board’s findings on transparency, data classification and fines.

What happens next will be closely watched by other tech giants, including Facebook and TikTok, for whom EU-level privacy enforcement increasingly begins not with a national penalty but with a fight in court.

Courthouse News reporter Eunseo Hong is based in the Netherlands.