A legal challenge against a €225 million fine imposed by Ireland's data protection authority gains support from a top EU court adviser.
WhatsApp, a messaging service owned by Meta Platforms, has received backing from an adviser to the Court of Justice of the European Union (CJEU) in its ongoing appeal against a €225 million privacy fine imposed by Ireland's data protection authority in 2021. This fine was the result of complaints regarding WhatsApp's management of personal data, and it was increased following input from the European Data Protection Board (EDPB).
In 2022, a lower tribunal had dismissed WhatsApp's legal challenge against the EDPB's decision, ruling that WhatsApp did not have the legal standing to contest the authority's findings as it was deemed not to be directly affected by the EDPB's ruling.
However, the tribunal permitted WhatsApp to pursue its challenge in a national court concerning the Irish fine.
In her recent opinion, CJEU Advocate General Tamara Capeta criticized the lower tribunal's ruling, asserting that WhatsApp's challenge against the EDPB should proceed.
She stated, "WhatsApp’s challenge of the EDPB decision is admissible, and the case should return to the General Court for a decision on its merits." While the CJEU typically follows the recommendations of its advisers, its final ruling in this matter is expected in the coming months.
The €225 million fine originated from concerns raised by Ireland’s Data Privacy Commissioner (DPC), who is responsible for overseeing data privacy for
Facebook in the EU. The authority highlighted issues with WhatsApp's compliance with EU regulations related to transparency in data processing.
Specifically, these concerns pertained to the information provided to users regarding data sharing between WhatsApp and other companies in the
Facebook portfolio.
Initially, the DPC had suggested a lesser fine of €50 million.
However, following an adjustment prompted by the EDPB, the penalty was significantly increased.
This development follows a broader pattern of scrutiny and enforcement of data protection laws across the European Union, especially pertaining to major technology firms.