European Court of Justice Raises New Hope for WhatsApp in GDPR Fine Dispute

The European Court of Justice (ECJ) has signaled potential relief for WhatsApp in its ongoing conflict regarding a substantial GDPR fine amounting to EUR225 million. Tamara Capeta, the Advocate General of the ECJ, has expressed concerns regarding the process that led to this record penalty.

In her recent conclusions, Capeta has urged the court to consider WhatsApp's appeal against the fine as valid. She argues that the lower court made significant errors by not adequately assessing the messenger service's arguments. As a result, she advocates for a re-evaluation of the case under different premises.

This legal battle has persisted for several years. In August 2021, the Irish Data Protection Commission (DPC) imposed the record fine on WhatsApp Ireland, a subsidiary of Meta Platforms, citing the company's lack of transparency in sharing user data with Facebook. WhatsApp has contested the penalty, deeming it excessive, and has pursued legal action not only in Ireland but also at the EU General Court (EGC). However, the EGC dismissed WhatsApp's complaint in late 2022, deeming it inadmissible.

The intricacies of the case arise from the DPC's initial draft, which included investigation findings and penalty recommendations that were contentious among national supervisory authorities in the EU member states. Consequently, the matter was escalated to the European Data Protection Board (EDPB), which issued a binding decision for all involved data protection authorities in 2021. Following this, the DPC announced its final verdict. Historically, the DPC has faced criticism for being a bottleneck in the enforcement of GDPR regulations, often being overruled in EDPB coordination processes. The EGC ruled that the EDPB's decision was not subject to appeal, meaning WhatsApp was only directly affected by the DPC's ruling.

WhatsApp has since appealed this EGC decision to the ECJ (case number C-97/23P). Advocate General Capeta now argues for the complete annulment of the lower court's ruling, asserting that the EDPB's decision is indeed subject to challenge in EU courts. She criticizes the EGC for inadequately assessing the grounds for annulment claims, focusing instead on whether the EDPB's decision was the final word in the coherence process outlined in the GDPR.

The Advocate General's recommendations are not binding; however, the ECJ often aligns with such opinions. If the court adopts her suggestions, the implications could be substantial. The case raises critical questions about the EDPB's authority in enforcing GDPR compliance and examines whether Meta Platforms has unlawfully processed user data for advertising purposes without proper consent as outlined in Article 6 of the GDPR.

Previously, the DPC sought to approve Meta's approach to data mining as a legitimate service for users, a position that the EDPB contested. The EGC reinforced the EDPB's position in January, emphasizing the need to resolve ongoing disagreements among data protection authorities through the EDPB's coordination procedures.