Tuesday’s ruling by the Court of Justice of the EU (CJEU) stems from a 2021 decision by the Irish Data Protection Commission (DPC) to fine WhatsApp €225 million for not being transparent enough with users about what it does with their data.
The Irish privacy regulator had originally proposed a lower fine of €30 million to €50 million, but its peers from across Europe disagreed with how the Irish authority had calculated the fine and ordered Ireland to raise the fine to €225 million.
The top court said Tuesday that decisions by Europe’s board of privacy regulators — which are technically binding on national regulators — are open to challenge by the companies affected.
“The EDPB is an unelected authority whose decisions can directly impact businesses and people across the EU,” a WhatsApp spokesperson said, adding that Tuesday’s decision “upholds our argument that those businesses and people should be able to challenge decisions the EDPB makes against them, so that it can be held fully accountable by the EU courts.”
WhatsApp appealed the EDPB decision in 2021, arguing that the board went beyond its powers when raising the fine amount.
Tuesday’s ruling is the final judgment after years of legal wrangling that previously saw the lower court, the EU’s General Court, throw out WhatsApp’s challenge. Tuesday’s decision affirms an opinion from the top court’s advocate general in March 2025.