In her Opinion of March 27, 2025 (Case C-97/23 P - WhatsApp/EDPB), AG Ćapeta recommends the CJEU declare admissible WhatsApp's action for annulment against an EDPB binding decision issued under GDPR Art. 65. The EU General Court (EGC) had previously dismissed the case as inadmissible. The AG argues such EDPB decisions are challengeable acts under Art. 263(1) TFEU because they are legally binding on the national supervisory authority (a third party) and represent the EDPB's final position on the referred dispute. WhatsApp is also directly concerned under Art. 263(4) TFEU, as the decision directly impacts its legal position and leaves the national authority no discretion regarding the implementation of the EDPB's specific findings.
Why does this matter?
If the CJEU agrees, not only can companies directly challenge the EDPB's key directives at the EU level, but according to the TWD case law, they likely must do so to preserve their rights. Failure to bring a timely direct action could preclude challenging the validity of the EDPB's binding points later in national proceedings against the DPA's final decision (regarding those aspects mandated by the EDPB). This directly impacts litigation strategy for affected companies.
What are the practical implications of this Opinion?
Should the CJEU follow the Advocate General, this would have significant practical consequences, notably accelerating legal clarification at the EU level. Allowing binding EDPB decisions under Art. 65 GDPR to be challenged directly before the General Court (EGC) would enable companies to seek timely review of the EDPB's key directives. This avoids potentially waiting years for national proceedings to conclude before a final instance court might make a preliminary reference under Art. 267 TFEU. Furthermore, following the TWD Textilwerke Deggendorf case law, direct action is often not merely an option but a necessity. Only by lodging a timely action for annulment with the EGC can companies ensure they preserve their right to challenge the validity of the EDPB decision when later contesting the subsequent national decision based upon it (regarding those parts mandated by the EDPB decision).
This is vital because national courts cannot annul EU acts, and the possibility of an indirect challenge via a preliminary reference on validity (Art. 267 TFEU) might be precluded if a direct action under Art. 263 TFEU was possible but the deadline was missed. Practitioners advising companies facing Art. 65 EDPB decisions impacting them negatively should therefore strongly consider filing a timely action for annulment at the General Court, potentially in parallel with appealing the final national decision domestically, to preserve all legal challenges. The AG's clear separation of the tests for a 'challengeable act' (Art. 263(1)) and 'direct concern' (Art. 263(4)), and her analysis of the implementing authority's lack of discretion, offer important guidance for navigating multi-stage administrative procedures in EU law.
What was the background?
The case originated from complaints about WhatsApp Ireland's 2018 privacy policy update. The Irish Data Protection Commission (DPC), acting as lead supervisory authority (LSA), investigated potential breaches of GDPR transparency obligations (Articles 12-14). As required by the GDPR's consistency mechanism (Art. 60), the DPC submitted its draft decision to other concerned supervisory authorities (CSAs) across the EU. Several CSAs, including those from Germany, France, and Italy, raised relevant and reasoned objections to the DPC's draft, which the DPC did not agree with.
Consequently, the DPC referred the unresolved objections to the European Data Protection Board (EDPB) for dispute resolution under Article 65 GDPR. On July 28, 2021, the EDPB adopted Binding Decision 1/2021. This decision instructed the DPC to modify its draft findings substantially. Key changes included classifying 'lossy hash data' as personal data, identifying additional GDPR infringements (under Art. 5, 13, 14), and requiring a significant increase in the financial penalty. The DPC was legally bound by this decision and incorporated these changes into its final national decision issued on August 20, 2021. WhatsApp then brought an action for annulment directly against the EDPB's decision before the EU General Court (EGC). However, the EGC dismissed this action as inadmissible in its Order of December 7, 2022 (T-709/21), reasoning that the EDPB decision was not a challengeable act under Art. 263(1) TFEU and did not directly concern WhatsApp under Art. 263(4) TFEU. WhatsApp appealed this order to the Court of Justice (CJEU).
What did the Advocate General propose?
Advocate General Ćapeta proposes that the CJEU should uphold WhatsApp's appeal, set aside the General Court's order, and declare WhatsApp's action for annulment admissible. Her main legal arguments are:
Challengeable Act (Art. 263(1) TFEU)
An EDPB binding decision under Art. 65 GDPR is a challengeable act. It represents the EDPB's final position and produces binding legal effects externally, on the LSA. The EGC wrongly focused on its "intermediate" nature or lack of direct enforceability against WhatsApp.
Direct Concern (Art. 263(4) TFEU)
WhatsApp is directly concerned. The EDPB decision directly affects WhatsApp's legal situation (infringement findings, basis for higher fine). The LSA has no discretion regarding the implementation of the points decided by the EDPB; implementation was automatic for those aspects. The EGC's considerations about enforceability, the measure not being the "final step", or the LSA's discretion on *other* matters were erroneous.
System of Remedies
The logic of the EU judicial system, particularly the TWD case law, necessitates allowing a direct action when standing requirements are met. Failing to bring a direct action within the time limit when possible can preclude later indirect challenges to the act's validity before national courts.
