Case C-97/23 P WhatsApp Ireland v European Data Protection Board

On February 10, 2026, the Grand Chamber of the EU Court of Justice issued a ruling with potentially far-reaching implications. The EU Court of Justice ruled that the decisions and guidelines of the European Data Protection Board (EDPB) are actionable acts, reviewable by the competent court. The fact that the so-called EDPB Guidelines can be actionable acts makes it possible to challenge the content of these influential guidelines in court.

Case C-97/23 P - ECLI:EU:C:2026:81

In Case C-97/23 P - ECLI:EU:C:2026:81, WhatsApp Ireland Ltd.'s ("Whatsapp") is seeking the annulment of a decision published by the EDPB on 2 September 2021 concerning ongoing proceedings between WhatsApp and the Irish Data Protection Commission (DPC) regarding the interpretation and enforcement of transparency obligations under the GDPR. The decision, “Binding decision 1/2021 on the dispute arising from the draft decision of the Irish Supervisory Authority regarding WhatsApp Ireland under Article 65(1)(a) GDPR”, is also known as EDPB Decision 01/2021. In the case, the EDPB argued that WhatsApp was inadmissible because EDPB decisions and guidelines are not subject to judicial review, as these guidelines constitute policy aimed at harmonizing interpretations of national supervisory authorities, not law. The EDPB itself is not a competent supervisory authority of a Member State with enforcement powers, nor is it an executive body of the EU, but rather a collaborative network for consultation between the competent supervisory authorities, the EDPB argued.

Initially, the Court of Justice of the EU ruled that an attempt by WhatsApp Ireland Ltd. (“Whatsapp”) to request the annulment of EDPB Decision 01/2021 was indeed inadmissible, as argued by the EDPB.

Whatsapp appeal

Now, following an appeal by WhatsApp, the Grand Chamber of the Court of Justice of the EU has ruled that WhatsApp Ireland Ltd.'s ("Whatsapp") appeal against EDPB Decision 1/2021 is admissible. The Grand Chamber of the Court of Justice of the EU examined Article 263 of the Treaty on the Functioning of the European Union ("TFEU"), which provides:

“Any natural or legal person may, under the conditions laid down in the first and second paragraphs, institute proceedings against an act addressed to that person or which is of direct and individual concern to them, and against a regulatory act which is of direct concern to them and does not entail implementing measures.”

According to WhatsApp, it is a legal entity directly and individually affected by EDPB Decision 01/2021 and is therefore entitled to seek annulment from the Court of Justice of the EU.

Direct and individual

The Grand Chamber of the Court of Justice of the EU considers in the case:

“92 Thus, the admissibility of an action brought by a natural or legal person against an act which is not addressed to that person, in accordance with the fourth paragraph of Article 263 TFEU, is subject, inter alia, to the condition that that act is of direct and individual concern to that person (judgment of 3 December 2019, Iccrea Banca, C-414/18, EU:C:2019:1036, paragraph 64 and the case-law cited).

[…]

94 It must be borne in mind in that regard that, according to settled case-law, the condition that a natural or legal person must be directly concerned by the decision which that person is contesting requires that two cumulative conditions be satisfied, namely that the measure being contested, first, directly affects the legal situation of that person and, second, leaves no discretion to the addressees who are entrusted with the task of implementing it, such implementation being purely automatic and resulting solely from EU provisions without the application of other intermediate rules (judgment of 4 October 2024, Commission and Council v Front Polisario, C-779/21 P and C-799/21 P, EU:C:2024:835, paragraph 87 and the case-law cited)”

So, according to settled case law, the two criteria to challenge an act at the EU level like a decision by the EDPB or other EU bodies on the basis of ‘direct and individual concern’ which have to be met to contest a measure are 1) the decision directly affects the legal position of the natural or legal person, and 2) the act leaves no discretionary authority to the, national level, addressees of the EU act, for example due to maximum harmonization.

According to the Grand Chamber of the Court of Justice of the EU, the intention and effect of EDPB Decision 01/2021 are to have legal effects on WhatsApp’s legal position in its ongoing proceedings before the Irish Data Protection Commission (DPC), partly because the competent Irish supervisory authority is bound by EDPB decisions and does not have the discretion to deviate from them at the Irish national level. Against which WhatsApp is entitled to legal remedies. As, in this case, the two cumulative criteria are met.

EDPB Guidelines

The EDPB Guidelines are developed and published by the EDPB. The European Data Protection Board is designated in the GDPR. The EDPB consists of the chairs of all data protection authorities in the EU Member States; in the Netherlands, the competent supervisory authority is the Dutch Data Protection Authority (‘Autoriteit Persoonsgegevens’).

The EDPB Guidelines are crucial guidance for the interpretation and application of statutory provisions under the General Data Protection Regulation ("GDPR"). Many obligations in the law are phrased in relatively general terms, as the law universally applies. However, the guidelines can focus on specific topics or sectors and thus provide much more detailed explanation. Many statutory obligations attributed to the GDPR actually originate from an EDPB Guideline on the interpretation and application of certain statutory provisions.

Strict interpretation

For companies and organizations, an interpretation in a guideline issued by a competent supervisory authority can be extremely detrimental. This is especially true if the competent supervisory authority has a stricter interpretation of the legal requirements than necessarily follows from the text of the statute or case law. In the Netherlands, the national supervisory authority has previously been reprimanded by the courts for an overly strict interpretation of the law in a published guideline. We previously wrote:

https://www.wisemen.nl/nl/artikelen/commerciele-belangen-als-avg-grondslag-hof-van-justitie-doet-uitspraak

Implications

EDPB Guidelines and other decisions by the EDPB are therefore subject to judicial review. If any parties are affected by such decisions in a " direct and individual concern" manner within the meaning of Article 263 of the Treaty on the Functioning of the European Union ("TFEU"), legal recourse is possible. The consequences of this ruling could have a significant impact on the future development of privacy and data protection law, even if WhatsApp ultimately loses the main proceedings it is now allowed to initiate. It is advisable to monitor these developments closely.

Questions?

Wondering what this ruling means for you or your organization? Do you have questions about privacy or data protection law? Do you have questions about the do's and don'ts of e-privacy regulations? Contact our IT & Privacy Law team today. They're happy to help.