Order of the General Court Fourth Chamber, Extended Composition, 7 December 2022, WhatsApp Ireland Ltd v European Data Protection Board, T-709/21
| Date | 07 December 2022 |
| Year | 2022 |
10
additional interference with fundamental rights resulting from such activity may be particularly
intense owing to the aggregation, in a search by name, of all information concerning the data subject
which is found on the internet. In the context of that autonomous assessment, account must be taken
of the fact that that display constitutes, in itself, the result sought by the internet user, regardless of
his or her subsequent decision to access the original internet page or not.
The Court observes, however, that such a specific weighing-up exercise, which takes account of the
autonomous nature of the data processing performed by the operator of the search engine, is
without prejudice to the possible relevance of text elements which may directly accompany the
display of a photograph in the list of search results, since such elements are capable of casting light
on the informative value of that photograph for the public and, consequently, of influencing the
weighing-up of the rights and interests involved.
Order of the General Court (Fourth Chamber, Extended Composition), 7 December 2022,
WhatsApp Ireland Ltd v European Data Protection Board, T-709/21
Link to the full text of the order
Action for annulment – Protection of personal data – Draft decision of the lead supervisory authority –
Resolution of disputes between supervisory authorities by the European Data Protection Board – Binding
decision – Article 60(4) and Article 65(1)(a) of Regulation (EU) 2016/679 – Act not open to challenge –
Preparatory act – Lack of individual concern
Following the entry into force of the GDPR,
9
the Data Protection Commission (Ireland) received
complaints from users and non-users of the ‘WhatsApp’ messaging service concerning the processing
of personal data by WhatsApp Ireland Ltd (‘WhatsApp’). Against that background, that Irish
supervisory authority, in its capacity as lead supervisory authority,
10
initiated of its own volition a
general investigation into WhatsApp’s compliance with the obligation of transparency and the
obligation to provide information with regard to individuals.
Following that investigation, under the cooperation mechanism established by the GDPR, the Irish
supervisory authority submitted a draft decision to all the other supervisory authorities of the
Member States concerned by the processing of personal data at issue for their opinion. Since no
consensus was reached on that draft, the Irish supervisory authority referred the matter to the
European Data Protection Board (EDPB)
11
adopted a decision that was binding on all the supervisory authorities concerned, in which it ruled on
the matters which, in its view, had been the subject of relevant and reasoned objections by some of
those authorities (‘the contested decision’).
12
After receiving that decision, the Irish supervisory
authority adopted a final decision on 20 August 2021, in which it found, inter alia, that WhatsApp had
administrative fines for a cumulative amount of EUR 225 million.
9
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to
the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection
Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’).
10
Under Article 56(1) of the GDPR, which grants, inter alia, competence to act on the supervisory authority of the main establishment of the
controller for the cross-border processing carried out by that controller.
11
Under Article 68(3) of the GDPR, the EDPB is composed of the head of one supervisory authority of each Member State and of the European
Data Protection Supervisor, or their respective representatives.
12
Binding Decision 1/2021 of the EDPB.
To continue reading
Request your trial