WhatsApp Ireland Ltd v European Data Protection Board.

• Jurisdiction: European Union
• ECLI: ECLI:EU:T:2022:783
• Date: 07 December 2022
• Docket Number: T-709/21
• Celex Number: 62021TO0709
• Court: General Court (European Union)

ORDER OF THE GENERAL COURT (Fourth Chamber, Extended Composition)

7 December 2022 (*)

(Action for annulment – Protection of personal data – Draft decision of the lead supervisory authority – Resolution of disputes between supervisory authorities by the European Data Protection Board – Binding decision – Article 60(4) and Article 65(1)(a) of Regulation (EU) 2016/679 – Act not open to challenge – Preparatory act – Lack of individual concern)

In Case T‑709/21,

WhatsApp Ireland Ltd, established in Dublin (Ireland), represented by H.-G. Kamann, F. Louis, A. Vallery, lawyers, P. Nolan, B. Johnston, C. Monaghan, Solicitors, P. Sreenan, D. McGrath, Senior Counsel, C. Geoghegan and E. Egan McGrath, Barristers-at-Law,

applicant,

v

European Data Protection Board, represented by I. Vereecken and G. Le Grand, acting as Agents, and by G. Ryelandt, E. de Lophem and P. Vernet, lawyers,

defendant,

THE GENERAL COURT (Fourth Chamber, Extended Composition),

composed, at the time of deliberation, of S. Gervasoni, President, L. Madise (Rapporteur), P. Nihoul, R. Frendo and J. Martín y Pérez de Nanclares, Judges,

Registrar: E. Coulon,

having regard to the written part of the procedure, namely:

– the application lodged at the Court Registry on 1 November 2021,

– the defence lodged at the Court Registry on 1 February 2022,

– the reply lodged at the Court Registry on 9 May 2022,

– the rejoinder lodged at the Court Registry on 18 July 2022,

– the measure of organisation of procedure by which the Court asked the parties, in the reply and the rejoinder, not to omit to define their position on all of the important matters concerning the jurisdiction of the Court and the admissibility of the action,

makes the following

Order

1 By its action under Article 263 TFEU, the applicant, WhatsApp Ireland Ltd (‘WhatsApp’), seeks the annulment of Binding Decision 1/2021 of the European Data Protection Board (‘the EDPB’) of 28 July 2021 on the dispute between the supervisory authorities concerned arising from the draft decision regarding WhatsApp drawn up by the Data Protection Commission (Ireland) (‘the Irish supervisory authority’) (‘the contested decision’).

Facts prior to and subsequent to the contested decision and procedure

2 Following the entry into force of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1), the Irish supervisory authority received complaints from users and non-users of the ‘WhatsApp’ messaging service concerning the processing of personal data by WhatsApp. The German federal supervisory authority also requested the assistance of the Irish supervisory authority in relation to WhatsApp’s compliance with the obligations of transparency incumbent on controllers of personal data as regards any sharing of such data with other entities in the Facebook group (renamed Meta in September 2021).

3 In December 2018, the Irish supervisory authority initiated of its own volition a general investigation into WhatsApp’s compliance with the obligation of transparency and the obligation to provide information with regard to individuals (as opposed to undertakings) laid down in Articles 12, 13 and 14 of Regulation 2016/679, without prejudice to the action it might take on the individual complaints or requests made to it. The Irish supervisory authority acted in that regard as ‘lead supervisory authority’, as provided for in Article 56(1) of Regulation 2016/679, since WhatsApp had its main establishment in Ireland as the controller for the operations of the ‘WhatsApp’ messaging service in Europe, and the processing carried out by it was of a cross-border nature.

4 After the investigation phase was completed in September 2019 with the submission of a final report by the investigator, the decision-maker of the Irish supervisory authority, following intermediate procedural phases during which WhatsApp provided its observations, submitted a draft decision in December 2020 to all the other supervisory authorities involved in the case, namely all the other supervisory authorities of the Member States, for their opinion, in accordance with the provisions of Article 60(3) of Regulation 2016/679.

5 In January 2021, eight of those supervisory authorities, namely the German federal supervisory authority and the Baden-Württemberg, Hungarian, Netherlands, Polish, French, Italian and Portuguese supervisory authorities, expressed objections to certain aspects of that draft decision. In addition, various supervisory authorities provided comments. The Irish supervisory authority issued a composite response to the other supervisory authorities concerned, proposing compromise positions. Although, following that response, one of those authorities withdrew one of its objections, the Irish supervisory authority found that a consensus had not been reached among the supervisory authorities concerned on its proposals concerning the other aspects objected to and it decided to reject all those objections in order to refer the matter to the EDPB for it to resolve the dispute between the supervisory authorities concerned on those aspects, in accordance with Article 60(4) and Article 65(1)(a) of Regulation 2016/679.

6 In May 2021, after sending it all the documents exchanged in that regard, the Irish supervisory authority received WhatsApp’s written observations on the matters discussed between the supervisory authorities concerned and in turn forwarded those observations to the EDPB so that it could take them into consideration in the dispute resolution procedure, which the Irish supervisory authority launched in June 2021.

7 The EDPB, which, under Article 68(3) of Regulation 2016/679, is composed ‘of the head of one supervisory authority of each Member State and of the European Data Protection Supervisor, or their respective representatives’, adopted the contested decision on 28 July 2021 by a two-thirds majority, in accordance with Article 65(2) of Regulation 2016/679. The contested decision is a decision addressed to the lead supervisory authority and all the supervisory authorities concerned and binding on them, as provided for in that provision, and concerns all the matters which have been the subject of relevant and reasoned objections, as provided for in Article 65(1)(a) of Regulation 2016/679. In that regard, in the contested decision, the EDPB first examined whether each objection raised by a supervisory authority concerned was relevant and reasoned. It took a position on an objection only if it was first deemed to be relevant and reasoned.

8 After the Irish supervisory authority had received the contested decision and was provided with observations from WhatsApp regarding the fines which it ultimately intended to impose on WhatsApp in the light of the contested decision, on 20 August 2021 the decision-maker of that authority adopted, in accordance with Article 65(6) of Regulation 2016/679, a final decision addressed to WhatsApp (‘the final decision’). In the final decision, WhatsApp is found to have infringed the principle and the obligations of transparency laid down in Article 5(1)(a), Article 12(1), Article 13(1)(c), (d), (e) and (f), Article 13(2)(a), (c) and (e) and Article 14 of Regulation 2016/679. Conversely, it is stated therein that WhatsApp complied with the obligations laid down in Article 13(1)(a) and (b) and Article 13(2)(b) and (d) of Regulation 2016/679. By way of corrective measures adopted on the basis of Article 58(2)(b), (d) and (i) of Regulation 2016/679, in the final decision, WhatsApp was issued a reprimand as well as an order to implement a number of actions, listed in an annex, intended to bring it into compliance, within a period of three months, with the provisions of Regulation 2016/679 that were infringed, and four administrative fines in relation to infringements of Article 5(1)(a) and Articles 12, 13 and 14 of Regulation 2016/679, for a total amount of EUR 225 million.

9 In the final decision, the decision-maker of the Irish supervisory authority identified the aspects in respect of which the contested decision required it to review the assessment set out in the draft decision referred to in paragraph 4 above. In relation to those aspects, it decided to reproduce, in shaded boxes, the reasons given by the EDPB in the contested decision as they stood and simply to draw the appropriate conclusions in each case in a concluding paragraph. It stated that, in the final decision, it did not refer to and did not take a position on the objections which the EDPB had deemed not to be relevant and reasoned, and which the EDPB had therefore declined to assess on the merits, or the objections which the EDPB had found not to require any change of the assessment set out in the draft decision.

10 In accordance with Article 65(6) of Regulation 2016/679, the contested decision was attached to the final decision of the Irish supervisory authority.

11 In that regard, it is apparent that, in the contested decision, the EDPB successively took a position solely on the following aspects, which, in its view, had been the subject of relevant and reasoned objections:

– whether WhatsApp had failed to comply with the obligations to provide information laid down in Article 13(1)(d) of Regulation 2016/679, relating to certain information to be provided to data subjects where personal data have been collected from them. Such a failure to comply had not been established by the Irish supervisory authority in its draft decision. The EDPB took the view, on the contrary, that WhatsApp had failed to comply with that provision;

– the classification as personal data of the material resulting from the ‘lossy hashing procedure’, applied to the data concerning the ‘contacts’ who are non-users of WhatsApp...