WhatsApp appeals EDPB Decision on Data Processing to EU’s Highest Court

WhatsApp has escalated its legal battle with the European Data Protection Board (EDPB) by appealing a binding decision to the European Court of Justice (ECJ), the European Union's top court. The case challenges the EDPB’s directives on WhatsApp’s data processing practices under the General Data Protection Regulation (GDPR).

The EDPB had instructed WhatsApp to modify its data processing practices for service improvement, citing non-compliance with GDPR requirements. The directive also included a €5.5 million fine imposed by the Irish Data Protection Authority (DPA), which oversees WhatsApp’s EU operations since the company is headquartered in Ireland.

The crux of the issue lies in WhatsApp’s use of personal data for service enhancements, which the EDPB deemed a violation of GDPR rules regarding transparency and user consent. WhatsApp contends that its practices are lawful and fall within the scope of legitimate interest, a legal basis allowed under GDPR.

Earlier this year, WhatsApp sought to annul the EDPB’s decision in the European Union’s General Court, arguing that the directive exceeded the board’s authority. However, the General Court ruled against WhatsApp, upholding the EDPB’s decision as compliant with EU law. This ruling led WhatsApp to take the case to the ECJ, seeking a final judgment.

According to The Legal World by The Economic Times, this legal battle is more than just a regulatory dispute for WhatsApp; it is a test case that could set a precedent for how GDPR is interpreted and enforced across the EU. At its core, the case explores the balance between technological innovation and user privacy, particularly the extent to which companies can process personal data without explicit consent.

Should the ECJ uphold the EDPB’s decision, it could lead to stricter scrutiny of data processing practices across industries and bolster the regulatory powers of EU data protection authorities. On the other hand, a ruling in WhatsApp’s favor could redefine the boundaries of legitimate interest under GDPR and offer greater flexibility for businesses in handling personal data.

As the ECJ prepares to hear the case, data protection advocates and businesses alike are closely monitoring the developments. The court’s ruling, expected to take months, will have far-reaching consequences for privacy laws, data processing norms, and the broader tech landscape in the EU.