WhatsApp Appeal Against EU Fine Backed By Court Advisor

The legal battle between Meta Platforms and the Irish data protection commission (DPC), as well as the European Data Protection Board (EDPB), has seen a notable development this week.

Reuters reported that an adviser to Europe’s top court, the Luxembourg-based Court of Justice of the European Union, has backed WhatsApp, the messaging app of Meta Platforms, in its appeal against a stiff fine from the Irish DPC.

It was back in September 2021 when the Irish DPC had ruled that WhatsApp would be fined 225m euros (£187m) for breaching privacy and data processing regulations.

The Irish DPC had issued the fine over Meta’s use of personal data in Ireland, after an order from the EU privacy watchdog, the European Data Protection Board (EDPB), to increase its initial fine.

Case background

The issue really began when Facebook had acquired WhatsApp in 2014 for $19 billion (£14.7bn).

Soon after that acquisition, the messaging app modified its terms of service, informing users it would share their data with its new parent, but backed down in the face of protests.

Then in August 2016 Facebook controversially decided again to update WhatsApp terms of service and privacy policy to include WhatsApp data sharing with the social network.

This change again prompted outrage among WhatsApp users and European regulators.

Matters were not helped by the fact that WhatsApp founder Jan Koum had denied at the time of the acquisition in 2014, that WhatsApp would have to follow Facebook’s privacy policies.

Indeed, such was the controversy that Facebook in November 2016 had to suspend data sharing between its social network and WhatsApp across the European Union.

It had earlier suspended such data sharing activity in the UK.

But this did not prevent Facebook from being fined 110 million euros (£93.8m) in May 2017 by European regulators, because the EU felt that the social network giant had provided misleading information during EU scrutiny of the deal.

The Irish DPC began its own investigation in 2018 (as Facebook has its European HQ in Ireland) and “ examined whether WhatsApp has discharged its GDPR transparency obligations with regard to the provision of information and the transparency of that information to both users and non-users of WhatsApp’s service.”

In 2020 the Irish DPC submitted a draft decision, but received objections from eight Concerned Supervisory Authorities (CSAs), prompting it to eventually issue the 225m euros (£187m) fine in September 2021.

WhatsApp appeal

Meta of course opted to appeal the fine, and in 2022 a lower tribunal rejected WhatsApp’s challenge against the EDPB, saying it has no legal standing to sue the authority as it was not directly affected by the EDPB’s decision, but that it could go to a national court on the Irish fine.

WhatsApp subsequently appealed to the Luxembourg-based Court of Justice of the European Union, Europe’s highest court.

CJEU Advocate General Tamara Capeta on Thursday reportedly faulted the lower tribunal on its analysis, and recommending that the case be referred back to the General Court for further review.

“WhatsApp’s challenge of the EDPB decision is admissible and the case should be referred back to the General Court for a decision on the merit,” Capeta reportedly said in a non-binding opinion.

The CJEU rarely disagrees with the advice of the CJEU Advocate General, and a final ruling is expected soon.