Companies targeted by the European Data Protection Board can now go straight to EU courts to challenge its binding decisions, the Court of Justice of the European Union ruled on Tuesday. The Luxembourg judges held that WhatsApp need not wait for Ireland's regulator to finalise enforcement before seeking judicial review of the board's 2021 decision against it.

The ruling redrew the procedural map of GDPR enforcement across the bloc. The court found the EDPB's decision in the WhatsApp transparency dispute was not a mere procedural step but a measure containing binding legal findings with concrete effects. Because those conclusions were fixed at the EU level, judges rejected the argument that WhatsApp had to await a final national enforcement decision before turning to the EU courts.

The court did not decide whether WhatsApp actually broke Europe's privacy rules. It sent the case back to the EU's General Court, which will now examine the substance of WhatsApp's claims about the board's findings on transparency, data classification and fines.

What does the ruling change?

The decision alters how privacy disputes get fought in Europe. When the EDPB issues a binding decision resolving a clash between national regulators, affected companies can challenge it directly before the General Court. The CJEU noted the GDPR itself permits direct challenges to board decisions before EU courts, and rejected the idea that only national proceedings guarantee effective judicial protection.

WhatsApp's troubles began in 2018, when the GDPR entered into force and Ireland's Data Protection Commission opened an inquiry into whether the company met its transparency obligations. Regulators questioned whether users were clearly told what data was collected, what it was used for, and how it moved within the Meta group. Because WhatsApp's European base is in Ireland, the Irish authority led the investigation.

The Irish regulator initially found WhatsApp had fallen short of transparency rules, particularly in explaining internal data sharing. Several other national regulators disagreed, triggering a formal dispute that pushed the case to the EDPB, which intervenes when regulators across the bloc clash.

In its 2021 binding decision, the board largely sided with the critics. It held that WhatsApp's explanations did not meet privacy standards and ruled that so-called "lossy hashed" data — information transformed into shortened or scrambled forms that can still be linked to individuals — must be treated as personal data. The board also ordered Ireland to raise the proposed penalty.

WhatsApp went straight to the General Court rather than waiting for Ireland to conclude its process. The lower court dismissed the action, treating the EDPB ruling as a preliminary step that did not change WhatsApp's legal position and holding that objections could be raised before Irish courts. Europe's highest court disagreed, finding the board's decision carried real legal force and directly affected WhatsApp's situation because it locked in EU-wide conclusions national regulators could not revisit — even though Ireland would ultimately impose the final fines and corrective measures.

How did experts react?

Gianclaudio Malgieri, an associate professor of law and technology at Leiden University, said the ruling strengthens the enforcement system by ensuring binding EU decisions can be tested directly before EU judges.

"This judgment makes the GDPR enforcement system more defensible from an effective remedy standpoint," Malgieri said. He cautioned, however, that once the board publishes a decision, companies that miss the deadline to act could later be restricted in challenging those findings through national courts.

Irene Kamara, an associate professor focusing on law and technology at Tilburg University, said the outcome fits within the EU's broader administrative law approach but carries trade-offs.

"EDPB decisions do have external legal effects and are therefore challengeable; from an EU law perspective this should not come as a surprise," Kamara said. She warned that the system must guard against overload: "We need to make sure that the EDPB will still be able to perform and continue doing its invaluable work, without being overwhelmed with actions from companies in bad faith."

Not everyone welcomed the shift. Christopher Docksey, honorary director general at the European Data Protection Supervisor and a former legal adviser on data protection to the European Commission, said the ruling could complicate enforcement. "I do not think this ruling is very helpful for the consistency mechanism," Docksey said, noting the judges openly accept their ruling "does indeed give rise to two parallel sets of proceedings" before EU and national courts — a development he said will "judicialize the consistency mechanism" in a way EU lawmakers likely never intended.

Cédric Burton, a Brussels-based partner at Wilson Sonsini Goodrich & Rosati, called the ruling "a pivotal moment for GDPR enforcement." He said: "The alternative the General Court endorsed would have created a serious accountability gap: An EU body making binding infringement findings shielded from direct judicial review."

What happens next?

WhatsApp welcomed the outcome. "The EDPB is an unelected authority whose decisions can directly impact businesses and people across the EU," a company spokesperson said. "The court's judgment upholds our argument that those businesses and people should be able to challenge decisions the EDPB makes against them, so that it can be held fully accountable by the EU courts."

The EDPB said in a statement it "stands ready to defend its decision on the merits."

The case now returns to the General Court for review of WhatsApp's substantive claims. The impact will reach beyond WhatsApp, with pending cases involving Meta's Instagram and Facebook, TikTok's data transfer rules, and challenges brought by national regulators against the board. For practitioners, the ruling means EDPB binding decisions are immediately justiciable acts — and that challenge deadlines under EU procedural rules now start running from the board's publication, not from any later national fine.