(CN) — WhatsApp won the support of a legal adviser to the European Union’s highest court in its battle against the EU privacy watchdog, giving the messaging platform a boost in its bid to avoid Irish regulators’ $242 million fine over privacy violations.
Advocate General Tamara Capeta issued a nonbinding opinion that WhatsApp’s challenge to the European Data Protection Board decision should be heard by a lower tribunal, reversing an earlier ruling that dismissed the case.
“WhatsApp’s challenge of the EDPB decision is admissible and the case should be referred back to the General Court for a decision on the merit,” Capeta said at the European Court of Justice.
The case stems from a €225 million ($242 million) fine levied against the Meta-owned messaging platform by Ireland’s Data Protection Commission in 2021 for failing to adequately inform users about how their personal data was being processed.
The penalty is one of the largest under the General Data Protection Regulation, the EU data protection and privacy law introduced in 2018. It compels organizations to follow laws no matter they are located, so long as they collect data from people within the EU.
Meta has come under scrutiny multiple times by the European Court of Justice, receiving large fines. In one case in 2023, the Irish authorities imposed a record-breaking €1.2 billion ($1.3 billion) fine on Meta for transferring the personal data of EU residents to the U.S. without adequate protections in place.
The fine on WhatsApp was issued after the board intervened and directed the Irish regulator to impose a higher fine. WhatsApp, which has around 47 million monthly average users in the EU, challenged the board’s role in the decision, arguing that it lacked the authority to order the fine increase.
The General Court dismissed the lawsuit in 2022, ruling that WhatsApp was not directly affected by the board’s decision and could instead challenge the Irish regulator.
WhatsApp appealed to Europe’s highest court, seeking to annul the European Data Protection Board’s binding decision.
The European Court of Justice, which is the supreme court of the EU, follows its advisers’ recommendations in four out of five cases, and is expected to rule on this case in the coming months.
The nonbinding decision could have significant implications for how General Data Protection Regulation enforcement is carried out across the EU and the extent of the European Data Protection Board’s authority over national regulators.