Can Big Tech Sue the EU’s Privacy Referee? The CJEU Reasserts Judicial Control

Uncategorized

February 11, 2026

European Governance

On 10 February 2026, the Court of Justice of the European Union ruled in WhatsApp Ireland v European Data Protection Board (C-97/23 P), that WhatsApp’s action for annulment against a binding decision of the European Data Protection Board (EDPB) is admissible. The Court set aside the General Court’s earlier order and referred the case back for a ruling on the merits.

At stake was the legal nature of EDPB binding decisions adopted under Article 65 GDPR, which are issued to resolve disputes between national data protection authorities. The General Court had previously treated the EDPB’s decision as a merely preparatory act, arguing that WhatsApp could challenge only the final enforcement decision adopted by the Irish Data Protection Commission before national courts. The CJEU rejected that reasoning. It held that the EDPB’s binding decision is intended to produce legal effects vis-à-vis third parties and is therefore an EU act open to judicial review under Article 263 TFEU.

A CJEU ruling about institutional balance

Beyond the immediate procedural question, the judgment is a clear institutional intervention by the CJEU in the evolving architecture of EU data protection enforcement. By recognizing that an EDPB decision can be of direct concern to a regulated company, the Court affirms its role as the ultimate arbiter of legality in an enforcement system that has become increasingly centralized at EU level.

This matters because EDPB binding decisions do not merely offer guidance. They can determine the existence of an infringement and constrain the discretion of the lead supervisory authority when adopting the final decision, including on fines. The CJEU’s reasoning reflects a concern that shielding such acts from direct judicial review would leave a gap in legal protection, contrary to the principle of effective judicial review under EU law.

Political effects for EU digital regulation

Politically, the ruling cuts both ways for the EU’s digital governance agenda. On the one hand, it strengthens the legal legitimacy of the EDPB by subjecting its most powerful instruments to direct judicial scrutiny at EU level. On the other, it gives large technology firms, such as WhatsApp, a more direct procedural route to contest the EU’s privacy enforcement strategy.

This may slow down headline-grabbing enforcement actions and complicate the EU’s effort to project itself as a fast-acting and uncompromising digital regulator. At the same time, it reinforces the EU’s self-image as a rule-of-law system, where even highly political regulatory choices remain contestable before an independent court.

More broadly, the judgment fits a wider CJEU pattern. As EU agencies and coordination bodies gain quasi-regulatory power, the Court is increasingly unwilling to allow their acts to sit beyond the reach of judicial review. In that sense, the case is less about WhatsApp and more about how far EU-level governance can centralize before the Court insists on tightening the judicial leash.

Sources