European Union: High Court Rules Companies Can Directly Challenge Data Privacy Fines

In a landmark judgment, the Court of Justice of the European Union (CJEU) has ruled that companies have the right to challenge binding decisions made by the European Data Protection Board (EDPB) before they are finalized by national authorities. The case originated from a massive fine involving WhatsApp and the Irish Data Protection Commission. The ruling essentially opens a "dual-track" litigation path for tech companies facing major penalties under GDPR.

Previously, it was argued that companies had to wait for a national agency to issue a final penalty before seeking a judicial review. However, the CJEU found that because EDPB decisions are "binding" and exhaustively resolve specific legal issues, they cannot be treated as mere preparatory steps. This means companies can now sue at the EU level to have these decisions annulled, potentially freezing enforcement actions across multiple member states simultaneously.

This decision is expected to have an immediate impact on several pending high-profile privacy cases. Legal experts suggest that this strengthens the procedural safeguards for corporations but could also lead to longer, more complex legal battles over data protection. The ruling underscores the CJEU's role in ensuring that EU bodies remain accountable to the same standards of judicial review as national governments.