The CJEU Says Companies Can Directly Challenge Binding EDPB Decisions

Most privacy enforcement disputes do not go straight from a regulator’s decision to a final judgment. They move through national authorities, national courts, and European review. The Court of Justice of the European Union changed one important part of that path in a February 2026 judgment. In WhatsApp Ireland v European Data Protection Board, Case C-97/23 P, the CJEU’s Grand Chamber held that a controller directly concerned by a binding EDPB decision can bring an action for annulment under Article 263 of the Treaty on the Functioning of the European Union. The judgment is about access to judicial review. It is not a final decision on the underlying privacy allegations against WhatsApp. The dispute over the route to court The case arose from the GDPR’s consistency mechanism. In a cross-border dispute, national supervisory authorities can refer unresolved issues to the EDPB. The board can issue a binding decision, after which national authorities adopt or adjust the measures applied in their own jurisdictions. WhatsApp sought to challenge Binding Decision 1/2021 directly. The General Court had dismissed the action as inadmissible, treating the EDPB decision as part of a process that would be implemented through national measures. The CJEU set that order aside. It held that a binding EDPB decision can produce distinct legal effects directly concerning the controller, even though national supervisory authorities later implement it. What the judgment means The ruling means a directly concerned controller does not always have to wait for a national implementation measure and then challenge the dispute indirectly through a national court. The controller may be able to seek annulment of the binding EDPB decision itself, subject to the conditions and time limits in Article 263 TFEU. That creates a clearer line of accountability for a powerful EU-level decision-maker. It also gives the CJEU a direct opportunity to review how the EDPB used the consistency mechanism in a particular dispute. For data subjects, the change is more indirect. The judgment does not automatically increase a person’s compensation, erase data, or decide whether a company violated the GDPR. But a more direct review route can affect the speed, shape, and transparency of high-profile cross-border enforcement. What the Court did not decide The judgment did not resolve the underlying merits of WhatsApp’s data-protection dispute. It addressed whether the action could be brought directly and whether the EDPB decision was an act open to challenge with direct concern to the applicant. That distinction matters because legal procedure can determine which questions a court is allowed to reach. A ruling about admissibility is not a ruling that the regulator, the company, or the complainants were ultimately right. Why this matters for privacy enforcement Cross-border platforms can affect people in many countries while being headquartered in one. The GDPR’s consistency mechanism is designed to keep national regulators from issuing contradictory outcomes, but centralized decisions also need meaningful review. The CJEU’s decision recognizes that a binding EDPB decision can matter to a controller before the final national implementation step. It gives companies a direct procedural channel while preserving the national courts’ role in reviewing national measures and referring questions of EU-law validity to the CJEU where appropriate. The practical questions for future cases include: Which EDPB decisions produce direct legal effects for a controller? How will the two-month challenge period be calculated in different situations? Will more controllers challenge EDPB decisions directly, changing the board’s litigation posture? How will national authorities coordinate implementation while a direct action is pending? What does clearer review mean for complainants waiting for an effective remedy? Privacy rights depend on substantive rules, but they also depend on who can challenge a decision, when they can do it, and which court can hear the case. The WhatsApp judgment is about that architecture—and the architecture determines how enforcement becomes real.