EU General Court: Irish DPC's Refusal to Probe Meta, WhatsApp is Unlawful
The European Court of Justice's General Court ruled Wednesday that the Irish Data Protection Commission (DPC) acted unlawfully when it refused to investigate a complaint from Noyb, the Austrian privacy organization. The ruling was issued in Data Protection Commission v. European Data Protection Board (joined cases T‑70/23, T‑84/23 and T‑111/23).
Sign up for a free preview to unlock the rest of this article
The EU court noted the case arose in 2018, when three people living in Belgium, German and Austria, respectively, lodged complaints against Facebook Ireland (now Meta) concerning Facebook and Instagram's processing of data. The three also lodged complaints against WhatsApp Ireland about processing data. Since Meta and WhatsApp are headquartered in Ireland, the DPC was the lead supervisory authority. The complaints were filed through Noyb before the three people's respective data protection authorities (DPAs).
After an investigation, the DPC submitted three draft decisions to all the other EU DPAs. The decisions found the complainants failed to show that the social media companies couldn't rely on a provision of the General Data Protection Regulation (GDPR) that doesn't require data subjects' consent for processing their personal data.
Some of the other DPAs objected to the DPC's assessment, others pointed out that failure to obtain user consent for processing the data would infringe the GDPR. DPAs stressed that the DPC should widen its investigations to learn how Meta and WhatsApp processed such data.
When the DPC couldn't reach agreement with the other DPAs, it submitted the matter to the European Data Protection Board, which backed several of the DPAs' objections. In particular, the General Court ruling said, the EDPB disagreed that the companies could rely on GDPR consent provisions to justify the legality of their data processing.
The board ordered the DPC to carry out new investigations into aspects of the companies' processing operations. The DPC challenged the board's power to make such a demand. The General Court dismissed the DPC's challenge, a decision which can now be appealed to the European Court of Justice.
Noyb Chairman Max Schrems applauded the ruling but said it also means that the cases, going on for more than six years, will "start again from square one." He accused the DPC of being a "master of grotesque sidesteps and loops in procedures" that mean U.S. Big Tech companies are never penalized.