In its judgment of 10 February 2026 in Case C-97/23 P, the Court of Justice of the European Union (CJEU) held that binding decisions adopted by the European Data Protection Board (EDPB) under Article 65 of the General Data Protection Regulation (GDPR) are amenable to annulment proceedings under Article 263 of the Treaty on the Functioning of the European Union (TFEU). Setting aside the General Court’s inadmissibility order, the CJEU found that the EDPB decision both produced binding legal effects vis-à-vis third parties and was of direct concern to WhatsApp. We examine the judgment’s reasoning and assess its institutional implications for the EDPB.
Global Privacy Law Review