The General Court dismisses as inadmissible an action against an EDPB decision issued under Article 65 of the GDPR

The Irish supervisory authority (acting as lead supervisory authority) submitted a draft decision concerning data processing activities carried out by the Applicant to the other supervisory authorities concerned for their opinions, in compliance with the cooperation mechanism provided in the General Data Protection Regulation (Regulation (EU) 2016/679—“GDPR”). The supervisory authorities failed to reach consensus on the draft decision; therefore, under Article 65 GDPR, the EDPB issued Decision 01/2021 ruling on the matter, which had been the subject of relevant and reasoned objections by some of these authorities. After the EDPB decision was issued, the Irish authority issued its final decision, imposing a fine on the Applicant. The latter sought to have the General Court annul the EDPB decision under Article 263 of the TFEU (Treaty on the Functioning of the European Union). The General Court found that the Applicant lacked standing to open proceedings seeking annulment under Article 263 TFEU, since the contested EDPB decision had no legal effect bringing about a distinct change in the Applicant’s legal position and did not directly concern the Applicant, meaning that it did not directly affect the Applicant’s legal situation and left the matter to the discretion of the Irish lead authority.

Below we will (1) briefly describe the legal framework concerning this case; (2) outline the reasoning in this case that led the General Court to state that the Applicant lacked standing; and (3) draw conclusions.

1.  The legal framework

A. EDPB dispute resolution under Article 65 of the GDPR

The GDPR is designed to ensure correct and consistent application of the same by providing for the EDPB to issue binding decisions in specific cases listed in Article 65 of the GDPR, including cases in which cooperation between the lead supervisory authority and other supervisory authorities under Article 60 is inconclusive.

Under Article 60, paragraph 4, the lead authority shall submit a draft decision to the other supervisory authorities concerned for their opinion and take account of their views. If any of the authorities expresses a relevant and reasoned objection to the draft decision, but the lead authority does not intend to follow that objection or deems it to be not relevant or reasoned, then the lead authority shall set in motion the consistency mechanism.

Once this mechanism is employed, the EDPB shall make a binding decision concerning all matters that are the subject of the relevant and reasoned objections. That decision shall be reasoned, issued within a specific timeframe, and addressed to the lead supervisory authority and all the supervisory authorities concerned, as well as being binding upon them. Accordingly, the lead supervisory authority shall make a final decision on the basis of that EDPB decision.

B. The right to bring an action for annulment of an EDPB decision before the Court of Justice of the European Union

Recital 143 of the GDPR states, “Any natural or legal person has the right to bring an action for annulment of decisions of the Board before the Court of Justice under the conditions provided for in Article 263 TFEU.” Therefore, when an EDPB decision is of direct and individual concern to a controller, processor, or complainant, that party may file for annulment of the decision before the Court of Justice within two months of the decision’s publication on the EDPB website.

According to Article 263 TFEU and to the extent relevant to this analysis, applicants other than Member States, the European Parliament, the Council, and the European Commission (i.e., “privileged” applicants) can undertake proceedings against an EU act if it is addressed to them or of direct and individual concern to them. The Court of Justice has provided clarification on said requirements in its case law, where it holds that (i) the act to be challenged must have binding legal effects capable of affecting the interests of the applicant by bringing about a distinct change in its legal position; and (ii) when the applicant is not the addressee of the act that it is challenging, the requirement under point (i) overlaps with the conditions set forth in Article 263 TFEU requiring the applicant to be directly and individually concerned with that act.

Notwithstanding Article 263 TFEU, each natural or legal person should be provided an effective judicial remedy before the appropriate national court against a decision of a supervisory authority that is legally binding and produces legal effects concerning that person.

Moreover, under certain conditions, national courts may, or must, request a preliminary ruling from the Court of Justice concerning the EDPB decision, asking for interpretation of EU law or referring a question of validity of the EDPB decision (Article 267 TFEU).

2. The reasoning of the General Court in Case T-709/21: The Applicant lacks standing

In stating that the Applicant lacks standing to bring an action for annulment under Article 263 of the TFEU, the General Court addressed the following main points.

(i) The EDPB is a body of the European Union, as recognized under Article 68, paragraph 1, GDPR, and the contested EDPB decision is intended to produce legal effects vis-à-vis third parties. Indeed, this binding decision is addressed to the lead supervisory authority and all the supervisory authorities concerned and it is binding upon them.

(ii) The contested EDPB decision is of individual concern to the Applicant, since the decision relates to certain aspects of the draft final decision of the national supervisory authority concerning the Applicant specifically. Indeed, although the contested EDPB decision includes principles and interpretations of a general nature—which is common in individual acts—it mainly addresses the Applicant’s compliance with GDPR obligations, including in relation to very specific processing activities carried out by the Applicant, certain corrective measures, and aspects of determination of the administrative fine.

(iii) The contested EDPB decision has no legal effects bringing about a distinct change in the Applicant’s legal position. The General Court stated that intermediate acts whose purpose is to prepare for the final decision do not, in principle, constitute acts subject to challenge. However, an exception applies when intermediate acts produce independent legal effects with regard to which sufficient judicial protection cannot be ensured by an action against the final decision. In the case at hand, the general principle applies, since the contested EDPB decision (a) includes definitive analysis of certain aspects that the national supervisory authority shall take up in its final decision, but (b) has no legal effect vis-à-vis the Applicant that is independent of the final decision of the national supervisory authority and is not directly enforceable against the Applicant. Therefore, the Applicant has effective judicial protection with regard to the contested EDPB decision by means of the remedy available to it before the national court against the final decision.

(iv) The contested EDPB decision is not of direct concern to the Applicant as defined in Article 263 TFEU. The Court of Justice has consistently held that, in order for a measure to be of direct concern to an applicant who is not an addressee of that measure, the measure must (a) directly affect the applicant’s legal situation and (b) leave no discretion to its addressees, which are entrusted with the task of automatically implementing it. As to point (a), as mentioned above, the contested EDPB decision is a source of neither obligations for the Applicant nor rights for other individuals, so it is not directly enforceable against the Applicant. As for point (b), the contested EDPB decision was binding upon the national supervisory authority with regard to the aspects discussed, but the national supervisory authority was granted some discretion as to the content of the final decision. For instance, when it comes to establishing the fine, the contested EDPB decision interprets the criteria for determining the fine, but leaves it up to the national supervisory authority to set the amount.

3. Conclusions

The General Court’s decision introduces a significant standard for assessing the standing of a data controller/processor to bring an action for annulment of an EDPB decision issued under Article 65 GDPR. First, the General Court applies the principles of law concerning Article 263 TFEU, as consistently interpreted in the case-law, to this specific case concerning an EDPB decision under the cooperation mechanism in the GDPR. Second, the General Court provides guidance for assessing the concrete elements of EDPB decisions and that of the lead supervisory authority, to determine whether the requirements under Article 263 TFEU are met by the data controller/processor concerned. Therefore, this case will likely become a leading case in helping data controllers/processors assess whether or not they have standing to bring such an action.

Lastly, the reasoning of the General Court addresses issues linked to an EDPB decision adopted under Article 65 GDPR, but leaves open for further investigation the Court of Justice stance on potential challenges against other types of EDPB decisions, such as those issued under Article 66 GDPR.