Opinion of the Advocate General — ECLI:EU:C:2025:328
Date: 2025-05-08
Language of the case: English

summary, I believe that the EDPS does not have the standing to bring an action which is provided for in the second and third paragraphs of Article 263 TFEU, which means that his main ground of appeal must be dismissed. B. The alternative ground of appeal 1. Arguments of the parties (a) Admissibility 56. The Council submits that this ground is also inadmissible, for the same reasons which it claims should lead to the inadmissibility of the main ground. (b) The substance 57. The EDPS begins by criticising the lack of clarity of paragraphs 76 and 77 of the contested order, which state that the decision of 3 January 2022 ‘is an administrative decision which cannot affect legislative acts such as the [AER] or affect the content thereof’ and that, ‘although the contested provisions alter the applicable legal framework, for which the EDPS is responsible for monitoring compliance, and do not have entirely the same scope as that of the decision of 3 January 2022, they do not, however, affect his legal situation.’ 58. The EDPS submits that those statements are vitiated by two errors. First, they do not point out that the exercise of the EDPS’s powers requires legal certainty and that those powers have been harmed by the adoption of retroactive measures. Secondly, they do not acknowledge that the contested transitional provisions are aimed at neutralising the ongoing effects of a specific decision and, therefore, are directed at the EDPS and at Europol. 59. The EDPS claims that it is the retroactive nature of the contested transitional provisions specifically which undermines his independence, which would not be affected at all if the legislative amendment were applied as regards the future. 60. The EDPS further claims that those provisions also affect him in a particular way as regards the exercise of his supervisory role in the field of data protection. At issue here are personal data whose protection is undermined by transitional provisions which, for the same reason, necessarily concern the EDPS. 61. The Parliament and the Council, supported by the Commission and the French Government, essentially endorse the arguments of the General Court. 62. In particular, the Parliament contends that, if it were accepted that any amendment of provisions already applied by the EDPS affects the EDPS directly, that would amount to conferring on him the status of privileged applicant, contrary to Article 263 TFEU. In the same vein, the French Government points out that this would render meaningless the criterion of direct concern. 2. Analysis (a) Admissibility 63. The reasons which I put forward in support of the rejection of the plea of inadmissibility of the main ground of appeal, raised by the Council, may be applied to the alternative ground. (b) The substance 64. The General Court and the institutions involved in the present proceedings all agree that the EDPS does not enjoy the standing conferred by the second and third paragraphs of Article 263 TFEU (privileged standing). They also all agree that the EDPS’s standing is conditional on fulfilment of the conditions laid down in the fourth paragraph of Article 263 TFEU. Up to this point, I am in agreement with their assessments. 65. However, I do not agree that the EDPS does not fulfil, in this case, the conditions required by the fourth paragraph of Article 263 TFEU. 66. Having ruled out the privileged standing claimed by the EDPS, I believe that the nature of the role of monitoring data protection legislation, entrusted to that body, should discourage an excessively strict interpretation of the EDPS’s ordinary standing to bring court proceedings. 67. While I stated above that the EDPS does not have the status of an institution of the Union, I must now stress that he performs an important role, enshrined in the FEU Treaty, to ensure that the institutions, bodies, offices and agencies of the Union comply with the provisions on the protection of natural persons with regard to the processing of their personal data. The performance of that role, as regards the right to bring a challenge before the Courts of the Union, should not be undermined without very sound reasons. 68. For the reasons I shall set out below, I believe that even a strict interpretation of the conditions laid down in the fourth paragraph of Article 263 TFEU would make it possible to recognise that the EDPS has the standing which he was refused in the contested order. 69. The approach which I propose does not amount to prejudging the substance of the action for annulment. During the stage of the examination of the admissibility of an action, the decision as to the substance does not need to be anticipated: it is sufficient to determine whether the applicant has adequately explained the reasons why the contested decision produces effects on his or her legal situation. (28) 70. The General Court found that the EDPS is not directly concerned by the contested transitional provisions, as required by the fourth paragraph of Article 263 TFEU because, on the one hand, those provisions amended the legislation which the EDPS is responsible for monitoring, but not his own powers, (29) and on the other, those provisions ‘leave Europol a certain discretion’. (30) 71. The approach adopted by the General Court when setting out the criteria for determining whether there is ‘direct concern’ is, in principle, correct. The Court of Justice has stressed that, in order to challenge a specific measure, two cumulative criteria must be met, ‘… namely, first, the contested measure must directly affect the legal situation of that person and, secondly, it must leave no discretion to its addressees who are entrusted with the task of implementing it, such implementation being purely automatic and resulting from EU rules alone without the application of other intermediate rules’. (31) 72. However, in assessing whether the contested transitional provisions affect the legal situation of the EDPS in this case, I believe that the General Court in fact ruled on a matter which relates to the substance of the action rather than admissibility: its central arguments concern the possible effects of the contested transitional provisions on the independence of the EDPS. In particular, the General Court found that the (alleged) retroactive nature of the contested transitional provisions is not likely to undermine the independence of the EDPS. 73. In my view, all the General Court was required to do at that stage of the proceedings was to determine whether the EDPS adequately (that is, reasonably and realistically) explained the reasons why those provisions were capable of producing that effect. 74. Something similar occurs in relation to the second condition referred to: the General Court assumed that the contested transitional provisions afford Europol a margin of discretion to decide ‘whether or not to continue the processing of certain data’, which shows that ‘the contested provisions … are not … purely automatic in nature’. (32) 75. The General Court dismissed the EDPS’s complaint (regarding the consequences of the exercise of that discretion vis-à-vis his decision of 3 January 2022), stating that ‘the contested provisions do not prevent the EDPS from exercising, as he sees fit, his own powers’. (33) 76. However, there are two objections to that finding: – First, it again deals with the substance of the dispute by prejudging, at the stage of the assessment of admissibility, the legal effects produced by the contested transitional provisions on the situation of the person seeking to challenge those provisions. (34) It also deals with the substance of the dispute by outlining the theoretical possibility that Europol acted in a particular manner when, in fact, the reply given by Europol to the EDPS on 22 August 2022 (35) made clear that, at least, Europol was no longer implementing part of the decision of the EDPS of 3 January 2022. – Secondly, it shifts the issue to the potential reaction of the EDPS to (future) decisions of Europol, whereas the decisive point for the resolution of the dispute was to establish whether the contested transitional provisions overrode, by themselves and on an ad hoc basis, individual decisions previously adopted by the EDPS and directed against certain conduct, also in the past, on the part of Europol. In such circumstances, it was justifiable that the ‘discretion’ granted allowed Europol, ipso facto, to disregard the contents of the decision of the EDPS of 3 January 2022. 77. Irrespective of the foregoing, I am not at all sure that the requirement of discretion must refer, in the circumstances of this case, to Europol’s conduct. If, as I understand it, the contested transitional provisions directly – and, as we shall see, also individually – concern the EDPS, it is because they produce legal effects on a specific decision of the EDPS and, to that extent, are addressed to the EDPS. The EDPS had no discretion as to the subject matter of that decision since, by operation of the contested transitional provisions, it was mandatory for that decision to be consistent with the requirements of those provisions. 78. In my view, it follows from the EDPS’s account of the facts and the summary of the facts contained in the contested order that the contested transitional provisions directly affected the EDPS. Whether they did so in disregard of his powers or by undermining his independence is, I repeat, part of the substantive issue which the EDPS raised before the General Court. 79. The contrast between the content of the decision of the EDPS of 3 January 2022 and that of the contested transitional provisions shows that it was, at the very least, legitimate to argue that, by means of the amended Europol Regulation, the legislature was seeking to ‘correct’ a decision of the EDPS which had become final (it had not been challenged by Europol). 80. Indeed: – On the one hand, the EDPS had called on Europol to categorise, within 12 months, the datasets in its possession on 3 January 2022. – On the other hand, the contested transitional provisions: (a) increased to 18 months, with the possibility of an extension, the period within which Europol was required to categorise the data in its possession at the time of the entry into force of those provisions, in other words, 28 June 2022; and (b) specified the conditions and procedures according to which the processing of personal data not relating to categories of data subjects listed in Annex II to the AER, which were transferred to Europol before 28 June 2022, is to be authorised in support of an ongoing criminal investigation. 81. The EDPS is taking great care in pointing out that he is not seeking to have standing to challenge all amendments to the legislative framework applicable to the content of his role. Further, he has no difficulty admitting, as he did at the hearing, that he would have no objection to the new rules if they applied to him only as regards the future. 82. However, the EDPS states that, in this case, the amendment affects him to the extent that it alters the content of a prior decision adopted by him, which is now final and which was adopted under the legislation in force, thereby creating a risk of anticipatory obedience likely to call into question his independence. 83. It is possible to dispute, as the Parliament does, that the contested transitional provisions have retroactive effect. It is also open to question, even if it is accepted that those provisions do have retroactive effect, whether they undermine the independence of the EDPS. In general terms, I believe that, where the legislature amends the substantive content of the provisions which an administrative authority is required to apply, that does not infringe the independence of that authority. (36) 84. That, I stress, is the substantive issue raised by the EDPS in his action for annulment, which cannot be avoided by dismissing it in advance. In fact, the General Court sets out in advance its substantive grounds relating to the substantive claim raised by the EDPS, as the basis for the decision to rule that the action for annulment is inadmissible. 85. The ad hoc nature of the contested transitional provisions also makes it possible to find that the condition of individual concern is satisfied, that being a point which, although the General Court did not express a view, should be addressed in the present appeal. (37) 86. In my opinion, the individual concern is clear merely from the account of the vicissitudes of the legislative procedure which ended with the adoption of the contested transitional provisions. The General Court described those in detail in paragraphs 5 to 11 of the contested order. 87. Those paragraphs describe how the legislative procedure commenced before the decision of the EDPS of 3 January 2022 was adopted, to be specific, on 9 December 2020 with a proposal for the amendment of the IER, submitted by the Commission. In Opinion 4/2021, (38) the EDPS welcomed the proposal, subject to certain reservations. 88. It is significant that, shortly after the adoption of the EDPS’s decision of 3 January 2022, the contested transitional provisions were added on 1 February 2022, following the last trilogue negotiation. All the indications are that Council Document No 5370/22 of 24 January 2022, on preparation for the trilogue, (39) was at the origin of the inclusion of those provisions. That document states that: – ‘the recent decision of the [EDPS], which could have operational consequences for Europol’s action, confirms the need for a rapid adoption of the regulation’; – ‘the Presidency proposed to the delegations to introduce a new Article 74[a] which would aim at further clarifying the situation of data currently in the possession of Europol, in particular in the context of the abovementioned decision of the EPDS of 3 January 2022’; and – ‘many delegations welcomed the principles of that proposal at the meeting of 19 January [2022], but approval by the committee is necessary in view of its recent presentation and the stakes that that subject represents following the decision of the EDPS’. (40) 89. It is difficult to dispute that the contested transitional provisions constitute a ‘tailored’ response to the decision of the EDPS of 3 January 2022 and are, therefore, addressed to the EDPS on an individual basis. Those are rules which, in the light the ‘stakes’ represented by the decision of the EDPS, which it was no longer possible to challenge because it had become final, are intended to override the content and consequences of that decision. 90. I fail to see how, in those circumstances, it can be accepted that the EDPS is not directly and individually concerned by the contested transitional provisions, since those provisions are aimed, specifically, at counteracting an individual, and now final, decision adopted by him. 91. The EDPS is required to monitor and ensure the application of the provisions of Regulation (EU) 2018/1725 (41) ‘and of any other Union act relating to the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data by a Union institution or body’. (42) 92. If, in the exercise of that competence, the EDPS requires a Union body to carry out a particular action and, in response to that decision (which becomes final), a provision specifically aimed at neutralising it is subsequently adopted, I believe that the EDPS should be recognised as having the right to bring proceedings before the EU Courts for a ruling on the validity of the (new) provision. 93. In summary, I believe that, without prejudging the substance of the matter raised by the EDPS before the General Court in relation to the validity of the contested transitional provisions, those provisions concern him to a sufficient degree to justify the locus standi which he was refused in the contested order. C. Final settlement of the dispute 94. In accordance with Article 61 of the Statute of the Court of Justice of the European Union, if the appeal is well-founded, the decision of the General Court must be set aside, and the Court of Justice may itself give final judgment in the matter, where the state of the proceedings so permits, or refer the case back to the General Court for judgment. 95. The EDPS requests that the Court of Justice give final judgment on the substantive issue raised at first instance. 96. In my view, the state of the proceedings does not permit final judgment to be given in the matter by the Court of Justice. In fact, the EDPS himself acknowledges this, requesting the Court to give ‘final judgment, having of course given all the parties the possibility to present their observations on every aspect of the case’. (43) 97. The arguments at first instance focused on the admissibility of the action brought by the EDPS against the contested transitional provisions. While that matter was resolved, as I have explained, by deciding in advance certain aspects of the substantive issue, that issue was not the subject of a full debate but rather merely an instrumental debate solely for the purpose of deciding on the standing of the EDPS, which is disputed by the Parliament and the Council. Accordingly, the case should be referred back to the General Court for it to give judgment following the proper exchange of views. D. Costs 98. In accordance with Article 184 of the Rules of Procedure of the Court of Justice, and since the EDPS has applied for costs, the Parliament and the Council should be ordered to pay the costs in these proceedings while the Federal Republic of Germany and the French Republic, interveners in these proceedings, should bear their own costs. V. Conclusion 99. On those grounds, I propose that the Court of Justice: – allow the appeal; – set aside the order of the General Court of 6 September 2023 in EDPS v Parliament and Council (T‑578/22, EU:T:2023:522); – in accordance with Article 61 of the Statute of the Court of Justice, refer the case back to the General Court for it to give judgment on the substance; – order the European Parliament and the Council of the European Union to pay the costs; – order the Federal Republic of Germany and the French Republic to bear their own costs. 1 Original language: Spanish. 2 T‑578/22, EU:T:2023:522; ‘the contested order’. 3 Regulation of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (OJ 2016 L 135, p. 53); ‘the initial Europol regulation or IER’. 4 Regulation of the European Parliament and of the Council of 8 June 2022 as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role in research and innovation (OJ 2022 L 169, p. 1); I refer to the version of the Europol regulation resulting from this amendment as ‘the amended Europol regulation or AER’. 5 These are two transitional provisions (Articles 74a and 74b; ‘the contested transitional provisions’) concerning, respectively, in so far as is relevant for the present purposes, the processing of personal data in support of an ongoing criminal investigation and the processing of personal data held by Europol. 6 Paragraphs 3 and 5 of Article 18 (‘Purposes of information processing activities’) of the IER provided: ‘3. Processing for the purpose of operational analyses as referred to in point (c) of paragraph 2 shall be performed by means of operational analysis projects, in respect of which the following specific safeguards shall apply: (a) for every operational analysis project, the Executive Director shall define the specific purpose, categories of personal data and categories of data subjects, participants, duration of storage and conditions for access, transfer and use of the data concerned, and shall inform the Management Board and the EDPS thereof; (b) personal data may only be collected and processed for the purpose of the specified operational analysis project. Where it becomes apparent that personal data may be relevant for another operational analysis project, further processing of that personal data shall only be permitted in so far as such further processing is necessary and proportionate and the personal data are compatible with the provisions set out in point (a) that apply to the other analysis project; (c) only authorised staff may access and process the data of the relevant project. … 5. Categories of personal data and categories of data subjects whose data may be collected and processed for each purpose referred to in paragraph 2 are listed in Annex II.’ 7 Article 18(6) of the IER provided: ‘Europol may temporarily process data for the purpose of determining whether such data are relevant to its tasks and, if so, for which of the purposes referred to in paragraph 2. The Management Board, acting on a proposal from the Executive Director and after consulting the EDPS, shall further specify the conditions relating to the processing of such data, in particular with respect to access to and use of the data, as well as time limits for the storage and deletion of the data, which may not exceed six months, having due regard to the principles referred to in Article 28.’ 8 Interlocutory judgment of 22 May 1990, Parliament v Council (C‑70/88, EU:C:1990:217; ‘the judgment in Parliament v Council’). 9 Paragraph 23 of the contested order. 10 Paragraph 21 of the contested order. 11 Paragraph 22 of the contested order. 12 Judgment of 17 December 2020, Germany v Commission (C‑475/19 P and C‑688/19 P, EU:C:2020:1036; ‘the judgment in Germany v Commission’ paragraph 33), relied on by the Council. 13 The judgment in Germany v Commission, paragraph 33 and the case-law cited. 14 As the General Court notes in paragraph 27 of the contested order. 15 Article 41(1) of Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ 2001 L 8, p. 1). 16 Paragraph 29 of the contested order, which cites the judgment of 14 July 2022, Italy and Comune di Milano v Council and Parliament (Seat of the European Medicines Agency) (C‑106/19 and C‑232/19, EU:C:2022:568, paragraphs 113 and 116). 17 Paragraph 32 of the contested order. 18 Paragraph 33 of the contested order reads: ‘the status of the EDPS as an independent supervisory authority is mentioned in Article 16(2) TFEU, which provides that compliance with the rules relating to the protection of individuals with regard to the processing of personal data by EU institutions, bodies, offices and agencies, is to be subject to the control of independent authorities, and in Article 8(3) of the Charter, which provides that compliance with the rules on the protection of personal data is to be subject to control by an independent authority.’ 19 Paragraph 41 of the contested order. The judgment in Parliament v Council acknowledged (paragraph 16) that the various legal remedies which, in the judgment of 27 September 1988, Parliament v Council (302/87, EU:C:1988:461), had been deemed sufficient for the purpose of submitting for review by the Court acts of the Council or the Commission adopted in disregard of the Parliament’s prerogatives may prove to be ‘ineffective or uncertain’. 20 Judgment in Parliament v Council, paragraph 21. 21 Judgment in Parliament v Council, paragraph 23. 22 Judgment in Parliament v Council, paragraph 25. 23 Judgment in Parliament v Council, paragraph 26. 24 Judgment in Parliament v Council, paragraph 27. Emphasis added. 25 Paragraph 30 of his appeal. 26 It is irrelevant from that perspective that, in the EDPS’s view, the fulfilment of those conditions is a consequence of the ‘very exceptional’ circumstances of this case. 27 Paragraphs 32 and 33 of his appeal. 28 Judgment of 6 November 2018, Scuola Elementare Maria Montessori v Commission, Commission v Scuola Elementare Maria Montessori and Commission v Ferracci (C‑622/16 P to C‑624/16 P, EU:C:2018:873, paragraph 47: ‘Given that the condition of direct concern requires the contested measure to produce effects directly on the applicant’s legal situation, the EU judicature must ascertain whether the applicant has adequately explained the reasons why the Commission’s decision is liable to place him in an unfavourable competitive position and thus to produce effects on his legal situation.’ Emphasis added. 29 Paragraph 74 of the contested order. 30 Paragraph 78 of the contested order. 31 See, inter alia, judgment of 12 July 2022, Nord Stream 2 v Parliament and Council (C‑348/20 P, EU:C:2022:548, paragraphs 43 and 44, and the case-law cited). 32 Paragraphs 80 and 82 of the contested order. 33 Paragraph 83 of the contested decision. 34 Judgment of 12 July 2022, Nord Stream 2 v Parliament and Council (C‑348/20 P, EU:C:2022:548, paragraph 98, and the case-law cited). 35 Paragraph 13 of the contested order. 36 There was a lengthy discussion of this point at the hearing which, in my view, is part of the substantive adjudication of the claims put forward by the EDPS rather than the assessment of the admissibility of the action. 37 Although the General Court ruled out the existence of direct concern, its decision that the action brought by the EDPS was inadmissible could ultimately be justified on other legal grounds, inter alia, if the condition of individual concern is not met. For example, judgment of 6 November 2018, Scuola Elementare Maria Montessori v Commission, Commission v Scuola Elementare Maria Montessori and Commission v Ferracci (C-622/16 P to C-624/16 P, EU:C:2018:873), paragraph 48 and the case-law cited, and of 22 June 2021, Venezuela v Council (Whether a third State is affected (C‑872/19 P, EU:C:2021:507), paragraphs 86 and 87. 38 Opinion of the EDPS of 8 March 2021 on the Proposal for Amendment of the Europol Regulation, available at https://www.edps.europa.eu/data-protection/our-work/publications/opinions/edps-opinion-proposal-amendment-europol-regulation_en. 39 Available at https://data.consilium.europa.eu/doc/document/ST‑5370-2022-INIT/fr/pdf. 40 Paragraph 11 of the contested order. 41 Regulation (EU) of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ 2018 L 295, p. 39). 42 Article 52(3) of Regulation 2018/1725. 43 Paragraph 68, in fine, of his appeal.