Order;Abstract — ECLI:EU:T:2023:522
Date: 2023-09-06
Language of the case: English
Court formation: First Chamber, Extended Composition
Subject matter: Provisions governing the Institutions
Procedure: Action for annulment - inadmissible
Origin: Belgium

Case T‑578/22 European Data Protection Supervisor v European Parliament and Council of the European Union, Order of the General Court (First Chamber, Extended Composition), 6 September 2023 (Action for annulment – Law governing the institutions – Processing of personal data by Europol – Regulation (EU) 2016/794 – The institutional prerogatives of the EDPS – Locus standi – Action in part inadmissible and in part manifestly inadmissible) 1. Actions for annulment – Jurisdiction of the EU judicature – Action brought by an EU institution – Action brought by the European Data Protection Supervisor (EDPS) – Standing in order to defend his or her institutional prerogatives, relied on in support of that action (Art. 263 TFEU; Parliament and Council Regulation No 45/2001, Art. 41(1)) (see paragraphs 26-36) 2. Actions for annulment – Natural or legal persons – Legal interest in bringing proceedings – Locus standi – Action brought by the European Data Protection Supervisor (EDPS) – Standing in order to defend his or her institutional prerogatives – Absence – Admissibility conditional on demonstrating standing and a legal interest in bringing proceedings (Art. 263, fourth para., TFEU) (see paragraphs 41-48, 54-57) 3. Actions for annulment – Locus standi – Legal persons – Concept – European Data Protection Supervisor (EDPS) – EU body – Included – Conditions (Art. 263, fourth para., TFEU) (see paragraphs 60-65) 4. Actions for annulment – Natural or legal persons – Measures of direct and individual concern to them – Provisions relating to the processing of personal data by Europol – Decision taken by the European Data Protection Supervisor (EDPS) against Europol – No bearing of those provisions on that decision and on the powers of the EDPS – No direct concern – Inadmissibility (Arts 16(2) and 263, fourth para., TFEU; Parliament and Council Regulation 2016/794, as amended by Regulation 2022/991, Arts 74a and 74b) (see paragraphs 66, 68-76, 78-82, 84, 85) Résumé On 3 January 2022, following an own-initiative inquiry, the European Data Protection Supervisor (EDPS) adopted a decision against the European Union Agency for Law Enforcement Cooperation (Europol). (1) By that decision, the EDPS ordered Europol, in essence, for each contribution received as from 4 January 2022, to proceed to data subject categorisation within 6 months as from the date of reception of that contribution, and to proceed to data subject categorisation within 12 months for all datasets existing as at the date of that decision, after which periods Europol was required to erase those data. On 8 June 2022, the European Parliament and the Council adopted the amended Europol regulation. (2) That regulation laid down, in essence, under two transitional provisions, (3) the conditions in which Europol is to proceed, within a specified period, to the categorisation of the datasets in its possession at the time of entry into force of the amended Europol regulation, and specifies the conditions and procedures according to which the processing of personal data not relating to categories of data subjects listed in Annex II to the amended Europol regulation, and which were transferred to Europol before 28 June 2022, is to be authorised in support of an ongoing criminal investigation. The EDPS took the view that the contested provisions infringed his independence and his powers as a supervisory authority, since, in his view, they retroactively legalised Europol’s contested data retention practices and de facto annulled the decision of 3 January 2022. Thus, pursuant to Article 263 TFEU, he sought, before the General Court, the annulment of those provisions. The EDPS submitted that his standing to bring an action was justified by the need to be able to have a judicial remedy in order to defend his institutional prerogatives and, in particular, his independence as a supervisory authority. In the present case, the General Court has before it, for the first time, an action for annulment brought by the EDPS against a legislative act of the Council and the Parliament, which raises, inter alia, the issue of the jurisdiction of the General Court to hear and determine that action, the issue of the application of the judgment in Parliament v Council (C‑70/88) (4) by analogy to the present case, and the issue of the direct concern of the EDPS, who is treated in the same way as a legal person, under the fourth paragraph of Article 263 TFEU. Findings of the Court In the first place, the Court examines whether it has jurisdiction to hear the action brought by the EDPS and observes, first of all, that the EDPS is not among the applicants referred to in the second and third paragraphs of Article 263 TFEU, (5) or in the list of institutions in Article 13(1) TEU. (6) Next, the Court notes that although the first paragraph of Article 263 TFEU expressly refers to EU bodies, offices and agencies in the list of authors of acts whose legality may be called into question in the context of an action for annulment, the same is not true as regards the second and third paragraphs of Article 263 TFEU. Thus, the General Court states that although the status of the EDPS, as an independent supervisory authority, is enshrined both in the FEU Treaty and in the Charter, (7) the EDPS was established as an EU body not by an act of primary law, but by an act of secondary legislation. (8) Consequently, the EDPS, although an EU body with a particular status, is not an EU institution and, in any event, cannot be regarded as one of the applicants referred to in the second and third paragraphs of Article 263 TFEU. Lastly, the General Court concludes that it has jurisdiction to rule on the action, since actions referred to in Article 263 TFEU, brought in particular by an EU institution against a legislative act, must be reserved to the Court of Justice, (9) and the EDPS is neither an institution nor an applicant referred to in the second and third paragraphs of Article 263 TFEU. In the second place, the General Court assesses whether the EDPS has standing under the case-law resulting from the judgment in Parliament v Council (C‑70/88). It notes that, in that judgment, relied on by the EDPS in support of his specific standing to bring proceedings to defend his institutional prerogatives, the Court of Justice held that the Parliament did not have any opportunity to challenge, before the Courts of the European Union, the acts adopted by the other institutions liable to infringe its own prerogatives and the Court of Justice chose to fill that gap by having recourse to the general principle of institutional balance. By contrast, the EDPS may bring an action for annulment on the basis of the fourth paragraph of Article 263 TFEU, since the EDPS is a body created by an act of secondary EU legislation that may be treated in the same way as a legal person. Furthermore, the General Court states that although the EDPS has a particular status, recognised both by the FEU Treaty and the Charter, and that the creation of independent supervisory authorities is an essential element of the protection of individuals with regard to the protection of personal data, the independence in which the EDPS must carry out his duties in practice is not intended to limit the powers of the EU legislature. (10) Consequently, the EDPS is required to exercise his duties and powers in complete independence, and it is within the framework of the legislative acts adopted jointly by the Parliament and the Council and in accordance with them that he supervises compliance with the rules relating to the protection of individuals with regard to the processing of personal data by the EU institutions, bodies, offices and agencies. The General Court concludes that the judgment in Parliament v Council (C‑70/88) cannot be applied by analogy to the EDPS’s situation, who cannot be recognised as having standing to bring proceedings in accordance with that judgment and who has to be regarded as an applicant who must fulfil the conditions for admissibility laid down in the fourth paragraph of Article 263 TFEU. In the third place, in the context of the examination of the EDPS’s standing to bring proceedings, under the fourth paragraph of Article 263 TFEU, the Court analyses, as a preliminary point, whether the EDPS may, as an EU body, be treated in the same way as a legal person within the meaning of that article. The Court notes that, by applying an interpretation of that provision in the light of the principles of effective judicial review and the rule of law, an EU body, such as the EDPS, has, as a ‘legal person’, standing to bring an action for annulment of the contested provisions, provided that the EDPS is directly and individually concerned by them within the meaning of that provision. Such a legal person is indeed equally as likely as any another person or entity to have its rights or interests adversely affected by an EU act and must, therefore, be able, in compliance with those conditions, to seek the annulment of such an act. As regards the condition that a legal person must be directly concerned, the Court points out that two cumulative criteria must be met in that respect. As regards, first, the criterion relating to the effects of the contested provisions on the legal situation of the EDPS, the Court points out that the EDPS is responsible for monitoring the application by the EU institutions, bodies, offices or agencies of the relevant rules relating to the protection of personal data. (11) In the present case, the contested provisions amend the initial Europol regulation and have no bearing on the nature or scope of the tasks entrusted to the EDPS by EU legislation. Thus, while it is true that the legal regime which the EDPS is responsible for monitoring has been changed, his own powers have not been, since the way in which he can lawfully exercise those powers has not been altered as such. The EDPS is not, therefore, directly concerned by the contested provisions, inasmuch as his rights, obligations or powers have not been affected by those provisions. Furthermore, as regards the effects of the contested provisions on the decision of 3 January 2022, the Court makes clear that that decision is an administrative decision which cannot affect legislative acts, such as the amended Europol regulation, or affect the content thereof. Secondly, as regards the criterion relating to the discretion of the addressees responsible for implementing the contested provisions, the Court notes that those provisions leave Europol a certain discretion. They are not, therefore, purely automatic in nature resulting from the EU rules alone vis-à-vis the EDPS, without the application of other intermediate rules. Consequently, given that the contested provisions do not directly affect the legal situation of the EDPS and that the conditions that the act whose annulment is sought should be of direct concern and individual concern are cumulative, the Court concludes that the action is inadmissible. 1 Pursuant to Article 43(3)(e) of Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (OJ 2016 L 135, p. 53; ‘the initial Europol regulation’). 2 By means of Regulation (EU) 2022/991 of the European Parliament and of the Council of 8 June 2022, as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role in research and innovation (OJ 2022 L 169, p. 1), thereby amending the initial Europol regulation (‘the amended Europol regulation’). 3 Articles 74a and 74b of the amended Europol Regulation (‘the contested provisions’). 4 Judgment of 22 May 1990, Parliament v Council (C‑70/88, EU:C:1990:217). 5 Under that provision, an action may be brought before the Court, on the one hand, by a Member State, the Parliament, the Council or the Commission, and, on the other, by the Court of Auditors, the European Central Bank (ECB) and the Committee of the Regions. 6 The seven institutions referred to in that provision are the Parliament, the European Council, the Council, the Commission, the Court of Justice of the European Union, the European Central Bank and the Court of Auditors. 7 Under Article 16(2) TFEU and Article 8(3) of the Charter of Fundamental Rights of the European Union (‘the Charter’), compliance with the rules relating to the protection of individuals with regard to the processing of personal data by the EU institutions, bodies, offices and agencies is to be subject to the control of independent authorities. 8 Article 41(1) of Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ 2001 L 8, p. 1). 9 Pursuant to Article 51(b) of the Statute of the Court of Justice of the European Union. 10 As provided for in Article 14(1) and 16(1) TEU. 11 Pursuant to Article 1(3) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ 2018 L 295, p. 39), and Article 43(1) of the initial Europol regulation.