ORDER OF THE PRESIDENT OF THE TENTH CHAMBER OF THE GENERAL COURT
26 October 2023 (*)
(Protection of personal data – General Data Protection Regulation – Powers of the European Data Protection Board – Binding decision – Action for annulment – Intervention – Application submitted by the European Data Protection Supervisor – Rejection)
In Joined Cases T‑70/23, T‑84/23 and T‑111/23,
Data Protection Commission, established in Dublin (Ireland), represented by D. Young, A. Bateman, R. Minch, and M. Delargy, Solicitors, B. Kennelly, lawyer, and D. Fennelly and E. Synnott, Barristers,
applicant,
v
European Data Protection Board, represented by I. Vereecken, C. Foglia and M. Gufflet, acting as Agents, and by G. Ryelandt, E. de Lophem and P. Vernet, lawyers,
defendant,
THE PRESIDENT OF THE TENTH CHAMBER OF THE GENERAL COURT
makes the following
Order
Procedure
1        In Case T‑70/23, by application lodged at the Court Registry on 14 February 2023, the Data Protection Commission, the Irish supervisory authority for personal data protection, as provided for by Article 51 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1), (‘the Irish Supervisory Authority’), brought an action for the annulment of part of points 198 and 487 of Binding Decision 3/2022 of the European Data Protection Board (‘the EDPB’) on the dispute between the supervisory authorities concerned arising from the Irish Supervisory Authority’s draft decision regarding Meta Platforms Ireland Ltd and its Facebook service.
2        In Case T‑84/23, by application lodged at the Court Registry on 17 February 2023, the Irish Supervisory Authority brought an action for annulment of part of points 203 and 454 of EDPB Binding Decision 4/2022 on the dispute between the supervisory authorities concerned arising from the Irish Supervisory Authority’s draft decision regarding Meta Platforms Ireland Ltd and its Instagram service.
3        In Case T‑111/23, by application lodged at the Court Registry on 24 February 2023, the Irish Supervisory Authority brought an action for annulment of points 222 and 326(8) of EDPB Binding Decision 5/2022 on the dispute between the supervisory authorities concerned arising from the Irish Supervisory Authority’s draft decision regarding WhatsApp Ireland Ltd.
4        The common subject matter of the three present cases is the challenge by the Irish Supervisory Authority to the EDPB’s entitlement to require it, in Binding Decision 3/2022, Binding Decision 4/2022 and Binding Decision 5/2022 (taken together, ‘the contested decisions’), adopted on the basis of Article 65(1)(a) of Regulation 2016/679, to carry out a new investigation and to issue a new draft decision in order to broaden the scope of the verification of compliance, on the part of the controller of the processing operation or operations concerned, with the provisions of Regulation 2016/679, compared with the scope initially adopted by that authority.
5        This common subject matter led, inter alia, to the three present cases being joined by decision of 21 April 2023 of the President of the Tenth Chamber of the General Court.
6        On 10 May 2023, the EDPB lodged with the Court Registry a joint statement of defence for the three joined cases. In that submission the EDPB asks the Court to dismiss the present actions and, in the alternative, ‘to limit the annulment [of the contested decisions] to their relevant parts’.
7        By documents lodged at the Court Registry on 17 May 2023, the European Data Protection Supervisor applied to intervene in the three cases in support of the form of order sought by the EDPB.
8        The application to intervene was served on the main parties. On 22 and 23 June 2023, respectively, the EDPB and the Irish Supervisory Authority stated that they had no objections to the intervention of the European Data Protection Supervisor and did not make any request for confidential treatment in his regard of data contained in the files of the three cases.
The application to intervene
9        The first paragraph of Article 40 of the Statute of the Court of Justice of the European Union provides that Member States and institutions of the European Union may intervene in cases before the Court of Justice. Under the first sentence of the second paragraph of that article, the same right is open to the bodies, offices and agencies of the European Union and to any other person if they can establish an interest in the result of a case.
10      More specifically, as regards the European Data Protection Supervisor, his capacity to be a party to legal proceedings before the Courts of the European Union is explicitly enshrined in Article 58(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ 2018 L 295, p. 39), which provides that the European Data Protection Supervisor ‘shall have the power to refer the matter to the Court of Justice under the conditions provided for in the Treaties and to intervene in actions brought before the Court of Justice’.
11      In this respect, it has already been held that the European Data Protection Supervisor’s right to intervene, referred to in Article 58(4) of Regulation 2018/1725, cannot be absolute since that authority is not one of the ‘privileged’ interveners referred to in the first paragraph of Article 40 of the Statute of the Court of Justice of the European Union, who may intervene without having to demonstrate any particular interest, and that his right to intervene is circumscribed within the limits deriving from the task entrusted to him. It has been stated that that right, based on the second paragraph of Article 40 of that Statute, requires the authority to establish an interest in the result of the case in order for that right to be exercised in a specific case (see order of the President of the Court of Justice of 21 July 2023, WhatsApp Ireland v European Data Protection Board, C‑97/23 P, EU:C:2023:609, paragraphs 9 and 10 and the case-law cited).
12      In the present cases, it is necessary to examine whether the European Data Protection Supervisor, in his application to intervene, has established an interest in the result of the case, in accordance with the second paragraph of Article 40 of the Statute of the Court of Justice of the European Union.
13      The European Data Protection Supervisor notes that Article 52(3) of Regulation 2018/1725 gives him responsibility for monitoring and ensuring the application of the provisions of that regulation and of any other EU act relating to the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data by an EU institution or body, and for advising EU institutions and bodies and data subjects on all matters concerning the processing of personal data. To those ends, he has the powers set out in Article 58 of that regulation, in particular the power referred to in paragraph 4 thereof to intervene in cases brought before the Court of Justice of the European Union.
14      The European Data Protection Supervisor argues that the result of the present cases will have an impact on his task of enforcing Regulation 2018/1725 and his task of advising the institutions and bodies of the European Union on all matters concerning the processing of personal data.
15      As regards the first of those tasks, the European Data Protection Supervisor draws a parallel between his position, as an independent authority responsible for fulfilling that task and for using the powers provided for that purpose in Regulation 2018/1725, and the position of the national supervisory authorities, which are also independent and are responsible for enforcing Regulation 2016/679 using the powers conferred on them therein. Recitals 4 and 5 of Regulation 2018/1725 confirm the existence of parallel rules on the protection of personal data, applicable by the institutions, bodies, offices and agencies of the European Union and by the public sector in the Member States, which are aligned as far as possible and must be interpreted homogeneously in order to constitute equivalent protection regimes. In his view, the questions raised by the Irish Supervisory Authority’s actions raise issues of fundamental importance, in particular as regards the scope of the independence of supervisory authorities in relation to the protection of natural persons’ personal data in the light of the right to such protection. The outcome of the present cases will therefore be highly relevant to the conduct of the tasks conferred on the European Data Protection Supervisor as an independent authority.
16      The existence of an interest in the result of the case must be understood as meaning a direct, existing interest in the ruling on the form of order sought, and not as an interest in relation to the pleas in law or arguments put forward, since the words ‘result of the case’ refer to the final decision sought, as set out in the operative part of the future judgment (see, to that effect, order of the President of the Court of Justice of 3 March 2022, Commission v Council, C‑551/21, EU:C:2022:163, paragraph 15 and the case-law cited). Here, the result of the present cases will clarify the extent to which the EDPB may compel a national supervisory authority to broaden the scope of an investigation it previously initiated and to draft and adopt as a result a new decision for the data controller concerned. Accordingly, it must be noted that in the present cases, as they concern a disagreement on the division of powers between the EDPB and the national supervisory authorities for determining the scope of the latter authorities’ investigations and decisions, the European Data Protection Supervisor has no direct, existing interest in the result of the cases from an institutional point of view.
17      Indeed, in the circumstances, the EDPB is not involved in the process of preparing decisions of the European Data Protection Supervisor, whereas it is involved, where appropriate, in the process of preparing decisions of national supervisory authorities when the dispute resolution mechanism between these authorities provided for in Article 65 of Regulation 2016/679 is implemented, which may result in the adoption of binding decisions by the EDPB in relation to national supervisory authorities. Article 62 of Regulation 2018/1725 provides only for coordination and assistance between the national supervisory authorities and the European Data Protection Supervisor, which takes the form in particular of their meeting at least twice a year within the framework of the EDPB, but not of a system in which the EDPB would adopt decisions binding on the European Data Protection Supervisor. The question of the uniform application of those two regulations, raised by the European Data Protection Supervisor, therefore does not arise in the present cases (see, by analogy, order of the President of the Court of Justice of 21 July 2023, WhatsApp Ireland v European Data Protection Board, C‑97/23 P, EU:C:2023:609, paragraph 14).
18      The European Data Protection Supervisor’s argument that the outcome of the present cases could have an impact on the performance of his tasks as an independent authority is therefore unfounded.
19      With regard to his task of advising the institutions and bodies of the European Union on all matters concerning the processing of personal data, the European Data Protection Supervisor submits that the present cases raise important questions of principle on the competence of the EDPB when adopting a decision that is binding on national supervisory authorities on the basis of Article 65(1)(a) of Regulation 2016/679. The functioning and effectiveness of the dispute resolution mechanism are at stake in the present cases. As part of his role advising the legislature, the European Data Protection Supervisor is regularly called upon to give his opinion on models to enforce the protection of personal data in the context of the development of the digital economy. These involve governance models and decision-making mechanisms to be implemented at EU level. The European Data Protection Supervisor provides examples in which he has been called upon to give his opinion, such as an opinion he delivered on a proposal for a regulation on transparency and targeting of political advertising. He is of the view that the outcome of the present cases will therefore be highly relevant and will have a direct impact on the performance of his advisory tasks.
20      Those arguments are not sufficient to establish that the European Data Protection Supervisor has a direct and existing interest in the result of the cases either. Whatever that result and its importance for the fulfilment, by the national supervisory authorities and the EDPB, of their respective tasks for the application of Regulation 2016/679 may be, it will have no impact on the performance of the European Data Protection Supervisor’s task of advising the institutions and bodies of the European Union on all matters concerning the processing of personal data. That task will be carried out whatever the circumstances and it will be for that authority, where appropriate, to issue advice, including advice to the legislature, in the light of that result. The mere fact that, as regards that task, the European Data Protection Supervisor is in favour, in the present cases, of the position defended by the EDPB and that he considers that these cases raise important issues for the protection of natural persons’ personal data is not sufficient to establish that he has an interest in the result of those cases within the meaning of the second paragraph of Article 40 of the Statute of the Court of Justice of the European Union. Otherwise, any body or agency of the European Union which supports the position of a party to a dispute before the Court of Justice of the European Union concerning its field of action and considers that the dispute raises important issues would have to be allowed to intervene. Other than in exceptional cases, an interest in the result of the case can be considered to be sufficiently direct only in so far as that result is capable of altering the legal position of the applicant to intervene (see order of the President of the Court of Justice of 11 March 2022, Silver and Others v Council, C‑499/21 P, not published, EU:C:2022:199, paragraph 7 and the case-law cited), which is not the case here, as stated above in the present paragraph.
21      The European Data Protection Supervisor also argues that he participated in the adoption of the contested decisions. He notes that he is a member of the EDPB, involved in this respect in the resolution of disputes between supervisory authorities provided for in Article 65 of Regulation 2016/679 which may relate in particular to the question of whether that regulation has been infringed. In the present cases he voted in favour of the contested decisions. He states that he was the lead rapporteur in the drafting of the EDPB guidelines for the implementation of that dispute resolution mechanism, which is of particular relevance. He therefore has an interest in supporting decisions such as the contested decisions. His intervention would shed light that would be useful for the judgment in the present cases.
22      It has been held that the bodies, offices and agencies of the European Union are likely to apply to intervene in a case before the Court of Justice of the European Union not to defend private interests or, as in the case of associations, interests connected with the objects set out in their statutes, but rather where the measure giving rise to the dispute was adopted following a procedure in which the body, office or agency in question was called upon to participate, in order to defend the opinion it had issued or the assessments it had made in the course of that procedure. In such a case, it has been held that the requirement that the relevant body, office or agency should have a direct and existing interest in the result of the case should be regarded as having been met, inter alia, if it is able to establish that the EU measure at issue was adopted following a procedure in which, in accordance with EU law, its participation is envisaged through, as the case may be, the adoption of opinions or the provision of assessments (order of the President of the Court of Justice of 17 September 2021, Parliament v Commission, C‑144/21, EU:C:2021:757, paragraphs 11 and 13). Such a case constitutes an exception to the principle that the interest of an applicant in intervention in the resolution of the dispute can be regarded as sufficiently direct only in so far as that resolution is of such a kind as to alter its legal position (see, to that effect, order of 12 April 2019, Algebris (UK) and Anchorage Capital Group v Commission, T‑570/17, not published, EU:T:2019:261, paragraph 21).
23      In the present cases, the European Data Protection Supervisor’s participation in the preparation of the contested decisions was limited, according to his arguments, to voting in favour of them within the EDPB, of which he is a member. A simple vote is not sufficient to transform participating in the preparation of a decision into having played a role therein. The situation is thus different from that of the lead supervisory authority for the cases examined in the context of the EDPB’s dispute resolution mechanism, since it is in relation to that authority’s draft decision that the EDPB’s binding decision is drawn up, and from that of the other supervisory authorities concerned which raised objections to that draft decision that were not accepted by the lead supervisory authority, which thus triggered the implementation of the EDPB’s dispute resolution mechanism. The European Data Protection Supervisor cannot therefore draw a sufficient argument from his participation in the vote within the EDPB in relation to the contested decisions to establish his interest in the result of the cases. It has also been held that such participation in favour of such decisions does not establish an specific interest, distinct from that of the EDPB (order of the President of the Court of Justice of 21 July 2023, WhatsApp Ireland v European Data Protection Board, C‑97/23 P, EU:C:2023:609, paragraph 17).
24      As for the argument that the European Data Protection Supervisor played a role in the preparation of the EDPB guidelines for the implementation of this dispute resolution mechanism, it is of the same kind as the arguments referred to in paragraph 19 above, which were found to be insufficient to establish his interest in the result of the present cases, in so far as that role in the preparation of such a general document is too remote from the particular procedures which led to the contested decisions in the present cases to be taken into account under the case-law referred to in paragraph 22 above. It has also been held that having played such a role does not establish a specific interest, distinct from that of the EDPB (order of the President of the Court of Justice of 21 July 2023, WhatsApp Ireland v European Data Protection Board, C‑97/23 P, EU:C:2023:609, paragraph 17).
25      Against that background and having regard to the above concerning the tasks of the European Data Protection Supervisor, the conclusion that the latter has no direct interest in the result of the case cannot be called into question merely by invoking the orders of 17 March 2005, Parliament v Council (C‑317/04, EU:C:2005:189) and Parliament v Commission (C‑318/04, EU:C:2005:190), which come within a different legal context which, moreover, is no longer in force.
26      It follows from all the foregoing that the European Data Protection Supervisor’s application to intervene cannot be accepted.
Costs
27      Under Article 133 of the Rules of Procedure of the General Court, a decision as to costs is to be given in the judgment or order which closes the proceedings. As this order closes the proceedings as far as the European Data Protection Supervisor is concerned, it is appropriate to give a decision on the costs relating to his application to intervene.
28      Under Article 134(1) of the Rules of Procedure, read in conjunction with Article 144(6) thereof, the unsuccessful prospective intervener is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings. Since the European Data Protection Supervisor has been unsuccessful in his application to intervene and neither the Irish Supervisory Authority nor the EDPB applied in that regard for costs, each of the three must be ordered to bear its own costs in relation to that application.
On those grounds,
THE PRESIDENT OF THE TENTH CHAMBER OF THE GENERAL COURT
hereby orders:
1.      The European Data Protection Supervisor’s application to intervene is dismissed.
2.      The European Data Protection Supervisor, the Data Protection Commission and the European Data Protection Board shall each bear their own costs relating to the application to intervene.
Luxembourg, 26 October 2023.
V. Di Bucci
O. Porchia
Registrar
President
*      Language of the case: English.