Luxembourg, 27 March 2025
OPINION OF ADVOCATE GENERAL ĆAPETA
delivered on 27 March 2025 (1)
Case C‑97/23 P
WhatsApp Ireland Ltd
v
European Data Protection Board
(Appeal – Protection of personal data – Regulation (EU) 2016/679 – Article 65 – Consistency mechanism – Dispute resolution by the European Data Protection Board – Action for annulment – First paragraph of Article 263 TFEU – Concept of ‘challengeable act’ – Fourth paragraph of Article 263 TFEU – Concept of ‘direct concern’ – Concepts of ‘preparatory act’ and ‘intermediate act’ – Question of the ‘non-enforceability’ of a decision against a natural or legal person – Discretion of the body implementing that decision)
I. Introduction
1. The present appeal raises the perennial question of the interpretation and application of the conditions for the admissibility of an action for annulment brought by applicants who are natural or legal persons. More specifically, the case concerns the concepts of ‘challengeable act’, for the purpose of the first paragraph of Article 263 TFEU, and of ‘direct concern’, within the meaning of the fourth paragraph of Article 263 TFEU.
2. That question arises in the context of the consistency mechanism provided for in Regulation (EU) 2016/679. (2) That mechanism consists of a composite procedure involving the participation of national supervisory authorities and the European Data Protection Board (EDPB).
3. In the order under appeal, the General Court considered inadmissible an action brought by WhatsApp Ireland Ltd (‘WhatsApp’ or ‘the appellant’) against Binding Decision 1/2021 (‘the contested decision’),(3) an EDPB decision adopted within the context of that mechanism. (4) Hence the present appeal. (5)
4. Beyond the appeal in this specific case, the Court of Justice has the opportunity to explain more generally how the rules on the admissibility of actions for annulment are to be applied to composite procedures.
II. Background
5. The present case arises out of the consistency mechanism introduced by the GDPR. More specifically, it concerns the part of that mechanism, provided for in Article 65 of the GDPR, according to which the EDPB is granted the power to adopt binding decisions by which it resolves certain types of disputes that arise among national supervisory authorities when they enforce the rules of the GDPR.
6. The consistency mechanism is one of numerous ‘composite administrative procedures’ established by EU secondary law. (6)
7. That term is used to describe procedures in which decision-making occurs in multiple steps, involving both EU and national institutions or bodies. (7)
8. One of the legal issues that arise in relation to such procedures is how to determine which of the acts adopted by multiple actors throughout that procedure constitute ‘challengeable acts’, and then before which courts such acts should be challenged. (8)
9. The present appeal must be placed in that context. The appellant considers that the General Court erroneously ruled that the contested decision, adopted under the consistency mechanism, is not an act challengeable before the EU Courts.
[…]
IV. Conclusion
195. I propose that the Court of Justice should:
– set aside the order of 7 December 2022, WhatsApp Ireland v European Data Protection Board (T‑709/21, EU:T:2022:783);
– declare the appellant’s action for annulment admissible;
– refer the case back to the General Court for a decision on the merits; and
– order that the costs be reserved.
Read the the full opinion
Source – Curia