Data Protection Commission v European Data Protection Board - 29 January 2025

• Judgment Date: 29 January 2025
• Issuer: Court of Justice of the European Union
• Year: 2025

Start printing

Language of document : English French ECLI:EU:T:2025:116

JUDGMENT OF THE GENERAL COURT (Tenth Chamber, Extended Composition)

29 January 2025 (*) (1)

( Protection of personal data – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision instructing a lead supervisory authority to broaden the scope of its investigation and issue a new draft decision – Competence of the European Data Protection Board )

In Joined Cases T‑70/23, T‑84/23 and T‑111/23,

Data Protection Commission, established in Dublin (Ireland), represented by D. Young, A. Bateman, R. Minch, M. Delargy, K. Donnelly, Solicitors, B. Kennelly, Senior Counsel, D. Fennelly, E. Synnott and R. Costello, Barristers-at-Law,

applicant,

v

European Data Protection Board, represented by I. Vereecken, C. Foglia and M. Gufflet, acting as Agents, and by G. Ryelandt, E. de Lophem and P. Vernet, lawyers,

defendant,

THE GENERAL COURT (Tenth Chamber, Extended Composition),

composed of O. Porchia, President, M. Jaeger, L. Madise (Rapporteur), P. Nihoul and S. Verschuur, Judges,

Registrar: M. Zwozdziak-Carbonne, Administrator,

having regard to the written part of the procedure,

further to the hearing on 16 April 2024,

gives the following

Judgment

1 By its actions under Article 263 TFEU, the applicant, the Data Protection Commission, which is the Irish supervisory authority for personal data protection, seeks annulment in part of Binding Decisions 3/2022, 4/2022 and 5/2022 of 5 December 2022 of the European Data Protection Board (‘the EDPB’) on the disputes between the supervisory authorities concerned arising from the Data Protection Commission’s draft decisions regarding, respectively, the social network Facebook, the social network Instagram and the messaging service WhatsApp, in so far as those binding decisions require it to carry out new investigations into the processing of data carried out in connection with the use of those applications and to issue new draft decisions on the basis of the results thereof.

Facts and proceedings

2 In 2018, three individuals living in Belgium, Germany and Austria, respectively, each lodged, through the non-profit association ‘NOYB – European Center for Digital Rights’, before the respective data protection supervisory authority of their place of residence, complaints against Facebook Ireland Ltd (which, in 2022, became Meta Platforms Ireland Ltd; ‘Meta’), regarding the processing of data in connection with the use of Facebook and Instagram, and against WhatsApp Ireland Ltd (‘WhatsApp’), regarding the processing of data in connection with the use of the messaging service WhatsApp.

3 Given the cross-border nature of the processing of personal data in connection with the use of those applications and the place of establishment of Meta and WhatsApp in Ireland, the applicant is the lead supervisory authority responsible for handling those complaints in accordance with Article 56(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1). Following the three investigations that it carried out, that authority submitted to the other supervisory authorities concerned, namely all the supervisory authorities of the Member States and other States party to the Agreement on the European Economic Area (EEA), three draft decisions, as provided for in Article 60(3) of Regulation 2016/679.

4 The complaints giving rise to the three procedures alleged possible infringements of several provisions of Regulation 2016/679, in particular Articles 6 and 9. Article 6(1) lists the alternative general conditions governing the lawfulness of processing personal data, while Article 9 specifically concerns the alternative conditions under which special categories of personal data, considered to be sensitive, such as data revealing opinions or beliefs, racial or ethnic origin, health or sexual orientation, may be processed. In its three draft decisions, the applicant considered, inter alia, that the complainants had failed to demonstrate that Meta and WhatsApp could not rely on one of the conditions laid down in Article 6(1) of Regulation 2016/679, namely the one referred to in Article 6(1)(b), which does not require the consent of the data subjects for the processing of their personal data, in order to justify the lawfulness of data processing carried out in connection with the use of the social networks Facebook and Instagram and the messaging service WhatsApp.

5 A number of the other supervisory authorities concerned raised objections to the applicant’s assessments, in particular as regards the targeted advertising which the users of the social networks Facebook and Instagram and the messaging service WhatsApp might be subjected to on the basis of their behaviour on those applications. Some supervisory authorities also drew attention to the fact that failure to obtain users’ consent for the processing of data coming within the scope of Article 9 of Regulation 2016/679 would result in an infringement of that provision and stressed that the applicant should broaden its investigations in order to determine whether and how Meta and WhatsApp processed such data.

6 Following discussions with the other supervisory authorities concerned, the applicant found that a consensus had not been reached in respect of the objections to its draft decisions and submitted the matter to the EDPB in the context of the consistency mechanism established in Regulation 2016/679, in accordance with Article 60(4) of that regulation.

7 Following the examination of the three files, the EDPB adopted Binding Decisions 3/2022, 4/2022 and 5/2022 on 5 December 2022 under Article 65(1)(a) of Regulation 2016/679. In those three binding decisions, the EDPB first of all took the view that most of the objections to the applicant’s draft decisions were relevant and reasoned, within the meaning of Article 4(24) of Regulation 2016/679, and that it was able to adopt a position on the issues which they raised. In that regard, the EDPB endorsed the merits of a number of those objections which it had considered relevant and reasoned.

8 In particular, the EDPB did not follow the applicant in its analysis that Meta and WhatsApp could, a priori, rely on Article 6(1)(b) of Regulation 2016/679 to justify the lawfulness of the data processing that they carried out in connection with the use of the three applications in question. Therefore, by the three Binding Decisions 3/2022, 4/2022 and 5/2022, it demanded that the applicant exclude from its final decisions the findings relating to that analysis, including, where appropriate, the finding that it was not necessary to have the users’ consent for the data processing carried out. By contrast it required it to find in its three final decisions certain infringements of Regulation 2016/679, in particular of Article 6(1), and to adopt corrective measures in respect of Meta and WhatsApp.

9 Furthermore, in its three binding decisions, the EDPB also endorsed the objections that it had considered relevant and reasoned relating to the excessively narrow scope of the analyses and investigations carried out by the applicant. In view of the removal of the findings referred to in paragraph 8 above, the issues raised by a number of the supervisory authorities concerned, in particular as regards the processing of data referred to in Article 9 of Regulation 2016/679, and the uncertainty highlighted by the complainants over what was done with those data, the EDPB decided, first, that the applicant had to carry out new investigations to determine whether the processing operations performed by Meta and WhatsApp related to those special categories of personal data and whether those companies complied in that regard with the relevant obligations laid down in Regulation 2016/679, and, second, that the applicant then had to issue new draft decisions in that regard in accordance with Article 60(3) of the same regulation, in addition to the three final decisions which it already had to adopt.

10 Thus, the second sentence in points 198 and 487 (summary operative part) of Binding Decision 3/2022 and in points 203 and 454 (summary operative part) of Binding Decision 4/2022 is worded as follows:

‘The EDPB decides that the [applicant] shall carry out a new investigation into [Meta’s] processing operations [with regard to its applications Facebook and Instagram] to determine if it processes special categories of personal data (Article 9 [of Regulation 2016/679]) and complies with the relevant obligations under [Regulation 2016/679], to the extent that this new investigation complements the findings made in [its final decisions] adopted on the basis of [these binding decisions], and based on the results of this investigation, issue a new draft decision in accordance with Article 60(3) [of Regulation 2016/679]’.

11 In points 222 and 326.8 (summary operative part) of Binding Decision 5/2022, the EDPB instructed the applicant, first, to carry out a new investigation in order to determine (i) whether the processing operations carried out by WhatsApp in the context of its WhatsApp messaging service relate to special categories of personal data, within the meaning of Article 9 of Regulation 2016/679, and whether they are used for targeted advertising based on user behaviour, marketing or the provision of metrics to third parties and the exchange of data with affiliated companies for the purpose of improving the service, and (ii) if WhatsApp complies in that regard with the obligations set out in Regulation 2016/679 and, second, to issue a new draft decision under Article 60(3) of that regulation.

12 In the present actions, lodged on 14, 17 and 24 February 2023, the applicant disputes the EDPB’s power to impose on it, in the context...