EDPB accountability: are Guidelines and Opinions challengeable?

Are Guidelines of the European Data Protection Board “challengeable acts”, and could you attack them before the General Court of the EU? What about Art. 64 GDPR Opinions of the EDPB? The Advocate General’s Opinion in the WhatsApp v EDPB case (re EDPB Binding Decisions) suggests that the answer could be “yes” regarding those Art. 64 GDPR Opinions of the EDPB and potentially even re Guidelines of the EDPB.

Why?

Ultimately, the challengeable nature of an act and the possibility for someone to file proceedings for the annulment of that act comes down to 2 elements, based on the AG’s Opinion:
1. Is the act intended to have binding legal effects? [para. 74 of the Opinion] If so, it is challengeable
2. Does the act directly affect the legal situation of the person making the claim, and does it leave any discretion to the addressee (= the Supervisory Authority / SA)?

I have always held that it makes sense for the EDPB to be accountable.

Its Binding Decisions are clearly intended to bind the relevant SA, and it is obvious that the relevant SA has no discretion in relation to the points decided by the EDPB, so it’s a pity that the EDPB even opposed the arguments brought by WhatsApp in the case in question (T‑709/21 before the General Court / C‑97/23 P before the Court of Justice).
We’ll obviously see what the CJEU thinks in this case, now the AG has issued her Opinion.

Regarding Art. 64 GDPR Opinions, like the “AI models & GDPR” one, the “biometrics in airports” one or the “Consent or Pay” one, are clearly intended to be binding and to leave no discretion. If a SA goes in another direction, the GDPR regulates the manner of bringing this before the EDPB… so no chance in practice of a SA deviating from those Opinions. They are “opinions” in name only.
Here, we’ll see what the General Court says in Meta’s case against the “Consent or Pay” Opinion.

Regarding Guidelines, there is an interesting de facto binding nature, as SAs have not yet (to my knowledge) sought to question, avoid or disapply Guidelines. Do they have a direct effect? Is there any discretion? The EDPB and SAs will likely argue that no, but I think the argument is worth making:
(i) they are authoritative & are not questioned by SAs (=> no discretion in practice)
(ii) data subjects rely on them to file complaints (yes, I have seen this often)
So controllers/processors are de facto required, when Guidelines are adopted, to either comply with them OR to document why they disagree.

Sure, there might not be immediate and specific enforcement against a particular controller, but that controller needs to take the risk of that enforcement into account too and in some cases to incur significant costs to that end.

In other words, their legal situation *is* directly impacted, and in the absence of SA deviation “discretion” seems to be an illusion.

Worth thinking about!

***

Read my analysis of the AG’s Opinion in the WhatsApp v EDPB case: https://lnkd.in/ev5P6Pi8

Data protection privacy