EDPB accountability: could Binding Decisions be challenged?

A step towards EDPB accountability? Advocate General sides with WhatsApp in CJEU case on whether EDPB binding decisions can be challenged directly. Sure, it’s “just” an AG Opinion, but it’s well researched and argued. What it says:

1. What is a challengeable act?

The AG says that some circumstances are *irrelevant* to assessing whether an act of an EU institution can be challenged before the EU General Court (GCEU).

Notably, it doesn’t matter if an act is an “intermediary act” (like an EDPB Binding Decision, which precedes a decision by the relevant supervisory authority [SA]) – the only question is whether the act is a “final and binding act” in and of itself. And yes, a Binding Decision is “the EDPB’s final position” and “that decision imposed an obligation on someone outside of that body” (the SA, in this case the Irish DPC).
[see paras. 42 & 44, plus 70 & 82]

Also: “all acts (of the EU institutions and other bodies), notwithstanding their form or name, that are intended to have binding legal effects are challengeable acts” [para. 74].

Does that act need to bring about “a distinct change” in the legal position of an applicant? That’s a question for “is there direct concern?”, not for “is it challengeable?” [para. 83].

Para. 113 stresses that “intermediary”/”preparatory” is only a relevant criterion when comparing to a final decision *by the same body*, and para. 117 concludes that “As that decision is final, and as it produces binding legal effects outside of [the EDPB], that is to say, vis-à-vis the Irish [SA]”, the GCEU should have concluded that the EDPB Binding Decision was a challengeable act.

Additional considerations: this paves the way for challenges to Art. 64 GDPR Opinions of the EDPB (as they are clearly binding upon SAs).

2. Who has “direct concern”?

To challenge a challengeable act, you need to be directly concerned. This requires 2 criteria to be met: (i) “the contested measure must directly affect the legal situation of that person”; (ii) “it must leave no discretion to its addressees who are entrusted with the task of implementing it, such implementation being purely automatic and resulting from EU rules alone without the application of other intermediate rules” [para. 128].
Yet “the challenged measure could directly affect the legal situation of the applicant only if the implementing body had no choice as to whether and how to implement that measure” [para. 130].

Paras. 138 ff. show that enforceability of the EDPB act is irrelevant. What matters is whether the SA has any discretion in implementing the EDPB’s act – and the AG says “no” in paras. 155-157.

What if an EDPB act doesn’t cover everything? Not a problem, a challenge before the GCEU on the scope of the EDPB act remains possible, and a national challenge against the SA decision on all other points. [see 164]

3. The AG’s conclusion? The challenge was admissible. Let’s see what the CJEU says.

Link: https://lnkd.in/eQh-_tgs
Data protection privacy