ORDER OF THE GENERAL COURT (Second Chamber)
22 November 2017 (*)
(Action for annulment — Area of freedom, justice and security — Protection of natural persons with regard to the processing of personal data — Transfer of personal data to the United States — Not-for-profit company incorporated under Irish law — No protection of personal data for legal persons — Controller — Action in the name of members and supporters — Action in the public interest — Inadmissible)
In Case T‑670/16,
Digital Rights Ireland Ltd, established in Bennettsbridge (Ireland), represented by E. McGarr, Solicitor,
applicant,
v
European Commission, represented by H. Kranenborg and D. Nardi, acting as Agents,
defendant,
APPLICATION based on Article 263 TFEU and seeking annulment of Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield (OJ 2016 L 207, p. 1),
THE GENERAL COURT (Second Chamber),
composed of M. Prek, President, E. Buttigieg and B. Berke (Rapporteur), Judges,
Registrar: E. Coulon,
makes the following
Order
Background to the dispute
1 Pursuant to Article 25(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31), Member States are required to provide that the transfer to a third country of personal data which are undergoing processing or are intended for processing after transfer may take place only if, without prejudice to compliance with the national provisions adopted pursuant to the other provisions of that directive, the third country in question ensures an adequate level of protection.
2 According to Article 25(5) of Directive 95/46, where the European Commission finds that a third country does not ensure an adequate level of protection, it is required to enter into negotiations with a view to remedying that situation.
3 In addition, Article 25(6) of Directive 95/46 provides that the Commission may find that a third country ensures an adequate level of protection, within the meaning of paragraph 2 of that Article, by reason of its domestic law or of the international commitments it has entered into, particularly upon conclusion of the negotiations referred to in paragraph 5, for the protection of the private lives and basic freedoms and rights of individuals.
4 Following the judgment of 6 October 2015, Schrems (C‑362/14, EU:C:2015:650), which declared invalid Commission Decision 2000/520/EC of 26 July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the safe harbour privacy principles and related frequently asked questions issued by the US Department of Commerce (OJ 2000 L 215, p. 7), the Commission entered into negotiations with the United States of America with a view to strengthening the protection of personal data transferred from the European Union.
5 After examining the legislation of the United States of America and its official commitments, the Commission adopted Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield (OJ 2016 L 207, p. 1) (‘the contested decision’) by which it found, essentially, that the United States of America ensures an adequate level of protection for personal data transferred from the European Union to organisations in the United States under the EU-U.S. Privacy Shield (‘the Privacy Shield’).
6 The effect of the contested decision is to authorise the transfer to the United States of personal data undergoing processing or intended for processing after transfer to organisations in the United States which are covered by the Privacy Shield.
Procedure and forms of order sought
7 On 16 September 2016 the applicant, Digital Rights Ireland, brought the present action. Digital Rights Ireland is a not-for-profit company incorporated under Irish law which has as its essential object the defence of individual internet freedoms.
8 By documents lodged at the Registry of the General Court on 12, 14, 16, 20, 22 and 29 December 2016, the Czech Republic, the Federal Republic of Germany, Ireland, the United Kingdom of Great Britain and Northern Ireland, the United States of America, the Kingdom of the Netherlands, Business Software Alliance (BSA), the French Republic and Microsoft Corporation applied for leave to intervene in support of the form of order sought by the Commission.
9 By separate documents lodged at the Court Registry on 19 and 22 December 2016, La Quadrature du Net, French Data Network, Fédération des Fournisseurs d’Accès à Internet Associatifs and the Union fédérale des consommateurs - Que choisir (UFC - Que choisir) applied for leave to intervene in support of the form of order sought by Digital Rights Ireland.
10 By separate document lodged at the Court Registry on 23 December 2016, the Commission raised an objection of inadmissibility under Article 130 of the Rules of Procedure of the General Court.
11 On 15 February 2017 the applicant submitted its observations on that objection of inadmissibility.
12 On 18 July 2017 the Court put a question to the applicant in relation to whether it had an interest in bringing proceedings against the contested decision.
13 On 1 August 2017 the applicant replied to the Court’s question.
14 The applicant claims that the Court should:
– declare the action admissible;
– order the Commission to pay the costs.
15 The Commission contends that the Court should:
– declare the action inadmissible;
– order the applicant to pay the costs.
Law
16 Under Article 130(1) of the Rules of Procedure, if a party submits an application to that effect, the Court may decide on an objection of inadmissibility without going to the substance of the case. Pursuant to Article 130(6) of those rules, the Court may decide to open the oral part of the procedure in respect of that application.
17 In the present case, the Court considers that it has sufficient information from the documents in the file and from the applicant’s reply to the question asked and has decided that there is no need to open the oral procedure.
18 Under the fourth paragraph of Article 263 TFEU, ‘[a]ny natural or legal person may, under the conditions laid down in the first and second paragraphs, institute proceedings against an act addressed to that person or which is of direct and individual concern to them, and against a regulatory act which is of direct concern to them and does not entail implementing measures’.
19 In addition, an action for annulment brought by a natural or legal person is admissible only in so far as the applicant has an interest in the annulment of the contested measure (see order of 26 March 2014, Adorisio and Others v Commission, T‑321/13, not published, EU:T:2014:175, paragraph 20 and the case-law cited).
20 Such an interest presupposes that the annulment of that measure must be capable, in itself, of having legal consequences or that the action may, through its outcome, procure an advantage for the party which has brought it (see, to that effect, judgment of 28 May 2013, Abdulrahim v Council and Commission, C‑239/12 P, EU:C:2013:331, paragraph 61, and order of 26 March 2014, Adorisio and Others v Commission, T‑321/13, not published, EU:T:2014:175, paragraph 21 and the case-law cited).
21 The applicant considers that it is entitled to bring an action both in its own name and on behalf of its members, its supporters and the general public.
Admissibility of the action brought by the applicant in its own name
22 In order to demonstrate the admissibility of the action in its own name, the applicant puts forward three series of arguments. The Court considers it appropriate to verify whether those arguments make it possible to demonstrate the existence of an interest in bringing proceedings within the meaning of the case-law cited in paragraphs 19 and 20 above.
23 In the first place, the applicant argues that, given that it possesses a mobile phone and a computer, its own personal data are liable to be transferred to the United States pursuant to the contested decision.
24 However, in its capacity as a legal person, the applicant does not possess personal data within the meaning of Directive 95/46, which provides for the protection of personal data only in respect of natural persons.
25 Moreover, in accordance with the case-law, in so far as the protection of personal data guaranteed by Article 8 of the Charter of Fundamental Rights of the European Union concerns any information relating to an identified or identifiable individual, legal persons can claim the protection of that provision only in so far as the official title of the legal person identifies one or more natural persons (see, to that effect, judgments of 9 November 2010, Volker und Markus Schecke and Eifert, C‑92/09 and C‑93/09, EU:C:2010:662, paragraphs 52 and 53, and of 17 December 2015, WebMindLicenses, C‑419/14, EU:C:2015:832, paragraph 79).
26 As the applicant is a legal person and its official title does not identify any natural person, it cannot avail of the protection of personal data.
27 The contested decision is thus incapable of breaching any right to protection of personal data of the applicant.
28 The annulment of the contested decision, therefore, is not capable of having, in itself, legal consequences for the applicant or of procuring for it an advantage in that regard.
29 In the second place, according to the applicant, the contested decision affects its situation as controller of the personal data of its supporters.
30 In that regard, Article 2(b) of Directive 95/46 defines the processing of personal data as any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.
31 Moreover, under Article 2(d) of that directive a controller is defined as the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data.
32 It is also apparent from recital 47 of Directive 95/46 that, where a message containing personal data is transmitted by means of a telecommunications or electronic mail service, the sole purpose of which is the transmission of such messages, the controller in respect of the personal data contained in the message will normally be considered to be the person from whom the message originates, rather than the person offering the transmission services. However, those offering such services will normally be considered controllers in respect of the processing of the additional personal data necessary for the operation of the service.
33 In collecting the personal data of its supporters and, as the case may be, transmitting them by electronic mail, the applicant therefore acts as controller in respect of those data.
34 However, recital 14 of the contested decision specifies that the Privacy Shield applies to American organisations, whether they act as controller or as processor. It is also apparent from recital 15 of that decision that the principles of the Privacy Shield apply to the processing of personal data by an American organisation only if that processing does not fall within the scope of EU legislation, and that the Privacy Shield does not affect the application of EU legislation governing the processing of personal data in the Member States.
35 The contested decision therefore applies to European controllers only in so far as it authorises them to carry out transfers to American organisations that are covered by the Privacy Shield.
36 The contested decision thus has the effect of entitling the applicant to carry out transfers under certain conditions. It does not restrict its rights or impose obligations on it.
37 Consequently, the annulment of the contested decision is not capable of procuring for it an advantage as controller.
38 In the third place, the applicant claims that there is a risk that the use of electronic communication services to process the data of which it is controller will result in their transfer to the United States by a provider of those services.
39 It thus argues, essentially, that it would be placing itself in an unlawful situation if it had to apply the contested decision and infers from that decision that it would undermine its obligation — laid down in Article 17 and Directive 95/46 as well as by Irish law — to ensure the lawful processing of data of which it is controller.
40 However, such a transfer of data for which it is responsible would, by definition, be made by an electronic communication service in accordance with the applicable rules, as they follow from, inter alia, the contested decision.
41 In those circumstances, that transfer could be regarded as a breach, by the applicant, of its obligation to ensure the lawful processing of data of which it is controller. The applicant could not be criticised for having breached its obligation of lawful processing by having carried out a transfer of personal data in accordance with the applicable rules.
42 Since implementation of the contested decision in the situation outlined by the applicant would not result in a breach of its obligations, annulment of that decision is likewise incapable of procuring for it any advantage in that regard.
43 The applicant thus does not have an interest in bringing proceedings.
44 In those circumstances, it is not necessary to rule on the applicant’s arguments concerning its individual concern or on the categorisation of the decision as issue as an act that does not entail implementing measures within the meaning of the final limb of the fourth paragraph of Article 263 TFEU.
Admissibility of the action brought by the applicant in the name of its members, its supporters and the general public
45 According to settled case-law, actions brought by associations are admissible in three situations, namely where they represent the interests of persons who, for their part, would have standing to take action, or where they are individually identified by reason of the impact on their interests as an association, particularly because their position of negotiator has been affected by the act the annulment of which is sought, or again where a legal provision expressly grants them a number of powers of a procedural nature (see order of 23 November 2015, Milchindustrie-Verband and Deutscher Raiffeisenverband v Commission, T‑670/14, EU:T:2015:906, paragraph 14 and the case-law cited).
46 In that regard, the applicant claims, on the one hand, to represent the interests of its members and supporters and, on the other hand, to act in the public interest on the basis of provisions of EU law which have opened the possibility of bringing an actio popularis in the public interest.
47 First of all, as the Commission argues, without being contradicted by the applicant, it must be stated that the applicant is not an association and cannot, therefore, rely on the case-law relating to the admissibility of actions brought by associations in the name of their members.
48 In any event, in so far as the applicant claims to be bringing the present action in the name of its members and supporters, it must be noted that it does not demonstrate that it has been empowered to bring legal actions in the name and on behalf of those members and supporters with a view to protecting their personal data.
49 Nor, moreover, does the applicant’s involvement in judicial proceedings at national and EU level allow its standing to be established since that involvement did not confer on the applicant a clearly circumscribed position as negotiator, within the meaning of the case-law, in the procedure which resulted in the adoption of the contested decision (see, to that effect, judgments of 2 February 1988, Kwekerij van der Kooy and Others v Commission, 67/85, 68/85 and 70/85, EU:C:1988:38, paragraph 21; of 24 March 1993, CIRFS and Others v Commission, C‑313/90, EU:C:1993:111, paragraph 30; and of 9 July 2009, 3F v Commission, C‑319/07 P, EU:C:2009:435, paragraph 88).
50 Next, it follows from the existence of specific conditions governing the admissibility of actions for annulment brought by individuals, provided for in Article 263 TFEU, that EU law does not, in principle, allow for the possibility of an applicant to bring an actio popularis in the public interest.
51 In that regard, Article 10a of Council Directive 85/337/EEC of 27 June 1985 on the assessment of the effects of certain public and private projects on the environment (OJ 1985 L 175, p. 40), as amended by Directive 2003/35/EC of the European Parliament and of the Council of 26 May 2003 (OJ 2003 L 156, p. 17), and Article 9(3) of the Convention on Access to Information, Public Participation in Decision-Making and Access to Justice in Environmental Matters, signed in Aarhus on 25 June 1998, relied on by the applicant, are not applicable to the protection of personal data.
52 Last, so far as concerns the applicant’s argument that its action should be declared admissible pursuant to recital 142 and Article 80(2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 (General Data Protection Regulation) (OJ 2016 L 119, p. 1), pursuant to which Member States may provide for any body, organisation or association to have the right to lodge a complaint with the competent supervisory authority in that Member State, independently of a data subject’s mandate, if it considers that the rights of a data subject under that regulation have been infringed as a result of processing, suffice it to point out that that regulation will apply only as from 25 May 2018.
53 Consequently, the applicant does not have standing to act in the name of its members and supporters or on behalf of the general public.
54 The action is therefore inadmissible.
The applications to intervene
55 Pursuant to Article 142(2) of the Rules of Procedure, intervention is ancillary to the main proceedings and becomes devoid of purpose, inter alia, where the application is declared inadmissible.
56 Consequently, there is no longer any need to adjudicate on the applications to intervene.
Costs
57 Under Article 134(1) of the Rules of Procedure, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings.
58 As the applicant has been unsuccessful, it must be ordered to pay the costs, in accordance with the form of order sought by the Commission.
59 Pursuant to Article 144(10) of the Rules of Procedure, if the proceedings in the main case are concluded before the application to intervene has been decided, the applicant for leave to intervene is to bear its own costs.
60 In the present case, the Czech Republic, the Federal Republic of Germany, Ireland, the United Kingdom of Great Britain and Northern Ireland, the United States of America, the Kingdom of the Netherlands, the French Republic, BSA, Microsoft Corporation, La Quadrature du Net, French Data Network, Fédération des Fournisseurs d’Accès à Internet Associatifs and UFC - Que choisir shall therefore bear their own costs.
On those grounds,
THE GENERAL COURT (Second Chamber)
hereby orders:
1. The action is inadmissible.
2. There is no longer any need to adjudicate on the applications to intervene of the Czech Republic, the Federal Republic of Germany, Ireland, the United Kingdom of Great Britain and Northern Ireland, the United States of America, the Kingdom of the Netherlands, the French Republic, Business Software Alliance (BSA), Microsoft Corporation, La Quadrature du Net,French Data Network, Fédération des Fournisseurs d’Accès à Internet Associatifs and the Union fédérale des consommateurs - Que choisir (UFC - Que choisir).
3. Digital Rights Ireland Ltd shall pay the costs, with the exception of those relating to the applications to intervene.
4. The Czech Republic, the Federal Republic of Germany, Ireland, the United Kingdom of Great Britain and Northern Ireland, the United States of America, the Kingdom of the Netherlands, the French Republic, BSA, Microsoft Corporation, La Quadrature du Net,French Data Network, Fédération des Fournisseurs d’Accès à Internet Associatifs and UFC - Que choisir shall bear their own respective costsrelating to the applications to intervene.
Luxembourg, 22 November 2017.