ORDER OF THE PRESIDENT OF THE COURT
29 November 2023 (*)
(Appeal – Application to intervene – Second paragraph of Article 40 of the Statute of the Court of Justice of the European Union – Interest in the result of the case – Application submitted by the European Data Protection Board – Admission to intervene)
In Case C‑413/23 P,
APPEAL under Article 56 of the Statute of the Court of Justice of the European Union, brought on 5 July 2023,
European Data Protection Supervisor (EDPS), represented by P. Candellier, G. Devin, X. Lareo, D. Nardi and T. Zerdick, acting as Agents,
appellant,
the other parties to the proceedings being:
Single Resolution Board (SRB), represented by H. Ehlers, M. Fernández Rupérez and A. Lapresta Bienz, acting as Agents, and by M. Braun and H.‑G. Kamann, Rechtsanwälte, and F. Louis, avocat,
applicant at first instance,
supported by:
European Commission, represented by A. Bouchagiar and H. Kranenborg, acting as Agents,
intervener in the appeal,
THE PRESIDENT OF THE COURT,
having regard to the proposal of T. von Danwitz, Judge-Rapporteur,
after hearing the Advocate General, A.M. Collins,
makes the following
Order
1 By its appeal, the European Data Protection Supervisor (EDPS) asks the Court of Justice to set aside the judgment of the General Court of the European Union of 26 April 2023, SRB v EDPS (T‑557/20, EU:T:2023:219), by which the General Court annulled the revised decision of the EDPS of 24 November 2020 adopted following the request from the Single Resolution Board (SRB) for review of the decision of the EDPS of 24 June 2020 concerning five complaints submitted by several complainants (Cases 2019-947, 2019-998, 2019-999, 2019-1000 and 2019-1122) (‘the contested decision’).
2 By document lodged at the Court Registry on 22 September 2023, the European Data Protection Board applied, on the basis of the second paragraph of Article 40 of the Statute of the Court of Justice of the European Union and Article 130 and Article 190(2) of the Rules of Procedure of the Court of Justice, for leave to intervene in support of the form of order sought by the EDPS.
3 In support of its application to intervene, the European Data Protection Board submits that it has a direct and existing interest in the result of the case submitted to the Court in the light of the tasks attributed to it by the EU legislature. In that regard, it states that the contested decision is based on the provisions of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ 2018 L 295, p. 39).
4 According to the European Data Protection Board, however, those provisions, and the issues raised by the present appeal, overlap and intersect inseparably with those of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1, ‘the GDPR’), and therefore also with the tasks conferred on it under the latter regulation. Those two regulations, it is submitted, should be interpreted uniformly.
5 The European Data Protection Board adds that the concept of ‘personal data’, within the meaning of Article 3(1) of Regulation 2018/1725, at issue in the present case and defined in identical terms in Article 4(1) of the GDPR, is inextricably linked to its guidance role relating to the adoption of guidelines on that concept and that of ‘pseudonymisation’, to its role in advising the European Commission and to its role in the consistency mechanism, requiring it to clarify in concrete cases the application of those concepts, stemming from Articles 64 and 65 and Article 70(1) of the GDPR.
6 Following service on the parties by the Registrar of the Court of Justice of that application to intervene, in accordance with Article 131(1) of the Rules of Procedure, applicable to the appeal proceedings pursuant to Article 190(1) of those rules, the EDPS lodged its written observations within the period prescribed and expressed its support for the application to intervene. The SRB did not lodge any observations within the period prescribed.
The application to intervene
7 The first paragraph of Article 40 of the Statute of the Court of Justice of the European Union provides that Member States and institutions of the Union may intervene in cases before the Court. Under the first sentence of the second paragraph of that article, the same right is open to the bodies, offices and agencies of the Union and to any other person which can establish an interest in the result of a case submitted to the Court.
8 Since the right to intervene enjoyed by the European Data Protection Board, as a body of the Union, derives from the second paragraph of Article 40 of that statute, the European Data Protection Board must establish an interest in the result of the case in order to exercise that right in a specific case.
9 In accordance with the Court’s settled case-law, the concept of an ‘interest in the result of a case’, within the meaning of that provision, must be defined in the light of the precise subject matter of the case and be understood as meaning a direct, existing interest in the ruling on the form of order sought, and not as an interest in relation to the pleas in law raised or the arguments put forward. The words ‘result of a case’ refer to the final decision sought, as set out in the operative part of the future judgment or order (order of the President of the Court of 1 September 2022, Google and Alphabet v Commission, C‑48/22 P, EU:C:2022:667, paragraph 5 and the case-law cited).
10 Furthermore, so far as concerns applications to intervene from bodies, offices and agencies of the Union, the Court is to apply the requirement that the applicant have a direct and existing interest in the result of the case in a way that reflects the specificity of the mandate which such an applicant is called upon to fulfil pursuant to EU law (order of the President of the Court of 3 March 2022, Commission v Council, C‑551/21, EU:C:2022:163, paragraph 16 and the case-law cited).
11 In the present case, in accordance with Article 70(1)(a) and (e) of the GDPR, the European Data Protection Board ensures the consistent application of the GDPR. To that end, its task is, inter alia, to monitor and ensure the correct application of that regulation in the cases provided for in Articles 64 and 65 thereof, and to issue guidelines, recommendations and best practice in order to encourage consistent application of that regulation.
12 It also follows from recital 17 of the GDPR that the legal acts of the Union applicable to the processing of personal data by the institutions, bodies, offices and agencies of the Union are to be applied in the light of the GDPR. In addition, under recital 5 of Regulation 2018/1725, in the interest of a coherent approach to personal data protection throughout the Union, whenever the provisions of that regulation follow the same principles as the provisions of the GDPR, those two sets of provisions should be interpreted ‘homogeneously’, in particular because the scheme of Regulation 2018/1725 should be understood as being equivalent to the scheme of the GDPR.
13 Given the existence of such links between the protection schemes provided for by the GDPR and Regulation 2018/1725, the decision to be taken will have a direct impact on the tasks entrusted to the European Data Protection Board by the EU legislature. The concept of ‘personal data’ at issue in the present case is relevant in the context of each of those two schemes and is decisive in defining the scope of the GDPR and, consequently, of those tasks and the remit of the supervisory authorities whose disputes the European Data Protection Board is required to settle by means of binding decisions, pursuant to Article 65 of the GDPR. In addition, the European Data Protection Board will be required, in particular, to adapt the content of the guidelines which it is called upon to issue to, inter alia, its members, including the EDPS, depending on how the decision to be taken is interpreted.
14 In that regard, it should be noted that the appeal specifically seeks to challenge the interpretation of the concept of ‘personal data’, within the meaning of Article 3(1) of Regulation 2018/1725, adopted by the General Court in its judgment of 26 April 2023, SRB v EDPS (T‑557/20, EU:T:2023:219), which led the General Court to annul the contested decision, as well as that of ‘pseudonymisation’ referred to in Article 3(6) of the same regulation. Indeed, those concepts are defined in identical terms in Article 4(1) and (5) of the GDPR and, in the light of recital 5 of Regulation 2018/1725, are to be interpreted uniformly, given that the same concept is invoked in the context of two schemes which should be understood as being equivalent.
15 It follows that the European Data Protection Board has established an interest in the result of the case and its application for leave to intervene in support of the form of order sought by the EDPS must therefore be granted.
The procedural rights of the intervener
16 Since the application to intervene has been allowed, the European Data Protection Board will receive a copy of every procedural document served on the parties, pursuant to Article 131(3) of the Rules of Procedure.
17 In accordance with Article 132(1) of the Rules of Procedure, the European Data Protection Board may submit a statement in intervention within one month after the communication referred to in the preceding paragraph.
18 Lastly, the European Data Protection Board will be able to submit oral observations if a hearing is organised.
Costs
19 Under Article 137 of the Rules of Procedure, applicable to proceedings on appeal pursuant to Article 184(1) of those rules, a decision as to costs is to be given in the judgment or order which closes the proceedings.
20 Since the application to intervene submitted by the European Data Protection Board has been granted, the costs relating to that intervention are reserved.
On those grounds, the President of the Court hereby orders:
1. The European Data Protection Board is granted leave to intervene in Case C‑413/23 P, in support of the form of order sought by the European Data Protection Supervisor (EDPS).
2. A copy of every procedural document shall be served on the European Data Protection Board by the Registrar.
3. The European Data Protection Board shall have one month from the date of service referred to in point 2 of this operative part to submit a statement in intervention.
4. The costs relating to the intervention of the European Data Protection Board are reserved.
Luxembourg, 29 November 2023.
A. Calot Escobar | | K. Lenaerts |