Action brought on 17 May 2024 – Commission v EDPS

(Case T-262/24)

Language of the case: English

Parties

Applicant: European Commission (represented by: A. Bouchagiar and H. Kranenborg, Agents)

Defendant: European Data Protection Supervisor

Form of order sought

The applicant claims that the Court should:

annul the decision of 8 March 2024 of the European Data Protection Supervisor concerning his investigation into the use of Microsoft 365 by the European Commission in Case 2021-0518; and

order the defendant to pay the costs of the proceedings.

Pleas in law and main arguments

In support of the action, the applicant relies on thirteen pleas in law.

First plea in law, alleging erroneous interpretation and application of Articles 4(1)(b), 6 and 9 of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data (the “EUDPR”), by inferring an obligation of the Commission to define exhaustively the “types” of personal data to be processed.

Second plea in law, alleging erroneous interpretation and application of Article 29(3)(a) EUDPR in finding that the Commission did not determine in the 2021 Inter-Institutional Licensing Agreement which types of personal data are to be processed and for which purposes.

Third plea in law, alleging erroneous interpretation and application of Article 9 EUDPR by considering it applicable to the present case and, in any event, by applying it erroneously.

Fourth plea in law, alleging erroneous interpretation and application of Article 29(3)(a) EUDPR in finding that the Commission failed to provide sufficiently clear documented instructions.

Fifth plea in law, alleging erroneous interpretation and application of Articles 4(2) and 26(1) in conjunction with Article 30 EUDPR by finding that the Commission failed to ensure that Microsoft processes personal data to provide its services only on documented instructions from the Commission.

Sixth plea in law, alleging erroneous interpretation and application of Article 29(3) EUDPR in relation to transfers of personal data to third countries.

Seventh plea in law, alleging erroneous interpretation and application of Articles 4(2), 46 and 48 EUDPR in finding deficiencies in the mapping of transfers.

Eighth plea in law, alleging errors of law and errors of fact in interpreting and applying Articles 4(2), 46 and 48 EUDPR.

Ninth plea in law, alleging erroneous application of Articles 4(2), 46, 48(1) and (3)(a) EUDPR by assuming that direct transfers of personal data took place between the Commission and Microsoft Corporation in the United States.

Tenth plea in law, alleging erroneous interpretation and application of Article 47 EUDPR.

Eleventh plea in law, alleging errors of law and errors of fact in interpreting and applying Articles 4(1)(f), 29(3)(a), 33(1) and (2) and 36 EUDPR.

Twelfth plea in law, alleging infringement of the duty to state reasons under Article 296 TFEU, lack of competence and erroneous interpretation and application of Article 52(3) EUDPR in recommending to the Commission to consider Articles 1, 2 and 5 of Protocol (No 7) on the Privileges and Immunities of the European Union.

Thirteenth plea in law, alleging infringement of the principle of proportionality in ordering the corrective measures of the contested decision.

____________