Action brought on 21 May 2024 – Microsoft Ireland Operations v EDPS

(Case T-265/24)

Language of the case: English

Parties

Applicant: Microsoft Ireland Operations Ltd (Dublin, Ireland) (represented by: J. Bourgeois and M. Meulenbelt, lawyers)

Defendant: European Data Protection Supervisor

Form of order sought

The applicant claims that the Court should:

annul the decision of the European Data Protection Supervisor (EDPS) of 8 March 2024 adopted following the investigation into use of Microsoft 365 by the European Commission (Case 2021-0518) (“Contested Decision”);

in the alternative, annul point 592.1 of the Contested Decision; and

order the EDPS to pay the costs.

Pleas in law and main arguments

In support of the action, the applicant relies on four pleas in law.

First plea in law, alleging errors in law and in fact in finding infringements of the EUDPR purpose limitation provisions (Articles 4(1)(b), 4(3), 6, 9, 26(1), 29(3)(a) and 30 EUDPR).

Second plea in law, alleging errors in law and in fact in finding infringements of the EUDPR provisions relating to international transfers (Articles 4(2), 29(3)(a), 46, 47 and 48(1), 48(3)(a)).

Third plea in law, alleging errors in law and in fact in finding infringements of EUDPR provisions on Unauthorised Disclosures (Articles 4(1)(f), 29(3)(a), 33(1) and (2), 36, 49).

Fourth plea in law, alleging that EDPS has erred in law by imposing disproportionate corrective measures based on unfounded presumptions of EUDPR infringements, and before completing steps required to verify its presumptions and to assess the impact of its proposed corrective measures.

____________