ORDER OF THE GENERAL COURT (First Chamber, Extended Composition)
6 September 2023 (*)
(Action for annulment – Law governing the institutions – Processing of personal data by Europol – Regulation (EU) 2016/794 – The institutional prerogatives of the EDPS – Locus standi – Action in part inadmissible and in part manifestly inadmissible)
In Case T‑578/22,
European Data Protection Supervisor (EDPS), represented by D. Nardi, T. Zerdick, A. Buchta and F. Coudert, acting as Agents,
applicant,
v
European Parliament, represented by P. López-Carceller, I. Liukkonen and R. van de Westelaken, acting as Agents,
and
Council of the European Union, represented by J. Lotarski, K. Pleśniak and R. Meyer, acting as Agents,
defendants,
THE GENERAL COURT (First Chamber, Extended Composition),
composed of D. Spielmann, President, V. Valančius, R. Mastroianni, M. Brkan and T. Tóth (Rapporteur), Judges,
Registrar: V. Di Bucci,
having regard to the written part of the procedure, in particular:
– the objection of inadmissibility raised under Article 130(1) of the Rules of Procedure of the General Court by the Council by way of separate document lodged at the Court Registry on 12 December 2022,
– the defence lodged by the Parliament on 13 December 2022,
– the applications for leave to intervene lodged by the French Republic on 7 December 2022, by the Federal Republic of Germany on 9 December 2022, by the Commission on 20 December 2022 and by the Kingdom of Belgium and the Kingdom of the Netherlands on 22 December 2022,
makes the following
Order
1 By his action under Article 263 TFEU, the European Data Protection Supervisor (EDPS) seeks the annulment of Articles 74a and 74b of Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (OJ 2016 L 135, p. 53; ‘the initial Europol regulation’), as amended by Regulation (EU) 2022/991 of the European Parliament and of the Council of 8 June 2022, as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role in research and innovation (OJ 2022 L 169, p. 1; ‘the amended Europol regulation’) (those articles taken together being ‘the contested provisions’).
Background to the dispute
The decision of the EDPS of 3 January 2022
2 Following an own-initiative inquiry and an admonishment decision of 17 September 2020, the EDPS adopted, on 3 January 2022, a decision against the European Union Agency for Law Enforcement Cooperation (Europol), pursuant to Article 43(3)(e) of the initial Europol regulation, finding that, ‘by providing for the continuous storage of datasets lacking a DSC [Data Subject Categorisation], the Action Plan provided by Europol d[id] not address the infringement identified in the admonishment decision of 17 September 2020’ and that ‘the processing by Europol of datasets lacking a DSC, …, for the sole purpose of extracting relevant information in compliance with Articles 18(3), (5), and Annex II.B [of the initial Europol regulation], as well as the principles of data minimisation and storage limitation (Article 28(1)(c) and (e) [of the initial Europol regulation), [could not] exceed a maximum period of six months as from the date of reception of the contribution’.
3 In order to arrive at that reasoning, the EDPS stated, in particular, that, ‘in the absence of an explicit legal provision laying down the retention period of personal data processed for this purpose, … [it was] appropriate to make an interpretation by analogy of Article 18(6) [of the initial Europol regulation]’.
4 Thus, it is apparent from the decision of 3 January 2022 that the EDPS ordered Europol, in essence, for each contribution received as from 4 January 2022, to proceed to data subject categorisation, within the meaning of Article 18(5) of the initial Europol regulation, within 6 months as from the date of reception of that contribution, and to proceed to data subject categorisation within 12 months for all datasets existing as at 3 January 2022, after which periods Europol was required to erase those data.
The adoption of the amended Europol regulation
5 On 9 December 2020, the European Commission submitted proposal COM(2020) 796 final for a regulation of the European Parliament and of the Council amending Regulation 2016/794, as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role on research and innovation (‘the proposal for an amending regulation’).
6 In Opinion 4/2021, the EDPS welcomed the proposal for an amending regulation, subject to certain reservations.
7 On 1 February 2022, following the last trilogue negotiation, two new provisions were added to the proposal for an amending regulation, namely Articles 74a and 74b, which are transitional provisions concerning, respectively, the processing of personal data in support of an ongoing criminal investigation and the processing of personal data held by Europol.
8 On 8 June 2022, the European Parliament and the Council of the European Union adopted the amended Europol regulation. The wording of Articles 74a and 74b was confirmed in that regulation.
9 Those provisions lay down, in essence, the conditions in which Europol is to proceed, within a specified period, to the categorisation of the datasets in its possession at the time of entry into force of the amended Europol regulation, and specify the conditions and procedures according to which the processing of personal data not relating to categories of data subjects listed in Annex II to the amended Europol regulation, which were transferred to Europol before 28 June 2022, is to be authorised in support of an ongoing criminal investigation.
The exchanges between the EDPS and Europol following the adoption of the amended Europol regulation
10 On 15 June 2022, the EDPS, taking the view that the scope of his decision of 3 January 2022 and of Articles 74a and 74b of the amended Europol regulation was not the same, requested the Parliament, the Council and the Commission to provide him with documents concerning the existence of a connection between the provisions of the amended Europol regulation and the past exercise of his supervisory powers. The Parliament and the Council replied to that request by letters of 12 July and 25 July 2022 respectively.
11 In Council Document No 5370/22 of 24 January 2022, on preparation for the trilogue, it is stated that ‘the recent decision of the [EDPS], which could have operational consequences for Europol’s action, confirms the need for a rapid adoption of the regulation’, that ‘the Presidency proposed to the delegations to introduce a new Article 74[a] which would aim at further clarifying the situation of data currently in the possession of Europol, in particular in the context of the abovementioned decision of the EPDS of 3 January 2022’ and that ‘many delegations welcomed the principles of that proposal at the meeting of 19 January [2022], but approval by the committee is necessary in view of its recent presentation and the stakes that that subject represents following the decision of the EDPS’.
12 By letter of 15 July 2022, the EDPS asked Europol whether, in the light of Articles 74a and 74b of the amended Europol regulation, his decision of 3 January 2022 continued to be implemented or whether Europol considered that those articles had replaced or altered the scope of that decision.
13 By letter of 22 August 2022, Europol replied to the EDPS, stating, in essence, that it continued to implement certain points of the decision of 3 January 2022, but that it was not in a position to comment at that stage on the situation as at 3 January 2023 and on the further submission of implementation reports under that decision. That letter also mentions the fact that Articles 74a and 74b of the amended Europol regulation were not applied to certain contributions which had been deleted.
Forms of order sought
14 In his application, the EDPS claims that the Court should:
– annul the contested provisions;
– order ‘the defendant’ to pay the costs.
15 In its defence, the Parliament contends that the Court should:
– dismiss the application;
– order the EDPS to pay the costs;
– were the application to be upheld, maintain the effects of the contested provisions.
16 In the objection of inadmissibility, the Council contends that the Court should:
– dismiss the action as being inadmissible;
– order the EDPS to bear the costs of the proceedings.
17 In the observations on the objection of inadmissibility, the EDPS claims that the Court should dismiss that objection raised by the Council and rule on the merits of the case.
Law
18 Pursuant to Article 130 of the Rules of Procedure of the General Court, where, by a separate document, the defendant applies to the General Court for a decision on inadmissibility or lack of competence without going to the substance of the case, the Court must decide on the application as soon as possible, where necessary after opening the oral part of the procedure. In addition, under Article 126 of those rules, where it is clear that the Court has no jurisdiction to hear and determine an action or where the action is manifestly inadmissible or manifestly lacking any foundation in law, the Court may, on a proposal from the Judge-Rapporteur, at any time decide to give a decision by reasoned order without taking further steps in the proceedings.
19 In the present case, the Court considers that it has sufficient information from the documents in the file and has decided, pursuant to those provisions, to give a decision without taking further steps in the proceedings.
20 In support of his application for annulment of the contested provisions, the EDPS relies on a single plea in law, alleging infringement of the independence and powers of the EDPS as a supervisory authority, as a consequence of the infringement of the principle of legal certainty and of the principle of non-retroactivity of legal acts. According to the EDPS, the contested provisions retroactively legalise Europol’s data retention practices and de facto annul his decision of 3 January 2022. In particular, he alleges infringement of Article 8(3) of the Charter of Fundamental Rights of the European Union (‘the Charter’) and of Article 55 of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ 2018 L 295, p. 39), read in conjunction with Article 43(1) and (3)(e) of the amended Europol regulation.
21 As regards the admissibility of his action, first, the EDPS submits, primarily, that his standing to bring an action for annulment under Article 263 TFEU is justified by the need to be able to have a judicial remedy in order to defend his institutional prerogatives, in particular his independence as a supervisory authority under Article 8(3) of the Charter, and the institutional balance between the role of supervisory authorities and the role of the legislature. In that regard, he states that he has standing to bring proceedings under the case-law resulting from the judgment of 22 May 1990, Parliament v Council (C‑70/88, EU:C:1990:217), which should be applied by analogy in the present case, since that judgment shows that the protection of institutional prerogatives allows, exceptionally, an institution to defend them without it being necessary for it to satisfy the conditions of admissibility applicable to natural or legal persons under the fourth paragraph of Article 263 TFEU.
22 Secondly, and alternatively, the EDPS maintains that he is directly and individually concerned by the contested provisions, which he has a clear and actual interest to have annulled. In addition, he states that the present action is lodged before the General Court as the competent forum, but that he would not oppose its transfer to the Court of Justice should the General Court deem that appropriate.
23 The Council contends that the present action is inadmissible on two grounds. It contends, first, that the action is inadmissible on the ground that the EDPS is not referred to in the second and third paragraphs of Article 263 TFEU or again in terms of the judgment of 22 May 1990, Parliament v Council (C‑70/88, EU:C:1990:217), and, secondly, that the EDPS is not directly and individually concerned within the meaning of the fourth paragraph of Article 263 TFEU.
24 Furthermore, the Council notes that the present action was brought before the General Court and not before the Court of Justice, which alone has jurisdiction to rule on actions brought by the EU institutions. Thus, the Council questions whether the EDPS may, in the same action, argue that he is both a ‘privileged’ applicant and a ‘non-privileged’ applicant.
The jurisdiction of the General Court
25 As a preliminary point, although the EDPS does not seek to be regarded as one of the ‘privileged’ or ‘semi-privileged’ applicants referred to in the second and third paragraphs of Article 263 TFEU, inasmuch as he claims specific standing in order to protect his prerogatives, it must be ascertained whether the General Court has jurisdiction to hear the present action.
26 In that regard, it should be borne in mind that the second and third paragraphs of Article 263 TFEU provide that the Court of Justice is to have jurisdiction, first, in actions brought by a Member State, the Parliament, the Council or the Commission on grounds of lack of competence, infringement of an essential procedural requirement, infringement of the Treaties or of any rule of law relating to their application, or misuse of powers, and is to have jurisdiction, secondly, under the same conditions, in actions brought by the Court of Auditors, by the European Central Bank (ECB) and by the Committee of the Regions for the purpose of protecting their prerogatives.
27 First of all, it should be noted that the EDPS is not among the applicants mentioned in the second and third paragraphs of Article 263 TFEU. Nor is the EDPS included in the list of institutions in Article 13(1) TEU, which establishes seven institutions, namely, the Parliament, the European Council, the Council, the Commission, the Court of Justice of the European Union, the European Central Bank and the Court of Auditors.
28 Next, the EDPS is an EU body established by Article 41(1) of Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ 2001 L 8, p. 1), on the basis of Article 286(2) EC.
29 On that question, it should be borne in mind that, in accordance with Article 13(1) TEU, the concept of ‘institutions’ refers to a precise list of entities which does not include the EU bodies, offices and agencies, and the distinction between the institutions, on the one hand, and the EU bodies, offices and agencies, on the other, must apply transversely and uniformly in both Treaties (see, to that effect, judgment of 14 July 2022, Italy and Comune di Milano v Council and Parliament (Seat of the European Medicines Agency), C‑106/19 and C‑232/19, EU:C:2022:568, paragraphs 113 and 116).
30 Lastly, as the Council observes, it should be noted that, although the first paragraph of Article 263 TFEU expressly refers to EU bodies, offices and agencies in the list of authors of acts whose legality may be called into question in the context of an action for annulment, the same is not true as regards the second and third paragraphs of Article 263 TFEU.
31 Indeed, the possibility of challenging acts of EU bodies, offices or agencies in an action for annulment was introduced by the Treaty of Lisbon. Nevertheless, it should be borne in mind that the EU bodies, offices and agencies were not referred to in the second and third paragraphs of Article 263 TFEU.
32 In that regard, the authors of the Treaty of Lisbon added the Committee of the Regions among the applicants referred to in the third paragraph of Article 263 TFEU. It follows that, even though the drafters of the Treaty took into consideration legal persons other than the institutions in the list of persons entitled to defend their prerogatives under that provision, they chose not to include the EDPS.
33 Admittedly, the status of the EDPS as an independent supervisory authority is mentioned in Article 16(2) TFEU, which provides that compliance with the rules relating to the protection of individuals with regard to the processing of personal data by EU institutions, bodies, offices and agencies, is to be subject to the control of independent authorities, and in Article 8(3) of the Charter, which provides that compliance with the rules on the protection of personal data is to be subject to control by an independent authority.
34 Nevertheless, the EDPS was established by an act of secondary legislation, namely Article 41(1) of Regulation No 45/2001, and not by primary law.
35 Consequently, the EDPS, although an EU body with a particular status, is not an EU institution and, in any event, cannot be regarded as one of the applicants referred to in the second and third paragraphs of Article 263 TFEU.
36 In the light of the foregoing, since Article 51(b) of the Statute of the Court of Justice of the European Union states that jurisdiction must be reserved to the Court of Justice in actions referred to in Article 263 TFEU which are brought in particular by an institution of the Union against a legislative act and the EDPS is neither an institution, nor an applicant referred to in the second and third paragraphs of Article 263 TFEU, the General Court has jurisdiction to rule on the action.
37 It is, therefore, necessary to examine the pleas of inadmissibility raised by the Council.
The first plea of inadmissibility
38 First, the Council notes, in essence, that, during the successive revisions of the Treaties since 1990, the standing to bring an action for annulment was significantly enlarged to other EU institutions, agencies, offices and bodies, but that the EDPS was not, however, considered one of the bodies which should benefit from a privileged access to actions for annulment. Secondly, it states that the role of the EDPS under Article 52(3) of Regulation 2018/1725 is to supervise the processing of personal data by EU institutions and bodies and to advise those institutions and bodies in data protection matters. Thirdly, the Council contends that the judgment of 22 May 1990, Parliament v Council (C‑70/88, EU:C:1990:217), is not applicable to the present case, since the EDPS is not deprived of sufficient and effective judicial protection, unlike the Parliament in that judgment. Fourthly, the Council contends that the EDPS cannot rely on Article 8(3) and Article 47 of the Charter in order to justify his locus standi.
39 The EDPS disputes the Council’s arguments.
40 The EDPS submits that he has standing to defend his institutional prerogatives, irrespective of the conditions laid down in the fourth paragraph of Article 263 TFEU. First, he states that the principle of institutional balance as interpreted in the judgment of 22 May 1990, Parliament v Council (C‑70/88, EU:C:1990:217), also protects his prerogatives as an independent supervisory authority of the EU institutions and bodies, pursuant to Article 8(3) of the Charter and Article 16(2) TFEU. Secondly, the EDPS submits that the Council’s analysis of the various remedies confirms that none of those types of proceedings could be actually used to autonomously challenge action by the legislature that would directly and specifically jeopardise the independence of supervisory authorities protected by the Charter and the FEU Treaty. Thirdly, he states that Article 8(3) of the Charter enshrines the fundamental right of individuals to enjoy independent supervision of the application of the rules on the protection of their personal data and that Article 16(2) TFEU strengthened those rules. Fourthly, the EDPS recalls that his prerogatives have been affected in the present case inasmuch as the contested provisions constitute an unlawful retroactive application directed at his enforcement activity and that the legislative procedure was used as an ad hoc measure to counter that activity.
41 In that regard, it must be pointed out that, in the judgment of 22 May 1990, Parliament v Council (C‑70/88, EU:C:1990:217), the Court of Justice held that the wording of Article 173 of the EEC Treaty did not offer the Parliament any opportunity to challenge, before the Courts of the European Union, the acts adopted by the other institutions liable to infringe its own prerogatives and it chose to fill that gap by having recourse to the general principle of institutional balance.
42 In the first place, in the judgment of 22 May 1990, Parliament v Council (C‑70/88, EU:C:1990:217), after stating, in paragraph 13, that the Parliament was not included, in the first paragraph of Article 173 of the EEC Treaty or in the first paragraph of Article 146 of the EAEC Treaty, among the institutions which, like the Member States, could bring an action for annulment against any measure of another institution, the Court of Justice held in paragraph 14 that the Parliament was not a legal person and that, accordingly, it could not bring an action before the Court of Justice on the basis of the second paragraph of Article 173 EEC, which was replaced by Article 230 EC and subsequently by Article 263 TFEU, and which corresponds, in essence, to the fourth paragraph of that article.
43 In the present case, as will be explained in paragraphs 59 to 66 below, a body, office or agency created by an act of secondary EU legislation may be treated in the same way as a legal person and, therefore, bring an action for annulment on the basis of the fourth paragraph of Article 263 TFEU.
44 In the second place, the Court of Justice also held in paragraphs 21 and 22 of the judgment of 22 May 1990, Parliament v Council (C‑70/88, EU:C:1990:217), that the Parliament’s prerogatives ‘[we]re one of the elements of the institutional balance created by the Treaties’ and that ‘observance of the institutional balance mean[t] that each of the institutions must exercise its powers with due regard for the powers of the other institutions [and] require[d] that it should be possible to penalise any breach of that rule which [might] occur’.
45 Thus, the Court of Justice held that it had to be able to maintain the institutional balance and, consequently, review the observance of the Parliament’s prerogatives when called upon to do so by the Parliament, by means of a legal remedy which was suited to the purpose which the Parliament sought to achieve (see, to that effect, judgment of 22 May 1990, Parliament v Council, C‑70/88, EU:C:1990:217, paragraph 23).
46 Nevertheless, it has been established in paragraphs 25 to 36 above that the EDPS could not be considered an institution, but was an EU body, not referred to in the second and third paragraphs of Article 263 TFEU.
47 Admittedly, the EDPS has a particular status, in so far as Article 16(2) TFEU states that compliance with the rules relating to the protection of individuals with regard to the processing of personal data by the EU institutions, bodies, offices and agencies is to be subject to the control of independent authorities and Article 8(3) of the Charter provides that compliance with the rules on the protection of personal data is to be subject to control by an independent authority.
48 However, while it is not disputed that the creation of independent supervisory authorities is an essential element of the protection of individuals with regard to the protection of personal data, the independence in which the EDPS must carry out his duties in practice is not intended to limit the powers of the EU legislature.
49 On that question, it must be pointed out that the Parliament and the Council’s legislative power, conferred in Article 14(1) TEU and Article 16(1) TEU, which reflects the principle of conferred powers, enshrined in Article 13(2) TEU and, more broadly, the principle of institutional balance, characteristic of the institutional structure of the European Union, means that it is for those institutions alone to decide the content of a legislative act (see judgment of 14 July 2022, Italy and Comune di Milano v Council and Parliament (Seat of the European Medicines Agency), C‑106/19 and C‑232/19, EU:C:2022:568, paragraph 146 and the case-law cited).
50 In that regard, Article 16(2) TFEU provides, in the first sentence thereof, that ‘the European Parliament and the Council, acting in accordance with the ordinary legislative procedure, shall lay down the rules relating to the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies’ and then, in the second sentence thereof, that ‘compliance with these rules shall be subject to the control of independent authorities’.
51 Consequently, the EDPS is required to exercise his duties and powers, in complete independence, but within the framework of the legislative acts adopted jointly by the Parliament and the Council and in accordance with them. Thus, it is in the context of the application of the legislative acts adopted by those two institutions that the EDPS, who is an independent authority, supervises compliance with the rules relating to the protection of individuals with regard to the processing of personal data by the EU institutions, bodies, offices and agencies.
52 On that question, it should be noted, as the Council has done, that the EU legislature made clear, in Article 58(4) of Regulation 2018/1725, that ‘the [EDPS] shall have the power to refer the matter to the Court of Justice under the conditions provided for in the Treaties and to intervene in actions brought before the Court of Justice’.
53 That conclusion cannot be called into question by the EDPS’s argument to the effect that his independence was, in the present case, affected by the use of legislative powers to alter retroactively a situation definitively settled by a decision which he had adopted under the rules applicable ratione temporis.
54 In that regard, it must be noted that the decision of 3 January 2022, the effects of which, according to the EDPS, were annulled retroactively by the contested provisions, was adopted in the context of the EDPS’s task of monitoring compliance with the rules relating to the protection of individuals with regard to the processing of personal data by the EU institutions, bodies, offices and agencies, as provided for in Article 16(2) TFEU.
55 The fact that the aforementioned rules were amended by the legislature does not affect the EDPS’s independence as such, but modifies the framework within which he must exercise his supervision of those rules, as an independent authority.
56 Accordingly, the judgment of 22 May 1990, Parliament v Council (C‑70/88, EU:C:1990:217), cannot be applied by analogy to the present case and the EDPS cannot be recognised as having standing to bring proceedings in accordance with that judgment.
57 Consequently, the EDPS has to be regarded as an applicant who must fulfil the conditions laid down in the fourth paragraph of Article 263 TFEU.
The second plea of inadmissibility
58 Under the second part of the fourth paragraph of Article 263 TFEU, any natural or legal person may institute proceedings against an act which is of direct and individual concern to them.
59 It is, therefore, necessary, as a preliminary point, to examine whether the EDPS may, as an EU body, be treated in the same way as a legal person within the meaning of the fourth paragraph of Article 263 TFEU.
60 In that regard, it has been held that the term ‘legal person’ used in the fourth paragraph of Article 263 TFEU cannot be interpreted restrictively (judgment of 22 June 2021, Venezuela v Council (Whether a third State is affected), C‑872/19 P, EU:C:2021:507, paragraph 44).
61 Moreover, it follows more generally from the case-law that not only private legal persons, but also public entities, may bring proceedings under the fourth paragraph of Article 263 TFEU (judgment of 22 June 2021, Venezuela v Council (Whether a third State is affected), C‑872/19 P, EU:C:2021:507, paragraph 46).
62 It has also been held that an entity, to the extent that it had legal personality, could, in principle, bring an action for annulment under the fourth paragraph of Article 263 TFEU (judgment of 22 June 2021, Venezuela v Council (Whether a third State is affected), C‑872/19 P, EU:C:2021:507, paragraph 45, and order of 10 September 2020, Cambodia and CRF v Commission, T‑246/19, EU:T:2020:415, paragraph 48).
63 In that regard, independence and responsibility, even if limited, have been identified as basic aspects of legal personality (see, to that effect, order of 14 November 1963, Lassalle v Parliament, 15/63, EU:C:1963:47, p. 51).
64 In the present case, as set out in Article 54(2) of Regulation 2018/1725, the EDPS has been provided with the human and financial resources necessary for the performance of his tasks. Furthermore, under Article 58(4) and (5) of that regulation, the EDPS has the power to refer a matter to the Court of Justice and the exercise of his powers may be the subject of effective judicial remedies.
65 In those circumstances, an interpretation of the fourth paragraph of Article 263 TFEU in the light of the principles of effective judicial review and the rule of law militates in favour of an interpretation according to which an EU body, such as the EDPS, should be found to have standing to bring proceedings, as a ‘legal person’, within the meaning of the fourth paragraph of Article 263 TFEU, where the other conditions laid down in that provision are satisfied. Such a legal person is indeed equally as likely as any another person or entity to have its rights or interests adversely affected by an EU act and must therefore be able, in compliance with those conditions, to seek the annulment of that act (see, to that effect, judgment of 22 June 2021, Venezuela v Council (Whether a third State is affected), C‑872/19 P, EU:C:2021:507, paragraph 50).
66 It follows that, in accordance with the fourth paragraph of Article 263 TFEU, the EDPS has standing to bring an action for annulment of the contested provisions, provided that he is directly and individually concerned by them within the meaning of that article.
67 Since the Council contends that the action is inadmissible because the EDPS is not directly and individually concerned, it is necessary to examine whether the action is admissible in the light of those conditions.
68 As regards direct concern, the Council contends, in essence, that the contested provisions do not affect the powers of the EDPS or the EDPS’s decision of 3 January 2022 and that they leave discretion to those to whom they are addressed.
69 The EDPS disputes the Council’s arguments and submits, in essence, that the contested provisions create a precedent where the legislature exerts undue pressure on a supervisory authority, that the decision of 3 January 2022 was rendered ineffective by the contested provisions and that, independently of any action by Europol or the Member States, the contested provisions deploy legal effects contrary to those resulting from the law as it stood and as interpreted by that decision.
70 As regards the condition that a legal person must be directly concerned, that condition requires, according to settled case-law, two cumulative criteria to be met, namely, first, the contested measure must directly affect the legal situation of the applicant and, secondly, it must leave no discretion to its addressees who are entrusted with the task of implementing it, such implementation being purely automatic and resulting from the EU rules alone without the application of other intermediate rules (see judgment of 13 January 2022, Germany – Ville de Paris and Others v Commission, C‑177/19 P to C‑179/19 P, EU:C:2022:10, paragraph 72 and the case-law cited).
71 In addition, in order to determine whether a measure produces legal effects, it is necessary to look in particular to its purpose, its content, its scope, its substance and the legal and factual context in which it was adopted (judgment of 22 June 2021, Venezuela v Council (Whether a third State is affected), C‑872/19 P, EU:C:2021:507, paragraph 66).
72 More specifically, it has been held that an act of EU law that prevented a public legal person from exercising its own powers as it saw fit had a direct effect on the legal situation of that legal person, with the result that the act in question had to be regarded as being of direct concern to that legal person, within the meaning of the fourth paragraph of Article 263 TFEU (judgment of 13 January 2022, Germany – Ville de Paris and Others v Commission, C‑177/19 P to C‑179/19 P, EU:C:2022:10, paragraph 73; see also, to that effect, judgment of 22 June 2021, Venezuela v Council (Whether a third State is affected), C‑872/19 P, EU:C:2021:507, paragraph 69).
73 As regards, in the first place, the condition relating to the effects on the legal situation of the EDPS, first, it should be noted that it is apparent from Article 1(3) of Regulation 2018/1725 and Article 43(1) of the initial Europol regulation that the EDPS is responsible for monitoring the application by the EU institutions, bodies, offices or agencies of the relevant rules relating to the protection of personal data. In the present case, the contested provisions amend the initial Europol regulation and primarily concern the latter. Thus, they have no bearing on the nature or scope of the tasks entrusted to the EDPS by EU legislation.
74 While it is true that the legal regime which the EDPS is responsible for monitoring has been changed, his own powers have not been, since the way in which he can lawfully exercise those powers has not been altered as such.
75 The EDPS is not, therefore, directly concerned by the contested provisions, inasmuch as his rights, obligations or powers have not been affected by those provisions.
76 Secondly, as regards the effects of the contested provisions on the decision of 3 January 2022, it should be noted that there is an overlap between the datasets concerned by the aforementioned decision and by the contested provisions. However, the decision of 3 January 2022 is an administrative decision which cannot affect legislative acts such as the amended Europol regulation or affect the content thereof.
77 That conclusion cannot be called into question by the EDPS’s argument that the contested provisions create a precedent where the legislature could exert undue pressure on a supervisory authority. Although the contested provisions alter the applicable legal framework, for which the EDPS is responsible for monitoring compliance, and do not have entirely the same scope as that of the decision of 3 January 2022, they do not, however, affect his legal situation.
78 In the second place, in any event, as regards the condition relating to the discretion of the addressees responsible for implementing the contested provisions, it should be noted that those provisions leave Europol a certain discretion.
79 In accordance with the contested provisions, Europol is responsible for deciding how to process the datasets transmitted to it by a Member State or by other entities and which were in its possession at the time of the entry into force of the amended Europol regulation. Europol is called upon to categorise the datasets that were in its possession at the time of entry into force of the amended Europol regulation and decide whether to continue to process the datasets belonging to categories of data subjects falling outside the scope of Annex II to the amended Europol regulation in support of ongoing criminal investigations and which were transmitted to it by a Member State or by other entities.
80 It is, therefore, for Europol to decide whether or not to continue the processing of certain data. Consequently, the EDPS’s supervisory role in relation to the contested provisions is subject to the initial intervention of Europol, the Member States or other entities.
81 First, Article 74a of the amended Europol regulation provides that Europol is to send to the EDPS for information the assessment referred to in Article 74a(1)(c) and (3)(d) of that regulation. Secondly, Article 74b of the amended Europol regulation provides, in essence, that Europol may carry out a pre-analysis of the personal data received before 28 June 2022 for a period of up to 18 months or, in justified cases and with the prior authorisation of the EDPS, for a longer period.
82 Thus, the contested provisions leave discretion to those to whom they are addressed. They are not, therefore, purely automatic in nature resulting from the EU rules alone vis-à-vis the EDPS, without the application of other intermediate rules.
83 That conclusion cannot be called into question by the EDPS’s argument that the mere fact of giving a choice to the Member States or to the EU agencies whether to authorise the continued processing of data lacking data-subject categorisation directly undermines the decision of 3 January 2022. On that question, it should be pointed out that the contested provisions do not prevent the EDPS from exercising, as he sees fit, his own powers within the meaning of the case-law referred to in paragraph 72 above.
84 Consequently, the contested provisions do not directly affect the legal situation of the EDPS.
85 Accordingly, since the conditions that the act whose annulment is sought should be of direct concern and individual concern are cumulative, the consequence, if one of those conditions is not met by an applicant, is that an action brought by him or her for annulment of that act must be held to be inadmissible (judgment of 3 October 2013, Inuit Tapiriit Kanatami and Others v Parliament and Council, C‑583/11 P, EU:C:2013:625, paragraph 76).
86 In the light of the foregoing, the objection of inadmissibility raised by the Council must be upheld and the claims directed against it must be dismissed as inadmissible under Article 130 of the Rules of Procedure.
87 For that reason, the claims directed against the Parliament, seeking annulment of the contested provisions of which it is also the author, must be dismissed as manifestly inadmissible within the meaning of Article 126 of the Rules of Procedure.
88 In addition, in accordance with Article 144(3) of the Rules of Procedure, where the defendant has lodged a plea of inadmissibility or of lack of competence, as provided in Article 130(1) of those rules, a decision on the application to intervene is not to be given until after the plea has been rejected or the decision on the plea reserved. Furthermore, in accordance with Article 142(2) of those rules, the intervention is to become devoid of purpose, inter alia, where the application is declared inadmissible. In the present case, since the action has been dismissed as inadmissible in its entirety, there is no need to rule on the applications for leave to intervene submitted by the French Republic, the Federal Republic of Germany, the Commission, the Kingdom of Belgium and the Kingdom of the Netherlands.
Costs
89 Under Article 134(1) of the Rules of Procedure, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings.
90 Since the EDPS has been unsuccessful, he must be ordered to pay the costs incurred by the Council and the Parliament, in accordance with the forms of order sought by them, with the exception of those relating to the applications to intervene.
91 In addition, in accordance with Article 144(10) of the Rules of Procedure, where the proceedings in the main case are concluded before the application to intervene has been decided, the applicant for leave to intervene and the main parties shall each bear their own costs relating to the application to intervene. Consequently, the EDPS, the Council, the Parliament and the Commission, the Kingdom of Belgium, the Federal Republic of Germany, the French Republic and the Kingdom of the Netherlands must bear their own costs relating to the applications to intervene.
On those grounds,
THE GENERAL COURT (First Chamber, Extended Composition)
hereby orders:
1. The action is dismissed as in part inadmissible and in part manifestly inadmissible.
2. There is no need to rule on the applications for leave to intervene submitted by the European Commission, the Kingdom of Belgium, the Federal Republic of Germany, the French Republic and the Kingdom of the Netherlands.
3. The European Data Protection Supervisor (EDPS) shall bear his own costs and pay the costs incurred by the Council of the European Union and the European Parliament, with the exception of those relating to the applications to intervene.
4. The EDPS, the Council, the Parliament and the Commission, the Kingdom of Belgium, the Federal Republic of Germany, the French Republic and the Kingdom of the Netherlands shall bear their own costs relating to the applications to intervene.
Luxembourg, 6 September 2023.