Action brought on 24 February 2023 – Data Protection Commission v EDPB

(Case T-111/23)

Language of the case: English

Parties

Applicant: Data Protection Commission (represented by: B. Kennelly, SC, D. Fennelly and E. Synnott, Barristers-at-Law, D. Young, A. Bateman and R. Minch, Solicitors)

Defendant: European Data Protection Board

Form of order sought

The applicant claims that the Court should:

annul paragraphs 222 and 326(8) of Binding Decision 5/2022 of the European Data Protection Board (the “EDPB”) on the dispute submitted by the Irish SA pursuant to Article 65 GDPR on WhatsApp Ireland Limited;

order the defendant to pay the costs of the proceedings.

Pleas in law and main arguments

In support of the action, the applicant relies on two pleas in law.

First plea in law, alleging that the EDPB exceeded its competence under Article 65(1)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)¹ in purporting to instruct the Data Protection Commission to: (i) carry out a new investigation, and (ii) issue a new draft decision in accordance with Article 60(3) GDPR.

Second plea in law, alleging that the EDPB infringed Article 4(24) GDPR and Article 65(1)(a) GDPR by incorrectly interpreting those provisions as conferring a competence on the EDPB to instruct the DPC to: (i) carry out a new investigation, and (ii) issue a new draft decision in accordance with Article 60(3) GDPR.

____________

¹ Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance) (OJ 2016 L 119, p. 1).