ORDER OF THE PRESIDENT OF THE COURT
21 July 2023 (*)
(Appeal – Application to intervene – Article 40, second paragraph, of the Statute of the Court of Justice of the European Union – Interest in the result of the case – Application made by the European Data Protection Supervisor (EDPS) – Rejection)
In Case C‑97/23 P,
APPEAL under Article 56 of the Statute of the Court of Justice of the European Union, brought on 17 February 2023,
WhatsApp Ireland Ltd, established in Dublin (Ireland), represented by H.-G. Kamann, Rechtsanwalt, F. Louis and A. Vallery, avocats, B. Johnston, C. Monaghan, P. Nolan, Solicitors, D. McGrath, Senior Counsel, P. Sreenan, Senior Counsel, E. Egan McGrath, Barrister-at-Law, and C. Geoghegan, Barrister-at-Law,
appellant,
the other party to the proceedings being:
European Data Protection Board, represented by C. Foglia, M. Gufflet, G. Le Grand and I. Vereecken, acting as Agents, and by G. Haumont, E. de Lophem, G. Ryelandt and P. Vernet, avocats,
defendant at first instance,
THE PRESIDENT OF THE COURT,
having regard to the proposal from T. von Danwitz, Judge-Rapporteur,
having heard the Advocate General, T. Ćapeta,
makes the following
Order
1 By its appeal, the appellant, WhatsApp Ireland Ltd., seeks to have set aside the order of the General Court of the European Union of 7 December 2022, WhatsApp Ireland v European Data Protection Board (T‑709/21, EU:T:2022:783; ‘the contested order’), by way of which the General Court dismissed as inadmissible its action seeking annulment of Decision 1/2021 of the European Data Protection Board of 28 July 2021 (‘the decision at issue’), adopted pursuant to Article 5 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’), further to an investigation conducted by the Data Protection Commission (Ireland), pursuant to Article 56 of that regulation in view of WhatsApp Ireland’s cross-border processing in the context of the provision of its services in the European Union.
2 By document lodged at the Registry of the Court of Justice on 28 April 2023, the European Data Protection Supervisor (EDPS) applied, pursuant to the second paragraph of Article 40 of the Statute of the Court of Justice of the European Union and Article 130 of the Rules of Procedure of the Court of Justice, applicable to appeal proceedings under Article 190(1) of those rules, and Article 58(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ 2018 L 295, p. 39), for leave to intervene in the present proceedings in support of the form of order sought by the European Data Protection Board.
3 In support of his application, the EDPS submits, in the first place, that the outcome of the present case will have an impact on the performance of his tasks, which consist in monitoring and ensuring the application of the provisions of Regulation 2018/1725 and any other Union act relating to the protection of the freedoms and fundamental rights of natural persons with regard to the processing of personal data by a institution or body of the Union, as well as advising the institutions and bodies of the Union on all matters concerning such processing. In that respect, the EDPS emphasises, first of all, that he must ensure that the provisions of the GDPR and of Regulation 2018/1725 are interpreted and applied homogeneously, as can be seen, in particular, from recitals 4 and 5 of the latter regulation. Next, the EDPS observes that the outcome of the present case is likely to have an impact on his consultative power, laid down in Article 42 of Regulation 2018/1725. He has thus contributed to the European Commission’s initiative to streamline cooperation between national data protection supervisory authorities when applying the GDPR in cross-border cases and could, in the future, be called upon to give his opinion on the operation of the cooperation mechanisms laid down by the GDPR as well as on future amendments to the rules relating to those mechanisms.
4 Second, the EDPS observes that the decision at issue concerns principles and rules applicable to the institutions, bodies, offices and agencies of the Union which correspond, in substance, to those set out in the GDPR, and that he has, in accordance with Article 68(6) of the GDPR, exercised his right to vote in the European Data Protection Board in the context of the adoption of that decision. In addition, the EDPS was the lead rapporteur for the adoption of the European Data Protection Board’s Guidelines 03/2021 of 13 April 2021 on the application of Article 65(1)(a) of the GDPR, on the basis of which, in his view, the contested decision was based.
5 Following service on the parties by the Registrar of the Court of Justice, in accordance with Article 131(1) of the Rules of Procedure, applicable to appeal proceedings by virtue of Article 190(1) of those rules, of the application to intervene lodged by the EDPS, WhatsApp Ireland and the European Data Protection Board submitted observations on that application within the prescribed period.
6 While the European Data Protection Board supports the EDPS’ application to intervene, WhatsApp Ireland contends that that application should be rejected.
The application to intervene
7 The first paragraph of Article 40 of the Statute of the Court of Justice of the European Union provides that the Member States and institutions of the Union may intervene in cases before the Court. Under the first sentence of the second paragraph of Article 40, the same right is to be open to the bodies, offices and agencies of the Union and to any other person which can establish an interest in the result of a case.
8 As regards the EDPS more specifically, his standing to act in proceedings before the Courts of the European Union is explicitly enshrined in Article 58(4) of Regulation 2018/1725, which provides that the EDPS ‘shall have the power to refer the matter to the Court of Justice under the conditions provided for in the Treaties and to intervene in actions brought before the Court of Justice.
9 However, such a right to intervene cannot be absolute since the EDPS is not amongst the ‘privileged’ interveners referred to in the first paragraph of Article 40 of the Statute of the Court of Justice of the European Union. Furthermore, the Court has already ruled that the EDPS’ right to intervene is circumscribed within the limits deriving from the task entrusted to him (see, by analogy, order of 17 March 2005, Parliament v Council, C-317/04, EU:C:2005:189, paragraph 16; see also, to that effect, order of the President of the Court of 14 October 2008, Commission v Germany, C-518/07, not published, EU:C:2008:563, paragraphs 12, 17 and 18).
10 It follows that the EDPS, whose right to intervene is based on the second paragraph of Article 40 of that statute, must establish an interest in the result of a case in order to exercise that right in a specific case.
11 According to the Court’s settled case-law, the concept of an ‘interest in the result of a case’, within the meaning of that provision, must be defined in the light of the precise subject matter of the case and be understood as meaning a direct, existing interest in the ruling on the form of order sought, and not as an interest in relation to the pleas in law raised or the arguments put forward. The words ‘result of a case’ refer to the final decision sought, as set out in the operative part of the forthcoming judgment or order (order of the President of the Court of 1 September 2022, Google and Alphabet v Commission, C‑48/22 P, EU:C:2022:667, paragraph 6 and the case-law cited).
12 However, it should be pointed out that bodies, offices and agencies of the Union, unlike natural and legal persons, are likely to apply for leave to intervene in a case before the Court not to defend private interests, but rather where, the measure giving rise to the dispute was adopted following a procedure in which the body, office or agency in question was called upon to participate, in order to defend the opinion it had issued or the assessments it had made in the course of that procedure. Therefore, so far as concerns applications to intervene by bodies, offices and agencies of the Union, the requirement that the applicant should have a direct and existing interest in the result of a case must be applied in a way that reflects that particular situation (order of the President of the Court of 22 September 2022, Mylan IRE Healthcare v Commission, C‑237/22 P, EU:C:2022:726, paragraphs 15 and 16 and the case-law cited).
13 Thus, as regards applications to intervene in a case concerning the annulment of an EU measure, or the setting aside of a decision of the General Court dismissing an action for annulment of such a measure, made by bodies, offices and agencies of the Union, the requirement that the relevant body, office or agency should have a direct and existing interest in the result of a case should be regarded as having been met, inter alia, if it is able to establish that the EU measure at issue was adopted following a procedure in which, in accordance with EU law, its participation is envisaged through, as the case may be, the adoption of opinions or the carrying out of assessments (order of the President of the Court of 22 September 2022, Mylan IRE Healthcare v Commission, C‑237/22 P, EU:C:2022:726, paragraph 17 and the case-law cited).
14 In the present case, with regard to the first argument put forward by the EDPS in support of his application to intervene, based on the impact of the present case on his role of ensuring the uniform application of the provisions of Regulation 2018/1725 and those of the GDPR and of issuing opinions on the functioning of the cooperation mechanisms provided for by the GDPR, it should be noted that the contested decision, adopted by the European Data Protection Board, is based on Article 65 of the GDPR and that Regulation 2018/1725 does not contain an analogous provision, so that the question of the uniform application of those two regulations, having regard to Article 65, does not appear to arise in the present case.
15 In any event, in the contested order, the General Court ruled only on the admissibility of the action for annulment before it, meaning that, in the present case, the only question that arises is whether the contested decision may be directly challenged before the Court of Justice of the European Union by WhatsApp Ireland. Accordingly, the decision of the Court bringing these proceedings to an end will relate solely to the admissibility of the action for annulment, and not to the question of whether the action for annulment of the contested decision is well founded. In the event that the order under appeal is set aside by the Court of Justice, the case cannot be regarded as ready for judgment on the substance of the case within the meaning of the first paragraph of Article 61 of the Statute of the Court of Justice of the European Union, since the General Court made its ruling under Article 129 of its Rules of Procedure without examining the case on the substance.
16 In those circumstances, it appears that the EDPS, in particular inasmuch as he relies on his role in advising Union institutions and bodies on all matters concerning the processing of personal data, as well as his consultative powers, laid down in Article 42 of Regulation 2018/1725, might establish his interest not with regard to the result of the case before the Court of Justice in the present appeal – namely that relating to the admissibility of the action for annulment of the contested decision having regard to the system of remedies provided for in the FEU Treaty – but rather the result of the case which would be brought before the General Court after the Court of Justice had set aside the contested order (see, to that effect, order of the President of the Court of 28 January 2020, VodafoneZiggo Group v Commission, C‑689/19 P, EU:C:2020:50, paragraph 20 and the case-law cited).
17 The second argument of the EDPS, based on the fact that he exercised his right to vote in the context of the adoption of the contested decision and that he was, moreover, the lead rapporteur in the context of the adoption of the guidelines referred to in paragraph 4 of this order, also does not make it possible to establish an interest in the result of the case. The EDPS cannot rely on such an interest as a basis for a right to intervene, since the interest invoked is not specific to the EDPS and, moreover, is not at all distinct from that of the European Data Protection Board, which is already a party to the case and in support of which it wishes to intervene (see, by analogy, order of the President of the Court of 1 September 2022, Google and Alphabet v Commission, C‑48/22 P, EU:C:2022:667, paragraph 12).
18 It follows from all the foregoing considerations that the EDPS has failed to demonstrate that he has an interest in the result of the case within the meaning of the second paragraph of Article 40 of the Statute of the Court of Justice of the European Union and that, consequently, his application to intervene must be rejected.
Costs
19 Under Article 138(1) of the Rules of Procedure of the Court of Justice, which applies to appeal proceedings by virtue of Article 184(1) thereof, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings. Since the EDPS has been unsuccessful in his application to intervene and neither WhatsApp Ireland nor the European Data Protection Board has applied for costs, the EDPS, WhatsApp Ireland and the European Data Protection Board must be ordered each to bear their own respective costs in relation to the EDPS’ application to intervene.
On those grounds, the President of the Court hereby orders:
1. The application to intervene brought by the European Data Protection Supervisor is rejected.
2. The European Data Protection Supervisor, WhatsApp Ireland Ltd. and the European Data Protection Board shall each bear their own costs.
Luxembourg, 21 July 2023.
A. Calot Escobar | | K. Lenaerts |