P WhatsApp Ireland Ltd v European Data Protection Board

1.

The present appeal raises the perennial question of the interpretation and application of the conditions for the admissibility of an action for annulment brought by applicants who are natural or legal persons. More specifically, the case concerns the concepts of ‘challengeable act’, for the purpose of the first paragraph of Article 263 TFEU, and of ‘direct concern’, within the meaning of the fourth paragraph of Article 263 TFEU.

2.

That question arises in the context of the consistency mechanism provided for in Regulation (EU) 2016/679. ( 2 ) That mechanism consists of a composite procedure involving the participation of national supervisory authorities and the European Data Protection Board (EDPB).

3.

In the order under appeal, the General Court considered inadmissible an action brought by WhatsApp Ireland Ltd (‘WhatsApp’ or ‘the appellant’) against Binding Decision 1/2021 (‘the contested decision’), ( 3 ) an EDPB decision adopted within the context of that mechanism. ( 4 ) Hence the present appeal. ( 5 )

4.

Beyond the appeal in this specific case, the Court of Justice has the opportunity to explain more generally how the rules on the admissibility of actions for annulment are to be applied to composite procedures.

5.

The present case arises out of the consistency mechanism introduced by the GDPR. More specifically, it concerns the part of that mechanism, provided for in Article 65 of the GDPR, according to which the EDPB is granted the power to adopt binding decisions by which it resolves certain types of disputes that arise among national supervisory authorities when they enforce the rules of the GDPR.

6.

The consistency mechanism is one of numerous ‘composite administrative procedures’ established by EU secondary law. ( 6 )

7.

That term is used to describe procedures in which decision-making occurs in multiple steps, involving both EU and national institutions or bodies. ( 7 )

8.

One of the legal issues that arise in relation to such procedures is how to determine which of the acts adopted by multiple actors throughout that procedure constitute ‘challengeable acts’, and then before which courts such acts should be challenged. ( 8 )

9.

The present appeal must be placed in that context. The appellant considers that the General Court erroneously ruled that the contested decision, adopted under the consistency mechanism, is not an act challengeable before the EU Courts.

10.

The task of monitoring and enforcing the rules of the GDPR is entrusted to the various supervising authorities of the Member States within their respective territories. ( 9 )

11.

To tackle the possible fragmentation in the implementation of data protection rules across the European Union that may result from such a ‘decentralised’ system, the GDPR provides for cooperation between national supervisory authorities. ( 10 )

12.

When a data processing operation has a cross-border dimension, the authority in charge of the processor or controller at issue – the lead supervisory authority (LSA) – must circulate its draft decision enforcing the rules of the GDPR against the processor or controller under its competence to the concerned supervisory authorities of other Member States.

13.

If those other authorities agree with the interpretation of the GDPR and with the enforcement measures proposed by the LSA, the latter may adopt its final decision, which is binding on the controller or processor at issue.

14.

However, if those other supervisory authorities express relevant and reasoned objections with which the LSA disagrees or considers them not to be relevant or reasoned, the LSA must submit the matter to the EDPB for the latter to take a decision. ( 11 )

15.

The EDPB adjudicates the dispute between the national supervisory authorities involved and resolves that individual case by means of a binding decision. ( 12 )

16.

According to Article 65(2) of the GDPR, that decision is addressed to and binds the LSA and all the other supervisory authorities concerned. ( 13 ) The decision is also published on the EDPB’s website. ( 14 )

17.

Within prescribed deadlines ( 15 ) and on the basis of that binding EDPB decision, the LSA must adopt its final decision, ( 16 ) which is then notified to the controller or processor at issue.

18.

WhatsApp is a company that provides internet-based calling and messaging services (‘the messaging service’).

19.

In order to create an account with that company for the use of that messaging service, a user must agree to its terms of service and its privacy policy. ( 17 )

20.

On 24 May 2018, WhatsApp changed its privacy policy to take account of changes introduced by the GDPR, which was to apply from 25 May 2018. ( 18 ) Existing users were presented with the option of accepting those changes or discontinuing their use of the appellant’s messaging service.

21.

Thereafter, the Irish Data Protection Commission (‘the Irish supervisory authority’) received a number of complaints from individual data subjects concerning the appellant’s data processing activities. ( 19 )

22.

In December 2018, and following a preliminary assessment of the complaints, the Irish supervisory authority initiated an inquiry into whether WhatsApp had discharged its GDPR transparency obligations, under Articles 12 to 14 thereof, with regard to the provision of information to both users and non-users of its messaging service and the transparency of that information. ( 20 )

23.

As WhatsApp’s messaging service entails cross-border processing throughout the European Union, in line with its obligations arising from the GDPR, the Irish supervisory authority circulated its draft decision to the other national supervisory authorities concerned. ( 21 )

24.

In response, the Irish supervisory authority received objections from the supervisory authorities of Germany (at Federation level), Hungary, the Netherlands, Poland, France, Italy, Portugal and the German Federal State of Baden-Württemberg. ( 22 ) Additionally, a number of comments on that draft decision were received from the supervisory authorities of Austria, the Netherlands, Denmark, Poland, Belgium, France and the German Federal State of Hamburg. ( 23 )

25.

Since a number of supervisory authorities expressed relevant and reasoned objections to the draft decision with which the Irish supervisory authority did not agree, the latter referred the objections to the EDPB for resolution. ( 24 )

26.

On 28 July 2021, the EDPB adopted the contested decision and subsequently notified the Irish and other concerned supervisory authorities. ( 25 )

27.

In the contested decision, the EDPB instructs the Irish supervisory authority to alter a number of the findings contained in the draft decision and to increase the fines proposed therein.

28.

In essence, the contested decision requires the Irish supervisory authority to find that ‘lossy hashed data’ ( 26 ) constitutes personal data within the meaning of Article 4(1) of the GDPR ( 27 ) and that the appellant breached the transparency rules of Article 5(1)(a), Article 13(1)(d) and (2)(e) and Article 14 of that regulation. ( 28 )

29.

In terms of procedural findings and fines, the contested decision requires that the appellant’s compliance period be reduced from six months to three months, claims that the Irish supervisory authority had misinterpreted the criterion relating to the quantum of the fines and states that the amounts of the fines envisaged by that authority should be increased. ( 29 )

30.

Acting on those instructions, the Irish supervisory authority altered its draft decision and adopted the final national decision on 20 August 2021. ( 30 )

31.

On 1 November 2021, the appellant brought an action before the General Court requesting the annulment of the contested decision.

32.

On 7 December 2022, the General Court made the order under appeal, rejecting the appellant’s action as inadmissible.

33.

In that order, the General Court considered, in essence, that the contested decision did not constitute a challengeable act for the purpose of the first paragraph of Article 263 TFEU and that the appellant was not directly concerned with that decision, within the meaning of the fourth paragraph of Article 263 TFEU.

34.

The order under appeal is structured as follows.

35.

By its appeal lodged on 17 February 2023, the appellant requests that the Court of Justice set aside the order under appeal, find the action admissible, refer the case back to the General Court to decide on the substance of the matter, and order the EDPB to pay the costs.

36.

The German Government intervened in support of the EDPB.

37.

A hearing was held on 26 November 2024 at which the appellant and the EDPB presented oral arguments.

38.

The appellant puts forward two grounds of appeal. By its first ground of appeal, it claims that the General Court misinterpreted the concepts of challengeable act, as arising from the first paragraph of Article 263 TFEU, and of direct concern, as contained in the fourth paragraph thereof. That error resulted in the misapplication of Article 263 TFEU in the case at hand, leading the General Court to incorrectly qualify the contested decision as not being an act challengeable by the appellant. By its second ground of appeal, the appellant claims that the General Court misinterpreted and incorrectly applied Article 65(1) of the GDPR in relation to the contested decision.

39.

In this Opinion, I shall propose to the Court of Justice that it find that the General Court incorrectly applied the analysis that is required under the first and fourth paragraphs of Article 263 TFEU to the consistency mechanism established by the GDPR. The first ground of appeal should thus be upheld and the order under appeal set aside. For that reason, it is not necessary to deal with the second ground of appeal.

40.

Beyond the immediate context of the present appeal, however, I observe that this case also raises an issue of a more horizontal nature: that is, the question of which analytical steps should be followed in order to determine the admissibility of an action for annulment brought against an act taken in the course of a composite procedure.

41.

Composite procedures vary considerably, each being specifically designed by the EU secondary act introducing them to fit the purpose which that particular procedure fulfils in a given area of administrative decision-making based on EU law.

42.

If the analytical steps in determining the admissibility of actions for annulment by natural or legal persons against acts taken in such procedures are misunderstood, there is a likelihood that, in future cases relating to different types of composite procedures, the General Court would again unjustifiably deny such persons access to the EU Courts.

43.

However, the conditions governing Article 263 TFEU remain the same, notwithstanding those different structures. Accordingly, the general rules on the admissibility of actions introduced by natural or legal persons against acts adopted within a composite procedure should be applied in the same way – using the same analytical steps – to all such composite procedures, all the while taking into consideration the particularities of each procedure.

44.

As I will try to show in my analysis, the General Court, inspired by the particularities of the GDPR consistency mechanism, introduced some unnecessary (and misleading) analytical steps into its assessment of the conditions for admissibility under Article 263 TFEU. In my view, for instance, asking whether the contested decision is an intermediary act within that procedure detracts from the relevant question of whether that decision is a final and binding act, which is the only appropriate question to ask in the context of an analysis to be undertaken under the first paragraph of Article 263 TFEU. Similarly, the inquiry into whether the contested decision can be enforced directly against the appellant detracts from the analytical question of whether that decision in itself affects the appellant’s legal position, as required by the fourth paragraph of Article 263 TFEU.

45.

When it justifies its finding of (in)admissibility in a specific case, the Court of Justice often refers to the particularities of the composite procedure that was at issue in the case at hand and not rarely distinguishes those particularities from the characteristics of another procedure in which it arrived at a different conclusion. ( 31 ) Any such explanations of the Court cannot be generalised and mechanically transposed to new cases. ( 32 )

46.

The General Court relied in its analysis on several judgments of the Court of Justice, especially the judgments in IBM ( 33 ) and Deutsche Post. ( 34 )

47.

I will suggest to the Court of Justice that it revisit some of those judgments and clarify that certain statements made therein were not intended to add to the conditions established by the FEU Treaty. Rather, their purpose was to explain the application of the Treaty rules to the particular situation underlying those cases. The automatic reproduction in later judgments, which arise out of different circumstances, of the statements made by the Court in earlier cases might lead – as it did in the present case – the General Court to arrive at an incorrect conclusion on the admissibility of an action for annulment.

48.

Accordingly, the present case offers the possibility to the Court of Justice to explain again the analytical steps that are necessary and sufficient to establish whether an individual can introduce a direct action for annulment.

49.

In that respect, I believe it is important that the Court of Justice draw a clear distinction between two analytical steps underlying the conditions for admissibility under Article 263 TFEU: first, the analysis of the question of whether an act is a challengeable act for the purpose of the first paragraph of Article 263 TFEU; and, second, where that act is challengeable, the analysis, under the fourth paragraph of Article 263 TFEU, of whether a particular applicant, who is a natural or legal person, is entitled to challenge that act.

50.

In the light of the foregoing, my analysis is structured as follows. I will commence with the preliminary issue that the underlying action was not brought out of time (A). I shall then move on to the substance of the appeal to lay out why I think that the Court should annul the order under appeal. Following the structure of the first ground of appeal, I will first explain that the General Court confused the conditions for establishing whether the contested decision is a challengeable act with the conditions for finding whether the appellant is directly concerned. It is on that basis that I find that that court incorrectly concluded that the contested decision is not a challengeable act (B). I will then explain that the General Court also committed an error of law when it considered that the contested decision does not concern the appellant directly (C). Finally, I will show that, contrary to the position of the General Court, the logic of the system of judicial remedies, as designed under the Treaties and interpreted by the Court of Justice, requires that the validity of the contested decision be decided in a direct action before the EU Courts (D).

51.

In its response, the EDPB claims that the appellant’s action was brought out of time. ( 35 ) The EDPB refers to a letter in the Court’s file, dated 16 August 2021, from which it appears that the Irish supervisory authority had informed the appellant already on 13 August 2021 of ‘the relevant content’ of the contested decision prior to the EDPB’s publication thereof on its website. Accordingly, the EDPB argues that the period to lodge an action for annulment would have expired on ‘25 October 2021 at the latest’, that is to say, prior to 1 November 2021, the date on which the application before the General Court was filed.

52.

I consider that that argument should be rejected.

53.

It is clear from the case-law that the reference, in the sixth paragraph of Article 263 TFEU, to the day on which a measure came to the knowledge of an applicant is subsidiary to the criteria of publication or notification of the same measure. ( 36 )

54.

In the present case, there has been no notification of the contested decision to the appellant. The EDPB is only under the obligation to notify its decision directly to the Irish LSA and the concerned national supervisory authorities. ( 37 )

55.

It must accordingly be determined whether the contested decision was published, within the meaning of the sixth paragraph of Article 263 TFEU.

56.

Article 263 TFEU does not attach any specific conditions to the act of publication.

57.

However, since the Court of Justice favoured the interpretation of the time limits prescribed by the Treaties in such a way that any undue limitation of the right to an effective judicial remedy is avoided, ( 38 ) the concept of ‘publication’ must be understood broadly. ( 39 )

58.

In that respect, the Court has already had occasion to hold that the publication on a website, where mandated by EU secondary law, satisfies the requirement of ‘publication’, as contained in the sixth paragraph of Article 263 TFEU. ( 40 )

59.

In the present case, the publication of binding decisions of the EDPB, such as the contested decision, is mandated by the third sentence of Article 65(5) of the GDPR.

60.

Given that the appellant challenged the contested decision within the applicable time limits from its date of publication on the EDPB’s website (2 September 2021), the fact that it may also have been aware of the material content of that decision prior to its mandated publication is irrelevant for the purposes of the admissibility of the present action for annulment. ( 41 )

61.

In the light of the above, there is no need to determine the precise point in time at which the appellant became aware of the content of the contested decision.

62.

I accordingly propose that the Court reject the EDPB’s argument that the action before the General Court was brought out of time.

63.

By its first and second arguments of the first ground of appeal, the appellant claims that, contrary to the position of the General Court, the question of whether an act is a challengeable act does not require an analysis of whether that act brings about a distinct change in the appellant’s legal position.

64.

I agree with the appellant. The question of whether a measure is a challengeable act is different from the question of whether a concrete applicant, who is a natural or legal person, can challenge that act – provided it is a challengeable act – in the first place.

65.

The question of whether an act is a challengeable act pertains to the analysis under the first paragraph of Article 263 TFEU. That requires a different and separate method of analysis, one which asks different questions from those which are relevant for establishing whether an act affects the legal position of the applicant (which pertains to the fourth paragraph of Article 263 TFEU).

66.

That conclusion follows from the text, structure and history of Article 263 TFEU (a) and is not contrary to the case-law of the Court of Justice (b).

67.

There are several reasons why the assessment of the question of whether the contested decision constitutes the type of act that can be the subject of a validity assessment by the EU Courts should be separate from the question of whether that act affects the appellant’s legal position.

68.

First, the determination of the type of act that can be challenged before the EU Courts is provided for in the first paragraph of Article 263 TFEU. That determination is made without regard to the person that introduces the challenge.

69.

Therefore, the answer to the question of whether an act is a challengeable act must be the same, whether the action for annulment was introduced by a privileged (as enumerated in the second paragraph of Article 263 TFEU), a semi-privileged (as enumerated in the third paragraph thereof) or a non-privileged (as enumerated in the fourth paragraph thereof) applicant.

70.

Second, the answer to the question of whether an act is challengeable requires an assessment of whether that act is capable of producing binding legal effects vis-à-vis a third party. ( 42 ) That party does not need to be the same as the one bringing the action for annulment in question.

71.

That requirement, as I will explain below, follows from the current wording of the first paragraph of Article 263 TFEU, which is the result of several amendments, and from the case-law of the Court, which was one of the driving forces behind those changes.

72.

In its current version, the first paragraph of Article 263 TFEU provides as challengeable acts (i) legislative acts, (ii) acts of the Council, of the Commission and of the European Central Bank, other than recommendations and opinions, and (iii) acts of the European Parliament and of the European Council, as well as of bodies, offices or agencies of the European Union intended to produce legal effects vis-à-vis third parties.

73.

The original EEC Treaty did not enumerate the acts open to challenge but only defined them negatively, as ‘legal acts of the Commission and Council, other than recommendations and opinions’. ( 43 )

74.

As the Treaty defines recommendations and opinions as acts having no binding force, ( 44 ) the Court concluded that all acts (of the EU institutions and other bodies), notwithstanding their form or name, that are intended to have binding legal effects are challengeable acts. ( 45 )

75.

If an act does not have binding legal effects, the action is inadmissible, whether it was brought by privileged applicants or by non-privileged applicants. ( 46 )

76.

There is therefore no need to ask the subsequent question of whether the act affects the applicant’s legal position, pursuant to the fourth paragraph of Article 263 TFEU. ( 47 )

77.

It follows from the case-law and the wording of the first paragraph of Article 263 TFEU that an act is legally binding if it is intended to produce legal effects vis-à-vis third parties. What does that mean?

78.

To be considered as having binding legal effects vis-à-vis third parties, an act must have legal effects outside of the institution or body that adopted it. If the act creates obligations only ‘internally’, that is to say for the same institution that adopted it, but not ‘externally’, that is, for third parties, that act does not constitute a challengeable act. ( 48 )

79.

The third party for which the act has legally binding effects need not necessarily be the applicant. ( 49 )

80.

The Court has further clarified that an act has effects outside of the institution only if, by that act, that institution that adopted it expressed its final position. ( 50 )

81.

A position is final if the institution or body that adopted the act cannot further change it; that is to say, it could only prevent the legal effects arising from that act by revoking it. ( 51 ) If the final act is not revoked by its author, the only way its legal effects could be nullified is by that act’s invalidation in judicial proceedings.

82.

On the basis of the aforementioned, that means the following for the present case: in order to decide on whether the contested decision is a challengeable act, it was necessary and sufficient that the General Court establish that the contested decision represented the EDPB’s final position and that that decision imposed an obligation on someone outside of that body; in this case, the Irish supervisory authority.

83.

For that assessment, it was not necessary to assess whether or not that act also brings about a distinct change in the appellant’s legal position. The latter is a question that relates to direct concern and not to the quality of challengeable act. ( 52 )

84.

Does the case-law relied on by the General Court suggest a different conclusion?

85.

In paragraph 41 of the order under appeal, the General Court explained that it must examine ‘whether the contested decision has legal effects bringing about a distinct change in WhatsApp’s legal position and whether it is of direct concern to WhatsApp within the meaning of the fourth paragraph of Article 263 TFEU’. ( 53 )

86.

The General Court’s conclusion that the assessment of whether the contested decision brings about a distinct change in WhatsApp’s legal position, on the one hand, and the assessment of whether that decision is of direct concern to that company, on the other hand, are two separate analyses to be undertaken appears to be based on the case-law that it cites, namely the judgments in IBM and Deutsche Post. ( 54 )

87.

I will therefore revisit those judgments.

88.

In paragraph 9 of the judgment in IBM, the Court of Justice stated that ‘any measure the legal effects of which are binding on, and capable of affecting the interests of, the applicant by bringing about a distinct change in his legal position is an act or decision which may be the subject of an action under Article 173’. ( 55 )

89.

That wording, which was repeated in a large number of judgments that followed, by both the Court of Justice ( 56 ) and the General Court, ( 57 ) has been and might continue to be interpreted to imply that the question of whether an act constitutes a challengeable act under the first paragraph of Article 263 TFEU encompasses also the assessment of whether it affects an applicant’s legal position. ( 58 ) That is also how the General Court appears to have understood paragraph 9 of the judgment in IBM (see point 86 of this Opinion).

90.

To my mind, that is not a correct (or useful) understanding of that paragraph.

91.

I read paragraph 9 of the judgment in IBM as the Court of Justice’s expression – in a single sentence – of all the conditions necessary to be fulfilled if a non-privileged applicant is to gain access to the EU Courts: that it to say, those flowing from the first paragraph of Article 263 TFEU, on the one hand, and those flowing from the fourth paragraph of Article 263 TFEU, on the other hand.

92.

With that sentence, the Court of Justice does not make the question of the effects of the act on the applicant a part of the assessment of the fulfilment of the conditions under the first paragraph of Article 263 TFEU. Indeed, an act may still be considered a challengeable act in general, even if it cannot be challenged in a specific case by a particular non-privileged applicant because it does not bring about a distinct change in that applicant’s legal position.

93.

To my mind, the Court tried to dispel the possible confusion created by the repeatedly used phrase in the judgment in IBM in the following paragraphs of the judgment in Deutsche Post:

94.

To my mind, in the judgment in Deutsche Post, the Court sought to clarify that paragraph 9 of its judgment in IBM pertains to a situation where a non-privileged applicant is the addressee of the challenged act. That is because, in such a situation, the answer to the question of whether an act has binding legal effects vis-à-vis third parties necessarily requires an assessment of whether that act has effects in relation to the applicant as the addressee of the act. In such a situation, the question of whether an act has binding legal effects and the question of whether it changes the legal situation of the applicant are the same question.

95.

However, when the non-privileged applicant is not the addressee of the act at issue, the question of whether that act brings about a distinct change in its legal position is the question relating to direct concern, required to be assessed under the fourth paragraph of Article 263 TFEU – and not under the first paragraph thereof.

96.

The often-misquoted wording, according to which the question of whether the act has legal effects bringing about a distinct change ‘overlaps’ with the requirement for direct concern in the fourth paragraph of Article 263 TFEU, in fact expresses the Court’s understanding that the question of direct concern has to be assessed separately and in addition to the question of whether the act produces binding legal effects.

97.

In its more recent case-law, the Court has, after quoting paragraph 38 of the judgment in Deutsche Post, usually continued with the analysis of whether the act in question is of direct concern to the non-privileged applicant who is not an addressee of the challenged act. ( 61 )

98.

Therefore, the judgment in IBM, as explained by the judgment in Deutsche Post, should not be read as fusing the requirements under the first and fourth paragraphs of Article 263 TFEU for situations in which an act is addressed to a person other than the applicant.

99.

In such a situation, that is to say, where the act is addressed to someone other than the applicant, the requirement that the act be legally binding is separate from the requirement that that act bring about a distinct change in the applicant’s legal position.

100.

Here, in order to answer the question of whether the action introduced by an applicant is admissible, it is not sufficient for the act at issue to have binding legal effects on its addressee or someone else; the Court must also assess whether the act at issue affects the applicant’s legal position. That is what is required by the additional admissibility condition that results from the fourth paragraph of Article 263 TFEU.

101.

In its judgment in Deutsche Post, the Court followed precisely that methodology and established, in two distinct steps, first, that the measure is legally binding, and, only thereafter, that it directly concerns the non-privileged applicant. It is also important that in the part of the analysis concerned with the question of whether the measure was legally binding, the Court did not deem it relevant to determine whether that measure was preparatory within the larger procedure in which it was enacted. ( 62 ) According to the Court, what mattered, for the purposes of that analysis, was that the decision produced independent legal effects, making it capable of forming the subject matter of an action for annulment. ( 63 ) Only after establishing that the General Court erred in law when it considered that the challenged act was not legally binding by reason of its preparatory nature, ( 64 ) the Court of Justice proceeded with the second step of its analysis, to find that that measure was also of direct and individual concern to the non-privileged applicant at issue, in that case, Deutsche Post AG. ( 65 )

102.

To my mind, therefore, the objective of the three paragraphs of the judgment in Deutsche Post cited in point 93 of the present Opinion is precisely to remove the possible confusion that arises from the judgment in IBM and to distinguish the analysis of the legally binding nature of the challenged act from the analysis of whether that act affects the legal position of the applicant.

103.

In the present case, the General Court failed to distinguish between those two analytical steps. In considering that the contested decision does not, in itself, affect the appellant’s legal position, that court erroneously concluded that the contested decision does not constitute a challengeable act. In that analysis, it did not focus on the question of whether the contested decision produces legally binding effects vis-à-vis third parties. Rather, it concentrated on the question of whether that act should be viewed as intermediary from the point of view of the applicant. ( 66 ) In so doing, the General Court erred in a similar manner as it did in its order in Deutsche Post v Commission ( 67 ) many years prior, and which the Court of Justice annulled in its judgment in Deutsche Post.

104.

To my mind, the question of whether an act is ‘intermediate’ or ‘preparatory’ is superfluous and unnecessarily complicates the analysis under the first and fourth paragraphs of Article 263 TFEU. As the present case shows, a dogmatic reliance on those concepts may, in fact, lead to an incorrect conclusion on the admissibility of an action for annulment. I will turn to that issue now.

105.

In paragraph 42 of the order under appeal, the General Court considered it relevant for its assessment of admissibility that the contested decision (i) constitutes a ‘preparatory’ or ‘intermediate’ act in a procedure that must be closed by a final decision of a national supervisory authority and (ii) that that decision is not directly enforceable against the appellant.

106.

Neither of those two factors – the ‘preparatory’ or ‘intermediate’ nature of the act or its direct enforceability against the appellant – are analytically relevant for answering the question of whether that act is a challengeable act for the purpose of the first paragraph of Article 263 TFEU.

107.

Those factors are equally irrelevant in the assessment of whether that act is of direct concern to the appellant under the fourth paragraph of Article 263 TFEU (which I shall address in Section C below).

108.

Likewise, the question of whether the act at issue is ‘final’, that is to say, whether it closes a certain composite procedure, or whether ‘another’ act of the same or different body is to follow is again not relevant for determining whether the act at issue is open to challenge. Indeed, as I explain in point 78 of this Opinion, the correct question to ask in relation to the assessment of whether an act may be challenged is whether that act produces independent legal effects – which it may only produce if it is definitive or final from the point of view of the institution or body that adopted it.

109.

In the order under appeal, the General Court relied on paragraph 10 of the judgment in IBM to conclude that there exists a principle according to which intermediate acts are not acts open to challenge. ( 68 ) Having established that principle, the General Court explained that the possibility to challenge an intermediate act is an exception, which exists when that act produces independent legal effects. ( 69 )

110.

However, in paragraph 10 of its judgment in IBM, the Court of Justice laid down the following: ‘in principle an act is open to review only if it is a measure definitively laying down the position of the Commission or the Council on the conclusion of that procedure’. ( 70 ) Accordingly, the Court of Justice explained that the focus of the analysis of the challengeable nature of an act should be on the question of whether the act at issue expresses the definitive position of the institution, viewed from the perspective of that institution.

111.

The judgment in IBM did not, therefore, reveal the existence of a principle according to which intermediate acts are not challengeable.

112.

Furthermore, the judgment in IBM did not even concern a composite procedure, but a procedure conducted solely by the Commission. In the context of that procedure, the Court assessed the relevance of different stages of the internal procedure within the Commission to conclude that the letter that was challenged in that case did not express a definitive position of that institution. ( 71 )

113.

Thus, the term ‘intermediary’ or ‘preparatory’ may be relevant only if used in opposition to the term ‘definitive’ or ‘final’ within the internal procedure of an institution or body. ( 72 )

114.

If an act were to be understood as ‘intermediary’ and therefore not challengeable, purely by reason of its place in the composite procedure in which, from the applicant’s perspective, there will exist another act that will be addressed to that applicant, it would never be possible for an individual to challenge the actual act that affects its legal position and so is of direct concern to that individual. That would be contrary to the fourth paragraph of Article 263 TFEU.

115.

As used in the present case, the General Court’s focus on the ‘intermediate’ or ‘preparatory’ nature of the contested decision thus detracts the analysis from the only relevant question under the first paragraph of Article 263 TFEU: that is, whether the position of the EDPB, as expressed in the contested decision, constitutes the final position of that body, namely one that is binding vis-à-vis a third party, irrespective of the fact that another act will follow to ‘close’ the procedure laid down in the GDPR’s consistency mechanism.

116.

In the present case, the contested decision is the act of the EDPB. By that decision, that body adopts its final position on the question of, first, whether ‘lossy hashed data’ as used by the appellant constitutes ‘personal data’ within the meaning of the GDPR and, second, whether the appellant breached the transparency rules of the GDPR. Both of those final findings have the legal effect of obliging the Irish supervisory authority, in its role as LSA, to amend its draft decision (that is, the very decision in which it had previously proposed to conclude to the contrary). By the contested decision, the EDPB also obliges that authority to reduce the relevant compliance period and gives binding instructions on how to calculate the fines at issue. The latter will result in the increase of those fines in comparison to the fines that the Irish supervisory authority intended to impose. Those findings are final from the perspective of the EDPB in the sense that they lay down that body’s definitive position on the questions referred to it. They thereby create a obligation ( 73 ) for the Irish supervisory authorities which may be nullified only if the EDPB revokes its decision or if the EU Courts annul it.

117.

As that decision is final, and as it produces binding legal effects outside of the body that adopted it, that is to say, vis-à-vis the Irish supervisory authority, the General Court should have concluded that the contested decision satisfies the conditions under the first paragraph of Article 263 TFEU and therefore should be classified a challengeable act.

118.

The second superfluous element which the General Court introduced in its analysis is the direct enforceability of the EDPB’s decision against WhatsApp.

119.

I can be brief on that point: given that the determination of the ability of an act to be challenged does not depend on whether or how it changes the legal position of an applicant, the question of the direct enforceability of the contested decision against WhatsApp cannot be relevant for the analysis under the first paragraph of Article 263 TFEU. Moreover, as I will argue later, the direct enforceability against that party as a criterion to assess whether the EDPB’s decision is of direct concern to that company is also irrelevant.

120.

The answer to the question of whether an act of an institution or body of the European Union is a challengeable act before the EU Courts, for the purpose of the first paragraph of Article 263 TFEU, requires an assessment of whether that act expresses the definitive position of that institution or body which has binding legal effects for someone outside of that institution or body.

121.

In order to answer the question of whether the act can be challenged before the EU Courts, the third person on which the act has binding legal effects does not need to be the same as that which introduced the action for annulment.

122.

The question of whether the person that introduced the action against a challengeable act has the capacity to challenge that act is resolved under the fourth paragraph of Article 263 TFEU and not under the first paragraph thereof.

123.

In order to establish whether an act is challengeable, it is irrelevant that that act constitutes an ‘intermediary’ step of a composite procedure.

124.

By focusing on the fact that the contested decision does not constitute the final decision within the consistency mechanism envisaged by the GDPR instead of assessing whether that decision constitutes the final or definitive decision of the EDPB that produces binding legal effects on the Irish supervisory authority, the General Court erred, in the order under appeal, in its assessment of the conditions under the first paragraph of Article 263 TFEU.

125.

I therefore suggest that the Court of Justice uphold the first two arguments of the first ground of appeal.

126.

By its third and fourth arguments of the first ground of appeal, the appellant claims that the General Court erred in finding that it is not directly concerned by the contested decision.

127.

According to the appellant, while the General Court correctly lays down the Court of Justice’s case-law requiring that two conditions must be fulfilled to establish that an act is of direct concern to a natural or legal person that is not the addressee of that act, ( 74 ) the General Court however erroneously applies that case-law.

128.

According to the case-law cited by the General Court, the ‘condition that a natural or legal person must be directly concerned by the measure being challenged requires two cumulative criteria to be met, namely, first, the contested measure must directly affect the legal situation of that person and, secondly, it must leave no discretion to its addressees who are entrusted with the task of implementing it, such implementation being purely automatic and resulting from EU rules alone without the application of other intermediate rules’. ( 75 )

129.

The treatment of those two criteria as ‘cumulative’ results from the case-law in which the challenged act necessitated implementing measures. ( 76 )

130.

In such a situation, the challenged measure could directly affect the legal situation of the applicant only if the implementing body had no choice as to whether and how to implement that measure. ( 77 )

131.

That is the situation in the present case. The contested decision, which concerns the appellant, is addressed to the Irish supervisory authority and not to the appellant. The decision requires the Irish authority to amend its draft decision when adopting the final decision, which is addressed to the appellant, in the way that it implements the findings contained in the contested decision. Therefore, the question of whether the Irish supervisory authority was left with discretion after the EDPB had adopted the contested decision is relevant for finding whether there is direct concern to the appellant.

132.

In that context, the appellant claims that the General Court misinterpreted the fourth paragraph of Article 263 TFEU in two ways. First, in its assessment of the first condition for direct concern, the General Court applied the criteria of ‘enforceability’ and the ‘final step in procedure’, neither of which are relevant for establishing direct concern. Second, in its assessment of the second condition for direct concern, the General Court misapplied the criterion of discretion to the contested decision.

133.

I agree with the appellant on both points.

134.

The first misinterpretation for which the appellant reproaches the General Court is that the latter considered, in paragraph 52 of the order under appeal, that the condition that the contested decision directly affects the legal position of WhatsApp is not fulfilled because that act is not enforceable against it.

135.

The condition of ‘enforceability’ does not figure in the fourth paragraph of Article 263 TFEU nor does it arise from the case-law of the Court of Justice.

136.

With good reason. In most situations in which an implementing measure is required at either EU or national level, the EU decision that is being implemented is not itself enforceable against natural or legal persons, even if those persons are the intended addressees of that measure. The very reason why an implementing measure is often required is that the EU measure at issue cannot of itself ‘reach’ the applicant. In those situations, only the implementing measure is enforceable against a natural or legal person.

137.

If the ‘direct enforceability’ of a measure against a natural or legal person were a condition for direct concern, there would be hardly any situation in which non-privileged applicants would be capable of challenging an EU act that requires implementing measures.

138.

In fact, it does not matter for the question of direct concern whether only the implementing measure at issue is enforceable against a natural or legal person, and not the measure whose validity that person challenges before the EU Courts. If the implementing measure is a mere replica of the measure that is the subject of the action because the implementing body had no choice as to whether and how to frame its decision, it is clear that the challenged measure is the real cause of affectation of the applicant’s legal position.

139.

In the present case, that means that the General Court erred when it took into consideration the enforceability of the contested decision towards the appellant as a relevant factor for assessing whether the appellant is directly concerned by that decision.

140.

In the same paragraph 52 of the order under appeal, the General Court considered that the appellant is not directly affected by the contested decision because that decision does not constitute the final step in the procedure envisaged by the GDPR’s consistency mechanism, but that it instead requires implementing measures at national level.

141.

It already follows from the preceding discussion that a person can be directly concerned by a measure even where that measure entails implementing measures. ( 78 )

142.

The second condition for establishing direct concern in the case-law of the Court of Justice (see point 128 of this Opinion), which the General Court referred to as applicable law in the order under appeal, ( 79 ) would make no sense if direct concern could not exist where a contested measure entailed implementing measures.

143.

Additionally, that understanding disregards the distinction between the requirement that a regulatory act does not entail implementing measures and the requirement for direct concern, both of which must be fulfilled for a non-privileged applicant to establish standing under the fourth paragraph of Article 263 TFEU. ( 80 )

144.

Thus, the General Court erred when it considered that the fact that, under the consistency mechanism, the Irish supervisory authority must adopt a decision implementing the contested decision is a relevant criterion for the analysis of whether the latter decision is of direct concern to the appellant.

145.

That court tried to distinguish the situation in the present case from situations as they arise in the area of State aid in which the Commission finds an aid incompatible with the internal market and orders the Member State concerned to recover the aid at issue. ( 81 ) In such situations, the Court of Justice has found that recipients of aid are directly concerned by a relevant Commission decision even where that decision had to be implemented by the Member State at issue and could only be enforced on the basis of said implementing measures. ( 82 )

146.

I must agree with the appellant that the General Court wrongly relied on those cases in order to distinguish the present situation and to find that WhatsApp is not directly concerned by the contested decision. ( 83 )

147.

Quite the contrary, as those cases instead provide arguments in favour of finding that WhatsApp is directly concerned by the contested decision. That decision is the source of the change in the appellant’s legal position, notwithstanding the need for the adoption of an ‘implementing’ decision by the Irish supervisory authority. At its heart, the logic is thus precisely that taken by the Court of Justice in the case-law cited by the General Court in paragraph 64 of the order under appeal.

148.

Likewise, I consider that the General Court erred in finding the contested decision not to be analogous to Commission decisions demanding the recovery of aid by virtue of the fact that the contested decision did not complete the administrative procedure at issue at national level. ( 84 ) However, in so far as it concerns the issues decided on by the EDPB by means of the contested decision, the procedure governing the consistency mechanism was, in fact, completed, given that the Irish supervisory authority cannot change the findings contained in the contested decision. The fact that that authority might need to also decide about certain additional issues not covered by the contested decision does not change the ‘finality’ of the findings made in the contested decision as regards the issues that it settled.

149.

From the above, it appears clear to me that the contested decision affects the legal position of the appellant because it, first, qualifies its ‘lossy hashing’ procedure as entailing personal data and, second, finds that company’s practice to be in breach of certain transparency rules imposed on controllers by the GDPR.

150.

That finding alone creates the legal obligation for the appellant to change its practice. Furthermore, it represents the legal basis for the Irish supervisory authority to impose higher fines on the appellant. Without the contested decision, that authority could not do so. The only reason for which it included those findings in its final decision addressed to the appellant was because it was obliged to do so by the contested decision. To my mind, that makes it pretty clear that the real reason for the change in the appellant’s legal position is the contested decision and not, as the General Court wrongly concludes, the decision of the Irish supervisory authority.

151.

If an act subject to an action for annulment requires implementing measures, it will be considered to be of direct concern to the applicant only if the body that adopts those implementing measures does not enjoy any discretion, but must instead automatically apply the findings of the contested decision.

152.

In the present case, that would mean that the contested decision would be of direct concern to WhatsApp if the Irish supervisory authority had no discretion as to whether or how to implement that decision.

153.

In the order under appeal, the General Court considered that the Irish supervisory authority enjoyed discretion and that the appellant was therefore not directly concerned by the contested decision, but only by that authority’s final decision. ( 85 )

154.

I agree with the appellant that here, too, the General Court erred in its assessment.

155.

First, the EDPB’s finding that ‘lossy hashing’ constitutes the processing of personal data and that the appellant has, as data controller, infringed its obligations under Articles 5, 13 and 14 of the GDPR had to be transposed into the final decision of the Irish supervisory authority, leaving the latter no discretion on the possibility to come to a contrary conclusion.

156.

Second, the contested decision imposed on the Irish supervisory authority an unconditional obligation to increase the fines and use the calculation methods stated in the EDPB’s decision, even if the final calculation and imposition of the amount of those fines was left to the Irish supervisory authority. That means that no discretion was left to that authority, in its capacity of ‘implementing body’, to either maintain the original fines or decrease them. ( 86 )

157.

Therefore, in relation to those aspects of the contested decision, the Irish supervisory authority did not enjoy any discretion as to whether or how to decide in relation to the appellant.

158.

It follows that the General Court erred in finding that, with regard to those aspects, the Irish supervisory authority enjoyed discretion. ( 87 )

159.

Under Article 65(1)(a) of the GDPR, the EDPB decides only on those aspects of the application of the GDPR that were objected to by other supervisory authorities and not settled among the participating supervisory authorities. Therefore, the Irish supervisory authority is indeed left with discretion to decide on those issues that were not submitted to the EDPB but which nonetheless form part of the final national decision. ( 88 )

160.

Is this relevant for finding that the appellant is directly concerned by the contested decision?

161.

In the order under appeal, the General Court considered that the limited scope of the contested decision mattered because the Irish supervisory authority’s final decision constitutes a whole that cannot be severed according to those aspects for which the Irish supervisory authority had and did not have discretion. ( 89 )

162.

To my mind, and again in agreement with the appellant, that element does not matter for the question of whether the contested decision is of direct concern to that party.

163.

For an assessment of the question of direct concern, one must start from the substance of the challenged act. ( 90 ) In that respect, it suffices that the content of the contested decision, which affects the legal position of the appellant, left no discretion to the Irish supervisory authority on those points, even if its final decision also dealt with other issues.

164.

In fact, as I will explain in the next part of this Opinion, if the appellant did not challenge the contested decision before the General Court, it would lose the possibility to plead the invalidity of that decision as part of its challenging the final decision of the Irish supervisory authority before the competent Irish courts.

165.

As the appellant explained at the hearing, such proceedings before the Irish courts are indeed pending. There, the appellant seeks the invalidation of the final decision of the Irish supervisory authority also for those aspects that are not dealt with in the contested decision. At the same time, however, the appellant challenged the EDPB’s decision before the General Court to safeguard its right to plead the invalidity of those parts of the Irish supervisory decision over which that authority could not exercise any discretion.

166.

It follows that the General Court also erred in its conclusion that the appellant was not directly concerned by the contested decision because the Irish supervisory authority enjoyed discretion in ‘implementing’ the contested decision due to the fact that the final national decision also contained aspects that were not covered by the contested decision.

167.

The General Court erred in applying the conditions for assessing the existence of direct concern under the fourth paragraph of Article 263 TFEU.

168.

First, it based its assessment on non-existing conditions that the challenged act (i) be directly enforceable towards the applicant in annulment procedures and (ii) not entail implementing measures.

169.

Second, the General Court erred in the assessment that the contested decision left discretion to the implementing authority, in this case the Irish supervisory authority.

170.

Finally, the General Court erred in concluding that the presence of parts not covered by the contested decision in the Irish supervisory authority’s final decision was relevant for the question of whether the contested decision left no discretion to that authority.

171.

I therefore suggest that the Court of Justice uphold the third and fourth arguments of the first ground of appeal.

172.

By its fifth argument within the first ground of appeal, the appellant argues that the General Court misstated the procedural requirements of the EU system of judicial remedies.

173.

In the order under appeal, the General Court considered that, in the procedure laid down by the consistency mechanism, legal proceedings against the final decision of the national supervisory authority must be introduced before the competent national courts. In the General Court’s view, the logic of the complete system of judicial remedies speaks in favour of the national court as the appropriate forum, ( 91 ) which would then initiate the preliminary ruling procedure before the Court of Justice on the validity of the part of the national decision that is dictated by the relevant EDPB decision.

174.

There is some force in the position of the General Court to require the concentration of actions in one court. Its proposed solution would, in fact, resolve the current procedural inconvenience that effectively requires an applicant to introduce two separate actions, one before the General Court and another before a national court, if that party wants to ensure the effective safeguard all of its rights under EU law. That is, indeed, not the most efficient way to protect one’s rights.

175.

In the present case, the appellant has done precisely that: it has introduced two actions, one before the General Court and the other before the competent Irish courts. However, at least in its current structure, the EU system of judicial protection provides for no other solution, as I shall explain.

176.

First, as is well known, national courts do not have the power to invalidate acts of EU institutions and other bodies. Therefore, if they consider that an EU act is invalid, they must initiate the preliminary ruling procedure before the Court of Justice and obtain confirmation of that invalidity from that court. ( 92 )

177.

Second, a national court cannot question the validity of an EU act if the party that relies on that invalidity satisfies the standing conditions under the fourth paragraph of Article 263 TFEU but did not challenge that act within the time limit provided for by the sixth paragraph thereof before the EU Courts. That follows from the judgment in TWD Textilwerke Deggendorf ( 93 ) and was confirmed in later judgments, including the judgment in Georgsmarienhütte and Others, ( 94 ) which was discussed by the parties to this procedure.

178.

In the latter judgment, the Court held that ‘where a person seeking to challenge an EU measure undoubtedly has standing under the fourth paragraph of Article 263 TFEU, that person is bound to make use of the remedy provided for in that provision by bringing an action before the General Court’. ( 95 ) If the person who had the opportunity to do so did not introduce an action for annulment within the deadline provided for under the sixth paragraph of Article 263 TFEU, the national court cannot accept a plea of invalidity of an EU act, introduced by that person, but has to consider the challenged act to be final in relation to that person. ( 96 ) If seised by a national court in a preliminary reference procedure in such a situation, the Court of Justice would have to reject the reference as inadmissible, as it would be responding to a question the answer to which cannot be used by the referring court.

179.

A recent example involving composite procedures is the judgment in Iccrea Banca. ( 97 ) In that judgment, the Court found inadmissible part of the preliminary reference of the Tribunale amministrativo regionale per il Lazio (Regional Administrative Court, Lazio, Italy), before which a bank, Iccrea Banca, challenged the calculation of the amount of its contribution to the Single Resolution Fund. The Court considered that that bank was directly and individually concerned by a decision of the SRB – which was the basis for establishing the amount of those contributions – but that it had failed to challenge that decision through an action for annulment before the General Court. ( 98 ) Iccrea Banca, therefore, had lost the opportunity to raise the plea of invalidity of the SRB decision indirectly before the national court, such that the Court of Justice had to dismiss the reference on that point as inadmissible.

180.

Applying that case-law to the present situation, in which WhatsApp had standing to challenge the contested decision before the General Court, it is clear that the invalidity of the EDPB decision could not be raised before the national court if WhatsApp had not sought to challenge that decision also directly before the General Court within the time period laid down in the sixth paragraph of Article 263 TFEU. ( 99 )

181.

Accordingly, given that, first, the appellant is directly concerned by the contested decision and, second, as the General Court itself found, that the contested decision is of individual concern to the appellant, ( 100 ) the challenge against the contested decision must be introduced before the EU Courts and not before the national courts.

182.

Recital 143 of the GDPR confirms that the proper organisation of judicial review in a situation, such as the one at issue in the present case, should be conducted through actions for annulment before the General Court. ( 101 ) Even if that recital is not binding, as rightly submitted by the EDPB, it nonetheless describes the consequences that result from the application of the binding norms of the Treaty relating to the organisation of judicial proceedings.

183.

Finally, I might add to the preceding arguments that the direct action before the General Court, in which the EU body which is the author of the contested decision is a party to the proceedings, is, to my mind, the more appropriate avenue for deciding on the validity of its decision. After all, before the national court, the procedural role of that body would depend on the relevant national procedural rules, thus possibly denying it access to the debate surrounding its own act. ( 102 )

184.

In the order under appeal, the General Court also expressed its worries regarding the possibility of diverging decisions at EU and national level, which may result from overlapping judicial proceedings. ( 103 )

185.

This is not new territory. As the Court explained in its judgment in Masterfoods and HB, where the validity of an EU act is questioned before both the national courts and the EU Courts, the former are under an obligation, by virtue of the principle of sincere cooperation, not to take a decision which may present a risk of conflict with an existing or forthcoming decision by the EU Courts. ( 104 ) Thus, where an action for annulment is pending before the General Court and a validity question is raised in a parallel action in national proceedings, the division of competences between the EU Courts and the national courts may require the national courts to stay proceedings. ( 105 ) This appears to have been the decision of the competent Irish courts in the present case. ( 106 )

186.

If the national court initiated the preliminary procedure before the Court of Justice despite the pending action for annulment before the General Court, the Court of Justice may stay its own proceedings in order to give preference to that action for annulment by application of Article 54 of the Statute of the Court of Justice of the European Union and by virtue of the principle of good administration. ( 107 )

187.

The logic of the system of judicial protection established by the Treaties does not require that the action for annulment introduced by the appellant before the General Court is found to be inadmissible.

188.

I therefore suggest that the Court of Justice also accept the fifth argument of the first ground of appeal.

189.

In the light of all of the foregoing arguments, I propose that the Court uphold the appellant’s first ground of appeal.

190.

Under Article 61 of the Statute of the Court of Justice of the European Union, the Court may, where the state of proceedings so permits, give itself final judgment in the matter.

191.

In the present case, that condition is satisfied in so far as it concerns the admissibility of the direct action brought before the General Court.

192.

First, the contested decision constitutes a challengeable act, for the purpose of the first paragraph of Article 263 TFEU. Second, the appellant is directly concerned by that decision, within the meaning of the fourth paragraph of Article 263 TFEU. Third, the contested decision is of individual concern to the appellant, as the General Court itself found in the order under appeal. ( 108 ) It follows that the conditions laid down in the first and fourth paragraphs of Article 263 TFEU are fulfilled. The action is therefore admissible.

193.

However, given that the General Court did not consider the merits of the action before it, the determination of which requires a detailed assessment in law and in fact, the state of proceedings does not permit the Court of Justice to rule on the merits of the appellant’s action.

194.

Accordingly, the case must be referred back to the General Court and the costs reserved.

195.

I propose that the Court of Justice should: