Table of contents
1 Summary of the dispute .............................................................................................. 3
2 The Right to good administration ............................................................................... 5
3 Conditions for adopting a binding decision............................................................... 6
3.1 Objection(s) expressed by CSA(s) in relation to the Draft Decision........................ 6
3.2 The LSA does not follow the objection(s) to the Draft Decision or is of the opinion
they are not relevant or reasoned ................................................................................ 6
3.3 Admissibility of the case and competence of the EDPB ......................................... 7
3.4 Structure of the binding decision ............................................................................ 9
4 On the envisaged dismissal of the complaint in the Draft Decision ...................... 10
4.1 Analysis by the LSA in the Draft Decision ............................................................ 10
4.2 Summary of the objection raised by the CSA ....................................................... 12
4.3 Position of the LSA on the objections................................................................... 13
4.4A nalysis of the EDPB........................................................................................... 14
4.4.1 Assessment of whether the objection was relevant and reasoned ................ 14
4.4.2 Assessment on the merits............................................................................. 18
5 Binding Decision........................................................................................................ 24
6 Final remarks ............................................................................................................. 24
1 | Adopted
The European Data Protection Board
Having regard to Article 63 and Article 65(1)(a) of the Regulation (EU) 2016/679 of the
European Parliament and of the Council of 27 April 2016 on the protection of natural persons
with regard to the processing of personal data and on the free movement of such data, and
repealing Directive 95/46/EC (hereinafter GDPR )1,
Having regard to the European Economic Area (hereinafter EEA ) Agreement and in particular
to Annex XI and Protocol 37 thereof, as amended by the Decision of the EEA joint Committee
No 154/2018 of 6 July 20182,
Having regard to Article 11 and Article 22 of its Rules of Procedure (hereinafter EDPB RoP )3,
Whereas:
(1) It follows from Article 60 GDPR that the lead supervisory authority (hereinafter LSA ) shall
cooperate with the other supervisory authorities concerned (hereinafter CSAs ) in an
endeavour to reach consensus, that the LSA and CSAs shall exchange all relevant information
with each other, and that the LSA shall, without delay, communicate the relevant information
on the matter to the other CSAs. The LSA shall without delay submit a draft decision to the
other CSAs for their opinion and take due account of their views.
(2) Where any of the CSAs expressed a reasoned and relevant objection on the draft decision
in accordance with Article 4(24) and Article 60(4) GDPR and the LSA does not intend to follow
the objection or considers that the objection is not relevant and reasoned, the LSA shall submit
this matter to the consistency mechanism referred to in Article 63 GDPR.
(3) The main role of the European Data Protection Board (hereinafter t EDPB
Board ) is to ensure the consistent application of the GDPR throughout the EEA. To this
effect, pursuant to Article 65(1)(a) GDPR, the EDPB shall issue a binding decision concerning
all the matters which are the subject of the relevant and reasoned objections, in particular
whether there is an infringement of the GDPR.
(4) The binding decision of the EDPB shall be adopted by a two-thirds majority of the members
of the EDPB, pursuant to Article 65(2) GDPR in conjunction with Article 11(4) EDPB RoP,
within one month after the Chair of the EDPB and the competent supervisory authority
SA ) have decided that the file is complete. The deadline may be extended by a
further month, taking into account the complexity of the subject-matter, upon decision of the
Chair of the EDPB on own initiative or at the request of at least one third of the members of
the EDPB.
(5) In accordance with Article 65(3) GDPR, if, in spite of such an extension, the EDPB has not
been able to adopt a decision within the timeframe, it shall do so within two weeks following
the expiration of the extension by a simple majority of its members.
(6) In accordance with Article 11(6) EDPB RoP, only the English text of the decision is
authentic as it is the language of the EDPB adoption procedure.
1 OJ L 119, 4.5.2016, p. 1.
2
3 EDPB Rules of Procedure, as last modified and adopted on 6 April 2022.
2 | Adopted
Has adopted the following Binding Decision:
1 Summary of the dispute
1 This document contains a binding decision adopted by the EDPB in accordance with
Article 65(1)(a) GDPR. The decision concerns the dispute arisen following a draft decision
(hereinafter, Draft Decision té de
r , BE SA
LSA the
Austrian supervisory authority , hereinafter, AT
SA
2 Complaint
August 2021 to the AT SA on a case concerning activities carried out by the Vlaamse Radio-
en Televisieomroeporganisatie, a public broadcasting company established in Brussels,
Controller VRT
complaint to the BE SA as LSA4.
3 Data Subject who requested
the non-profit noyb NOYB 5 to represent
them under Article 80 (1) GDPR Complainant
4 In particular, the Complaint concerned the
Article 5(1)(a), Article 6(1)(a), Article 12(1), Article 12(2) andArticle 13(1)(c) GDPR and
Article 5(3) ePrivacy Directive and was one of the multiple complaints lodged by NOYB with
different supervisory authorities (he SAs
set up a Taskforce6 to coordinate the response to these complaints by exchanging views
among relevant SAs and streamlining communication. The work of the Taskforce led to the
publication of a report in 20237.
5 The Draft Decision envisages the dismissal of the Complaint on the ground that the general
principle of EU law prohibiting abuse of law was violated due to an alleged abuse of the right
to lodge a complaint under Article 77 GDPR in conjunction with Article 80(1) GDPR8. The Draft
Decision is largely based on earlier case law of the Belgian Market Court, which had previously
quashed another BE SA decision (Decision 113/2024) for not concluding on the existence of
an abuse in a very similar case brought by NOYB9.
6 The following table presents a summary timeline of the events part of the procedure leading
to the submission of the matter to the consistency mechanism:
4 Draft Decision, paragraph 3.
5 NOYB is an association established under Austrian law: Austrian Central Register of Associations (ZVR) nr. 1354838270.
6 EDPB News, EDPB establishes Cookie Banner Taskforce, 27 September 2021, available at:
https://www.edpb.europa.eu/news/news/2021/edpb-establishes-cookie-banner-taskforce_en.
7 EDPB, Report of the work undertaken by the Cookie Banner Taskforce, 18 January 2023, available at:
https://www.edpb.europa.eu/our-work-tools/our-documents/other/report-work-undertaken-cookie-banner-taskforce_en.
8 Draft Decision, paragraphs 21-43 and 46 and p. 17.
9 Draft Decision, paragraphs 12-20, referring to the Judgment of the Brussels Court of Appeal (section Market Court) of 19 March
2025 (Mediahuis), nr. 2024/AR/1690.
3 | Adopted
20 February 2026, the BE SA provided such clarifications and uploaded on IMI additional
documents.
9 In the context of the assessment of the completeness of the file, the EDPB Secretariat
translated certain documents into English in line with the EDPB RoP14.
10 A matter of particular importance that was scrutinised by the EDPB Secretariat was the right
to be heard, as required by Article 41(2)(a) of the Charter of Fundamental Rights of the
Charter CFR . Further details on this are provided in
Section 2 of this Binding Decision.
11 On 31 March 2026, the decision on the completeness of the file was then taken by the Chair
of the EDPB and by the BE SA, in line with Article 11 (2) EDPB RoP. The file was circulated
by the EDPB Secretariat to all the members of the EDPB on 31 March 2026.
12 The Chair of the EDPB decided, in compliance with Article 65(3) GDPR in conjunction with
Article 11(4) EDPB RoP, to extend the default timeline for adoption of one month by a further
month on account of the complexity of the subject-matter.
2 The Right to good administration
13 The EDPB is subject to the Charter, in particular Article 41 (right to good administration). This
is also reflected in Article 11(1) EDPB RoP. Further details were provided in the EDPB
Guidelines on Article 65(1)(a) GDPR15.
14 The EDPB assessed whether all documents received containing the matters of facts and law
used by the EDPB to take its decision in this procedure had previously been shared with the
Controller and the Complainant, and whether they were given the opportunity to exercise their
right to be heard in relation to the procedure led by the BE SA and the subject matter of the
dispute to be resolved by the EDPB. In respect of the Complainant, the EDPB underlines in
particular that the Complainant may potentially be adversely affected by the outcome of this
specific procedure as the dispute pertains to the dismissal of the Complaint.
15 The EDPB takes the view that both the Controller and the Complainant had received the
opportunity to exercise their right to be heard with regard to the documents containing the
matters of fact and law considered and addressed by the EDPB to solve the dispute in the
context of this Binding Decision. Their written observations were shared with the EDPB by the
BE SA16.
14 Art. 11(2) EDPB RoP
Article 65 submissions of 12 January 2026, there were some decisions adopted by SAs that were not available in English. These
decisions were provided in Italian, Spanish, German and French. The translation of the documents was proofread and validated
by the SAs who issued such decisions or who had the language of the decision as official language (IT SA, ES SA, AT SA, and
BE SA). Following the validation of the translations, the translated documents were added to the file by the EDPB Secretariat on
23 March 2026.
15 EDPB Guidelines 3/2021 on the application of Article 65(1)(a) GDPR, adopted on 24 May 2023 (version after public
consultation) EDPB Guidelines on Article 65(1)(a) GDPR V2.0 paragraphs 93-107 and EDPB Guidelines 3/2021
on the application of Article 65(1)(a) GDPR, adopted on 13 April 2021 EDPB
Guidelines on Article 65(1)(a) GDPR V1.0 , paragraphs 94-108 (both hereinafter referred to as EDPB Article 65 (1)(a)
Guidelines
16 As mentioned above in paragraph 6 of this Binding Decision, on 21 October 2025, the BE SA invited the Controller and the
Complainant to submit their positions prior to a potential Article 65 GDPR procedure and therefore in the context of that procedure.
The Controller provided written submissions on 1 December 2025 and 19 January 2026. The Complainant provided written
submissions on 12 January 2026.
5 | Adopted
16 However, for reasons of transparency, VRT and NOYB were provided with specific documents
which they ha March 202617.
These specific documents did not bring any new factual or legal elements to be relied on by
the EDPB in the context of this Binding Decision. VRT and NOYB were thereby offered the
opportunity to share further observations they might have. These written observations were
provided by VRT and NOYB on 26 March 2026 and were subsequently added to the file
March 2026 NO
Submissions to the EDPB of 26 March 2026
17 Therefore, the EDPB notes that both VRT and NOYB received the opportunity to make their
views known regarding all the legal and factual elements used by the EDPB to take this
decision.
3 Conditions for adopting a binding decision
18 The general conditions for the adoption of a binding decision by the EDPB are set forth in
Article 60(4) and Article 65(1)(a) GDPR18.
3.1 Objection(s) expressed by CSA(s) in relation to the Draft
Decision
19 The EDPB notes that the AT SA raised an objection to the Draft Decision via IMI pursuant to
Article 60(4) GDPR19.
3.2 The LSA does not follow the objection(s) to the Draft
Decision or is of the opinion they are not relevant or
reasoned
20 On 17 October 2025, the BE SA provided CSAs with its analysis of the objection raised by the
AT SA. The BE SA clarified that it deems the objection raised by the AT SA prima facie to be
relevant and reasoned, and believes the referral is admissible under the dispute resolution
procedure mechanism, as the matter concerns the interpretation of a general principle of EU
77 GDPR in
conjunction with Article 80(1) GDPR20. However, the BE SA concluded that it would not follow
the AT SA Objection because of the divergent national case law in Belgium and Austria with
regard to this matter21.
3.3 Admissibility of the case and competence of the EDPB
17 In particular, the Referral by the BE SA to the EDPB and the Preliminary Draft Decision were shared with the Complainant
and VRT - see Letters of the EDPB Chair to VRT and to NOYB of 12 March 2026.
18 According to Art. 65(1)(a) GDPR, the Board will issue a binding decision when a supervisory authority has raised a relevant
and reasoned objection to a draft decision of the LSA and the LSA has not followed the objection or the LSA has rejected such
an objection as being not relevant or reasoned.
19 AT SA Objection, dated 22 September 2025.
20The analysis of the BE SA was initially provided via IMI (the IT platform to support cooperation and consistency procedures
under the GDPR), but its content is the same as the one provided to the EDPB in the context of the Article 65 GDPR procedure
in the Referral by the BE SA to the EDPB, p.8.
21 Referral by the BE SA to the EDPB, p.8.
6 | Adopted
21 The case at issue fulfils, prima facie, all the elements listed by Article 65(1)(a) GDPR, since
the AT SA raised an objection to the Draft Decision of the BE SA within the deadline provided
by Article 60(4) GDPR, and the BE SA has not followed the objection.
22 Considering the above, in particular that the conditions of Article 65(1)(a) GDPR are met, the
EDPB is competent to adopt a binding decision, which shall concern all the matters which are
the subject of the relevant and reasoned objection, in particular whether there is an
infringement of the GDPR or whether the envisaged action in relation to the controller or
processor complies with the GDPR22.
23 The EDPB recalls that its current decision is without any prejudice to any assessments the
EDPB may be called upon to make in other cases, including with the same parties, taking into
account the contents of the relevant Draft Decision and the objection raised by the CSA.
23
24 VRT argues that the concerned matter falls , for two main
reasons.
25 First, VRT puts forward that the EDPB has no authority regarding a dispute on a draft decision
that does not concern a GDPR infringement. 24 According to VRT, the fact that this dispute
does not in itself concern whether the controller has infringed the GDPR brings the dispute
25
. VRT also argues that all previous EDPB decisions have always
concerned infringements of the GDPR by a controller26.
26 With respect to this first argument, the EDPB recalls that, pursuant to Article 65(1) GDPR and
Article 70(1)(a) GDPR, the dispute resolution mechanism is indeed meant to ensure the
correct and consistent application of the GDPR in cases involving cross-border processing of
personal data.
27 However, for a matter to concern the application of the GDPR, it does not necessarily have to
concern whether the controller committed an infringement of the GDPR. The wording of the
relevant provisions clearly shows that the EDPB is competent to resolve disputes among SAs
under Article 65(1)(a) GDPR also on other questions, i.e., whether envisaged action in relation
to the controller or processor complies with [the GDPR] 27. Moreover, according to Article
shall concern all the matters which are the
subject of the relevant and reasoned objection, in particular whether there is an infringement
of Recital 136 GDPR also explains that the Board is
supervisory authorities, in particular in the cooperation mechanism between the lead
22 Art. 65(1)(a) GDPR and Art. 4(24) GDPR.
23 65 submissions of 1 December 2025 paragraphs 8- 65 submissions of 19 January 2026
paragraphs 8-14 and paragraph 37.
24 65 submissions of 1 December 2025 paragraphs 8- 65 submissions of 19 January 2026
paragraphs 8- Submissions to the EDPB of 26 March 2026,
authority to adopt a binding decision in accordance with Article 65(1)(a) - -
- an
aspect emphasised by Article 65(1)(a) [GDPR], Article 70(1)(a) GDPR, as well as by recital 136 GDPR,
Article 65 submissions of 1 December 65 submissions of 19 January 2026, p.
6, paragraph 8.
25 80(1) [GDPR] juncto Article 77 GDPR
AT SA Objection does not concern the fact that one of the conditions of Article 77 GDPR or Article 80(1) GDPR would have been
77 [GDPR] and/or Article 80(1) GDPR would not be respected, this cannot be attributed
e 65 submissions of 1 December 2025
65 submissions of 19 January 2026, paragraph 12, p. 7.
26 65 submissions of 1 December 2025,paragraph 9, p.7. 65 submissions of 19 January 2026,
paragraph 9, p.7.
27 Article 4(24) GDPR.
7 | Adopted
supervisory authority and supervisory authorities concerned on the merits of the case, in
particular
28 In light of these provisions, the EDPB is competent to address the merits of all the objections
that are found to be relevant and reasoned, and is competent to resolve disputes also
concerning the envisaged action in relation to the controller or processor, including the
envisaged corrective measures or the envisaged decision to dismiss or reject a complaint28.
29
29
30
. If such objection
is deemed to be relevant and reasoned within the meaning of Article 4(24) GDPR, which is
analysed below,
solving the dispute between the supervisory authorities.
30 consistency
of the application of the GDPR as a whole, and not just of its provisions imposing obligations
on controllers and processors31.
31
complainant (or its representative) is abusing its rights under Article 77 [GDPR] [in
combination with] Article 80(1) GDPR because abuse of rights is not a GDPR-
32
- .
32 The BE SA indicates t
33
Article 77 [GDPR] [in combination with] Article 80(1) . However, the BE SA does not
question the competence of the EDPB to address the matter.
33 The competence of the EDPB to address any dispute raised by a relevant and reasoned
objection to a draft decision that concerns the compliance of the envisaged action with the
GDPR necessarily also includes disputes on whether the relevant provisions of the GDPR
were correctly applied. The dispute in this case pertains precisely to whether
28 Article 4(24)
an infringement of [the GDPR], or whether envisaged action in relation to the controller or processor complies with [the GDPR]
(emphasis added). See as well EDPB Guidelines on Article 65(1)(a) GDPR V2.0, paragraph 92 and EDPB Guidelines on
Article 65(1)(a) GDPR V1.0, paragraph 92 and EDPB Guidelines 9/2020 on the concept of relevant and reasoned objection,
version 2.0 (after public consultation) adopted on 9 March EDPB Guidelines on RRO graph 32. In
past EDPB Article 65(1)(a) binding decisions, the EDPB addressed the merits of objections not only on whether the controller or
processor had breached the GDPR but also of objections concerning the envisaged scope of the investigation or the corrective
measures - see EDPB Binding Decision 1/2020, adopted on 9 November 2020, section 8.4.2; EDPB Binding Decision 1/2021,
adopted on 28 July 2021, sections 8.4.2 and 9; EDPB Binding decision 1/2022, adopted on 15 June 2022, section 5.4.2; EDPB
Binding decision 2/2022, adopted on 28 July 2022, section 7.4.2; EDPB Binding Decision 3/2022, adopted on 5 December 2022
sections 5.4.2, 8.4.2 and 9; EDPB Binding Decision 4/2022, adopted on 5 December 2022, sections 5.4.2, 8.4.2 and 9; EDPB
Binding Decision 5/2022, adopted on 5 December 2022, sections 6.1.4, 8.4.2 and 9; EDPB Binding decision 1/2023, adopted on
13 April 2023, sections 4.4.2 and 5.4.2; EDPB Binding Decision 2/2023, adopted on 2 August 2023 (hereinafter section 6.4.2. In
respect of Binding Decision 3/2022, Binding Decision 4/2022 and Binding Decision 5/2022 and of the validity of the instruction of
the EDPB to the LSA to carry out further investigation, see the Judgment of the General Court of 29 January 2025 in Joined
Cases Data Protection Commission v European Data Protection Board, T-70/23, T-84/23 and T-111/23, OJ C 127.
29 AT SA Objection, p.1.
30 AT SA Objection, Section I, p.2.
31 65 submissions of 12 January 2026, paragraph argument according to which the
uation
where the EDPB would not be competent to assess the admissibility of complaints but only questions of material law. This would
result in reducing the competence of the EDPB to [for example] Articles 1 to 50 [GDPR], but not to Articles 51 to 77 or 80 GDPR
32 65 submissions of 1 December 65 submissions of 19 January 2026,
paragraph 13, p.7.
33 Referral by the BE SA to the EDPB, p.8.
8 | Adopted
Article 57(4) GDPR, Article 77 GDPR and Article 80 GDPR were correctly applied. Where
necessary, this evaluation has to also take into account the general principles of EU law such
as the one prohibiting abuse of rights.
34 According to the C CJEU ,
Article 57(4) GDPR reflects and is an expression of the general principle of EU law that EU
law cannot be relied on for abusive or fraudulent ends34. This link between Article 57(4) GDPR
and the general principle of EU law prohibiting abuse of rights was also underlined by the
AT SA Objection35. Therefore, the subject matter of the AT SA Objection relates also to the
application of Article 57(4) GDPR and of the general principle of EU law prohibiting abuse of
rights in the context of submitting complaints under the GDPR, for which the EDPB is
competent to adopt a binding decision.
35 In addition, the EDPB recalls that the General Court underlined that a relevant and reasoned
of
SAs to monitor and enforce the application of the GDPR and handle complaints to the extent
appropriate under Article 57(1)(a) GDPR and Article 57(1)(f) GDPR36. The dispute in the case
at hand, too, pertains to the discharge of these two tasks by SAs.
36 In light of the above, the EDPB takes the view that the subject matter of the present dispute
resolution procedure falls within the competence of the EDPB as described by
Article 65(1)(a) GDPR and Article 70(1)(a) GDPR. Should the EDPB consider the objection of
the AT
merits.
3.4 Structure of the binding decision
37 For the objection raised by the AT SA, the EDPB decides on its admissibility, by assessing
first whether it
of Article 4(24) GDPR as clarified in the guidelines on the concept of a relevant and reasoned
objection37.
38 Where the EDPB finds that an objection does not meet the requirements of
Article 4(24) GDPR, the EDPB does not take any position on the merit of any substantial
issues raised by that objection in this specific case. The EDPB will analyse the merits of the
substantial issues raised by the AT SA Objection if it considers the objection to be relevant
and reasoned38.
4 On the envisaged dismissal of the Complaint in the
Draft Decision
34 Judgment of the Court of Justice of 9 January 2025 in case Österreichische Datenschutzbehörde v F R, C 416/23,
ECLI:EU:C:2025:3, paragraph 49 and Judgment of the Court of Justice of 19 March 2026 in case Brillen Rottler GmbH & Co. KG
v TC, C 526/24, ECLI:EU:C:2026:216, paragraph 30.
35 AT SA Objection, p. 4 referring to Judgment of the Court of Justice of 9 January 2025 in case Österreichische
Datenschutzbehörde v F R, C 416/23, ECLI:EU:C:2025:3, paragraphs 49 et seq.
36 Judgment of the General Court of 29 January 2025, inJoined cases Data Protection Commission v European Data Protection
Board, T-70/23, T-84/23 and T-111/23, OJ C 127, paragraph 50.
37 EDPB Guidelines on RRO.
38 The EDPB will assess, in relation to each objection raised, whether the objection meets the requirements of Art. 4(24) GDPR
and, if so, address the merits of the objection in the binding decision. icle 65(1)(a) GDPR V2.0,
paragraph 63 and EDPB Guidelines on Article 65(1)(a) GDPR V1.0, paragraph 63.
9 | Adopted
4.1 Analysis by the LSA in the Draft Decision
39 In its Draft Decision, the BE SA starts by recalling previous investigations carried out by the
BE SA Inspection Service and public declarations made by NOYB on their website39. The
BE SA also refers to a previous ruling of the Belgian Market Court in the Mediahuis case40, on
which the Draft Decision is largely based41. More specifically, according to the Draft Decision,
the Complaint should be dismissed due to an apparent abuse of the right to lodge a complaint
under Article 77 GDPR in conjunction with Article 80(1) GDPR42.
40 The BE SA considers that the essential aspects of the Complaint have been identified by
NOYB and not by the Data Subject, as in the BE the latter has been instructed on
how to lodge the Complaint43. In the BE Complaint pursues the policy
objectives linked to interests other than those of an individual data subject (for instance,
strategic objectives of the board or the wishes of donors) and which may de facto take
precedence over the mandating in this context44.
41 The BE SA refers to the CJEU case law on abuse of law and takes the view that there is an
abuse of law in the case at hand, given that both the objective and the subjective
components of the abuse, as required by the CJEU case law, are present45.
42 The BE SA considers that there are numerous elements proving the objective component
of the abuse46, i.e. a set of objective circumstances whereby, despite formal compliance with
the conditions imposed by the [European] Union rules, the aim pursued by those rules has not
been achieved 47, namely:
A standardised submission-in-bulk approach has been followed and an automated
process for generating complaints has been used; various complaints have been drawn
up and signed in the same way48;
the Data Subject does not belong to the average target audience of a Belgian website
in Dutch and the initiative for lodging the complaints undeniably lies with NOYB49;
there was a working relationship between the Data Subject and NOYB at the time when
the Complaint was submitted50 and the Data Subject mandated NOYB after the details
of the project had, been outlined and the controllers identified by NOYB51;
this association-led project deviates from the letter and spirit of what a mandating
relationship should entail under Article 80(1) GDPR, read in the light of
recital 142 GDPR52, considering that the assignment should be one-way: from the data
subject to the representative, and not the other way around 53 ; the complaints are
39 Draft Decision, Section II.1, p.4-6.
40 Judgment of the Brussels Court of Appeal (section Market Court) of 19 March 2025 (Mediahuis), nr. 2024/AR/1690.
41 Draft Decision, Section II.2, p. 6-7.
42 Draf .
43 Draft Decision, Section III, paragraph 21 - according to the BE SA, these essential aspects include the claimed grievances but
also the identity of the targeted controllers; the BE SA notes that NOYB has explicitly mentioned a target list .
44 Draft Decision, Section III, paragraph 23.
45 Draft Decision, Section III.1, paragraphs 24-43.
46 Draft Decision, Section III.1.2, paragraphs 29-38.
47 Draft Decision, Section III.1.1, paragraph 26.
48 Draft Decision, Section III.1.2, paragraph 29(a).
49 Draft Decision, Section III.1.2, paragraph 29(b) & paragraph 29(c).
50 Draft Decision, Section III.1.2, paragraph 29(d).
51 Draft Decision, Section III.1.2, paragraph 29 (e).
52 Draft Decision, Section III.1.2, paragraphs 29(d) and 30.
53 Draft Decision, Section III.1.2, paragraph 30.
10 | Adopted
fabricated within a fictive structure not envisaged by the legislator under
Article 80(1) GDPR54;
the intended purpose of the right to lodge a complaint by giving a mandate to an
organisation, foreseen by Article 77 GDPR and Article 80(1) GDPR, is not respected in
this case and there is a clear and deliberate circumvention by NOYB of the objectives
of these legal provisions55.
in identifying the purpose of the legislator with Article 80(1) GDPR, the existence of
Article 80(2) GDPR is important the European legislator did not intend that
associations could 'seek' a mandate under Article 80(1) GDPR based on their own
priorities and strategies, because such 'association-
intention of Article 80(2) GDPR56. Article 80(2) GDPR enables national legislators to to
provide the organisations concerned the possibility to lodge complaints in an
overarching manner, when they consider that a data subject's rights under the GDPR
have been infringed as a result of the processing57. Neither the Austrian, nor the Belgian
legislator availed themselves of this possibility58.
43 The BE SA considers that the subjective component of the abuse is present too, namely
the intention to obtain an advantage conferred by the Union rules by artificially creating the
conditions under which the right to that advantage arises59. According to the BE SA, the abuse
of law is based on circumvention60 because:
NOYB seeks to have the power to bring proceedings before the BE SA for its cookie
banner complaints project61; a power to bring proceedings cannot exist without the
data subject as an individual in Belgian or Austrian law (where Article 80(2) GDPR has
not been implemented)62;
NOYB asks trainees or staff if they want to become data subjects in model cases to
artificially fall under Article 80(1) GDPR - the incitement to create a legal pathway to
the BE SA constitutes the subjective element of the abuse law on the part of NOYB63.
the benefit is aimed at pursuing the general (policy) objectives of NOYB, which follows
clearly from the declarations on the NOYB website, declaring NOYB aims to end
cookie banner terror by filing the complaints64.
44 In light of the above, and referring to CJEU case law65, the BE SA takes the view that it must
refuse NOY icle 77 GDPR in conjunction with
Article 80(1) GDPR66.
4.2 Summary of the objection raised by the CSA
54 Draft Decision, Section III.1.2, paragraph 31.
55 Draft Decision, Section III.1.2, paragraph 38.
56 Draft Decision, Section III.1.2, paragraph 32.
57 Draft Decision, Section III.1.2, paragraph 34.
58 Draft Decision, Section III.1.2, paragraph 35.
59 Draft Decision, Section III.1.2, paragraph 26.
60 Draft Decision, Section III.1.1, paragraph 27.
61 Draft Decision, Section III.1.3, paragraph 39.
62 Draft Decision, Section III.1.3, paragraph 39.
63 Draft Decision, Section III.1.3, paragraph 40.
64 Draft Decision, Section III.1.3, paragraph 40.
65 BE SA refers to the Judgment of the Court of Justice of 21 December 2023 in joint cases VK and Others v BMW Bank GmbH
and Others, C-38/21, C-47/21 and C-232/21, ECLI:EU:C:2023:1014, paragraph 283.
66 Draft Decision, Section III.1.4, paragraph 41.
11 | Adopted
45 The AT SA raises an objection pursuant to Article 4(24) GDPR and Article 60(4) GDPR
against the dismissal of the Complaint on the grounds that the case involves an apparent
abuse of law. The AT SA requests that the BE SA issues a decision on the merits and deals
with the Complaint in accordance with Article 57(1)(f) GDPR67.
46 The AT SA emphasises that the Complaint forms part of the so-called
complaints which NOYB lodged with various SAs and that no other supervisory authority has
68
. The AT SA considers,
thus, that the BE SA should analyse the Complaint on its merit and not dismiss the Complaint
on the grounds of apparent abuse of law69.
47 To support its view, the AT SA refers to European and national case law dealing with the
question of whether there has been an abuse of the right to lodge a complaint under
Article 77 GDPR 70 . Firstly, the AT SA relies on a previous ruling by the Austrian Federal
Administrative Court: this Court held, in a similar case, that there were no doubts as to the
existence of a valid power of attorney [referring to NOYB , flagged that the non-
implementation of Article 80(2) GDPR into Austrian law could not mean that employees or
members of an association such as NOYB were barred from lodging individual data protection
complaints in the event of alleged infringements arising from their personal activities, and
highlighted that the GDPR does not take into account the motive of the data subject in
connection with an activity that is ultimately relevant under data protection law71.
48 The AT SA also refers to CJEU case law there is, in EU law, a general legal
principle that EU law may not be relied upon for abusive or fraudulent ends and that a finding
of abusive intent may be made if a person has lodged complaints in circumstances where it
was not objectively necessary to do so in order to protect his or her rights under that
72
.
49 The AT SA also recalls another national ruling where the Austrian Supreme Administrative
Court has held that abusive intent exists
submission of a large number of data protection complaints do not lie in the pursuit of the
rights conferred upon him or her by the GDPR, and if the complainant would not have lodged
this large number of complaints without those extraneous motives 73. In this regard, the AT SA
also recalls an instance where the AT SA itself affirmed the existence of abusive intent74.
50 The AT SA considers that in] the present case no purposes unrelated to data protection
are pursued by exercising the right to lodge a complaint under Article 77 GDPR on
the contrary, organisations such as NOYB are intended to be established precisely for the
67 AT SA Objection, p. 6 (also referring to Recital 141 GDPR and the Judgment of the Court of Justice of 9 January 2025 in
case Österreichische Datenschutzbehörde v F R , C-416/23, ECLI:EU:C:2025:3, paragraph 25).
68 AT SA objection, Section III, p.2.
69 AT SA Objection, p. 6.
70 AT SA Objection, p. 4-5.
71 AT SA Objection, Section III, p.4 referring to the Austrian Federal Administrative Court (BVwG), 18 August 2020, W137
2264614-1. In this regard, the EDPB notes VRT's observation that the reference for this latter decision appears to be incorrect
as it refers to a case from 30 June 2023, and thus not 2025 or 2020 (VRT Article 65 submissions of 1 December 2025,
paragraphs 29 and 30). For the avoidance of doubt, the EDPB relies, in its reasoning in Section 4.4.2 of this Binding Decision
below, on the case law of the Court of Justice of the European Union and not on national case law.
72 AT SA Objection Section III, p.4 referring to the Judgment of the Court of Justice in case Österreichische Datenschutzbehörde
v F R , C-416/23, ECLI:EU:C:2025:3, paragraphs 49 et seq.
73 AT SA Objection, Section III, p.5 referring to Supreme Administrative Court (VwGH), 29 January 2025, Ra
2023/04/0002-1.
74 AT SA Objection, Section III, p. 5, referring to AT SA, 21 February 2023, 2023-0.137.735.
12 | Adopted
purpose of acting in the field with regard
75
.
51 According to the AT SA, with respect to Member States where Article 80(2) GDPR has not
been transposed into national law, has hardly any other possibility than to
systematically investigate certain infringements in advance and subsequently lodge
complaints 76. The AT his also stems from the fact that during a complaint
procedure, certain evidence must be provided by the complainant n the context of a
website visit, such evidence can only be submitted if screenshots and logfiles are created at
the very time of visiting the website 77.
52 In the AT 80(2) GDPR does not lead to the conclusion that
representation under Article 80(1) GDPR cannot systematically take place and be organized
according to specific thematic areas such as the Cookie Banner Complaints 78.
53 The AT SA further underlines its view that, regardless of NOYB Data
Subject is adversely affected as the cookie banner on the C in
compliance with the GDPR 79. According to the AT SA, the Data S may be
a reason why no right to compensation under Article 82 GDPR arises, due to the deliberate
access to the website, but the objective infringement of the GDPR remains because the
conditions for a valid consent under data protection law and, consequently, the lawfulness of
the processing, were not met 80.
54 Moreover, the AT SA states that the consistent application of the GDPR is jeopardised if
certain SAs such as, at least in this case, the BE SA dismiss a complaint on the grounds of
apparent abuse of law, while others examine similar or even identical complaints on their
merits81.
4.3 Position of the LSA on the objection
55 The BE SA considers that the AT SA Objection against the dismissal of the Complaint on the
grounds that the case involves an apparent abuse of law constitutes a relevant and reasoned
objection in accordance with Article 4(24) GDPR82. The BE SA however states that it does not
intend to follow the AT SA Objection because of the divergent national case law in Belgium
and Austria with regard to this matter83.
4.4 Analysis of the EDPB
4.4.1 Assessment of whether the objection was relevant and
reasoned
56 The objection raised by the AT SA concerns, in a nutshell, whether the Draft Decision
appropriately envisages the dismissal of the Complaint.
75 AT SA Objection, Section III, p. 5.
76 AT SA Objection, Section III, p. 5.
77 AT SA Objection Section III, p.5.
78 AT SA Objection Section III, p.5.
79 AT SA Objection Section III, p.5.
80 AT SA Objection Section III, p.5-6.
81 AT SA Objection Section III, p.3.
82 Referral by the BE SA to the EDPB, p.8.
83 Referral by the BE SA to the EDPB, p.8.
13 | Adopted
57 SA Objection does not meet the threshold set
by Article 4(24) GDPR84 85
.
58 T SA Objection is not relevant because it only holds abstract and
analysis86
, but the AT
Decision would not be correct or why the LSA should have made another assessment of the
factual circumstances stated in the Draft Decision87. Further, i , there is no clear
demonstration of what the alleged legal or factual errors in the Draft Decision are 88. With
respect to the subject matter of the AT SA Objection, VRT argues that none of the examples
mentioned in the EDPB Guidelines on Article 65(1)(a) GDPR are at issue in the present case89.
59 Moreover, VRT argues that the AT SA Objection is not reasoned including because the AT SA
attempts to substantiate its objection with elements that are not coherent or relevant90.
60 VRT also argues that the AT SA Objection does not clearly demonstrate the significance of
the risks posed by the Draft Decision, as the AT SA Objection does not contain a clear
statement regarding the risks and their significance 91. Further, VRT claims that the fact that
the Data Subject would be adversely affected due to allegedly unlawful cookie banners on
92
, and that the fact that the LSA has
not addressed the Complaint on its merits does not in any way lead to a significant risk for
93
.
84 65 submissions of 1 December 2025, paragraphs 15- 65 submissions of 19 January 2026,
paragraphs 15- Submissions to the EDPB of 26 March 2026, Section 2, p.4.
85 65 submissions of 12 January 2026, paragraph 14, p.4
86 65 submissions of 1 December 65 submissions of 19 January 2026,
paragraph 18, p. 9.
87 submissions of 1 December 2025 paragraph 18, p. 9 65 submissions of 19 January 2026,
paragraph 18, p. 9.
88 65 submissions of 1 December 65 submissions of 19 January 2026,
paragraph 18, p. 9.
89 65 submissions of 1 December 65 submissions of 19 January 2026,
paragraph 21, p. 9. VRT considers in this regard that the AT SA Objection does not concern the existence of a given infringement
of the GDPR nor the existence of additional or alternative infringements of the GDPR, as no infringement by VRT has been
established. Additionally, VRT notes that the AT SA Objection does not concern gaps in the Draft Decision justifying the need for
further investigation and does not indicate that the Draft Decision would hold insufficient factual information or reasoning. Lastly,
VRT contends that the AT SA Objection does not dispute the Draft Decision because the LSA would have insufficiently
investigated the facts, neither the AT SA Objection is related to the specific action envisaged by the Draft Decision as no sanction
(within the meaning of Article 58(2) GDPR) was imposed on VRT.
90 According to VRT, the fact that abuse of rights was not addressed in the report from the EDPB Cookie Banner Taskforce in
no way excludes that complaints filed by NOYB on behalf of a complainant may constitute abuse of rights; also, it is incorrect to
represented by an organisation in violation of the prohibition of abuse of right; moreover, VRT considers that the Austrian
decisions mentioned in the AT SA Objection cannot support the AT
and certain case law is incorrectly referenced. VRT also considers that the concerned matter is not related to Article 80(2) GDPR
and therefore the arguments about this provision are not relevant, 65 submissions of 1 December 2025, p. 10-12,
paragraphs. 26- 65 submissions of 19 January 2026, p. 10-12, paragraphs 26-31.
91 65 submissions of 1 December 65 submissions of 19 January 2026,
paragraph 25, p. 10.
a subjects and/or the free flow of data are not put
in a clear, precise and detailed manner in the objection. The same applies to the link between the envisaged consequences of
the Draft Decision and the significance of the anticipated risks that have not been established or demonstrated.
92 65 submissions of 1 December 65 submissions of 19 January 2026,
Complaint and therefore has not (yet)
investigated whether the concerned cookie banner from VRT would actually infringe the GDPR.
93 65 submissions of 1 December 65 submissions of 19 January 2026
paragraph 33, p. 12.
14 | Adopted
61 AT SA Objection is relevant. NOYB considers that the substance of the
Draft Decision is correctly identified in the AT SA Objection94 and the AT SA Objection clearly
identifies how if followed, it would entail a change leading to a different conclusion and more
precisely that the BE SA shall not dismiss the Complaint based on an apparent abuse of law
and instead issue a decision on the merits. Further, NOYB considers that the AT SA Objection
concerns the specific legal question of abuse of law in the complaint lodged by NOYB on
behalf of the Data Subject 95 . With respect to the subject matter of the objection, NOYB
considers that the AT SA disagreed on the action envisaged towards VRT by the BE SA (i.e.
the dismissal of the complaints) and suggests that instead a decision on the merits should be
taken96.
62 Moreover, NOYB considers the AT SA Objection is reasoned because the AT SA Objection
provides ample legal arguments for an amendment of the Draft Decision97.
63 NOYB also argues that the AT SA Objection sufficiently proves the risks posed by the Draft
Decision because as outlined in the AT SA Objection the Draft Decision leads to a fragmented
interpretation of the admissibility of similar cookie complaints across the Union98. According to
NOYB, this would undermine the aim of a consistent GDPR application across the E[uropean]
U[nion] resulting in data subjects being granted different rights depending on the SA where
they lodge their complaints and thus affecting the free flow of data.
64 In order to analyse whether the AT SA O 4(24) GDPR,
the EDPB notes , that the AT SA Objection has a direct connection
with the Draft Decision and makes many references to its factual and legal content99. The
AT SA Objection, if followed, would entail a change leading to a different conclusion100 since
taking it on board would mean assessing the case on its merits and not dismissing the
Complaint. The AT SA also points out that if the AT SA rejects the Complaint following a final
decision taken by the BE SA, it is very likely that the Austrian Courts will quash this decision101.
65 The EDPB further considers the objection to concern whether the envisaged action in relation
to the controller or processor complies with the GDPR, in line with Article 4(24) GDPR. The
EDPB recalls that the decision to reject or dismiss a complaint, in whole or in part, also
constitutes an envisaged action capable of being subject of a relevant and reasoned
objection 102. Indeed, the AT SA Objection relies upon the content of the Draft Decision to
highlight whether the envisaged action complies with the GDPR and more precisely the
specific legal question of the dismissal of the Complaint
103
. The AT SA requests in its objection that the BE
[C]omplaint and the submissions made to appropriate extent, in accordance with
104
Article 57(1)(f) [GDPR] and Recital 141 .
66 In consequence, the EDPB finds the objection of the AT SA to be relevant.
94 March 2026, paragraph 24, p. 6.
95 NOYB Submissions to the EDPB of 26 March 2026, paragraph 34, p. 7.
96 March 2026, paragraph 26, p. 6.
97 March 2026, paragraph 51, p. 9.
98 March 2026, paragraph 60,p.10.
99 EDPB Guidelines on RRO, paragraphs 12 and 14.
100 EDPB Guidelines on RRO, paragraph 13.
101 AT SA Objection, Section III, p.5.
102 EDPB Guidelines on Article 65(1)(a) GDPR V2.0, paragraph 92 and EDPB Guidelines on Article 65(1)(a) GDPR V1.0,
paragraph 92. This was also argued in to the EDPB of 26 March 2026, paragraph 26, p. 6.
103 AT SA Objection, p. 2.
104 AT SA Objection, p. 6.
15 | Adopted
67 The EDPB assesses in the following paragraphs if the AT SA Objection meets the threshold
of bein 4(24) GDPR. With respect to whether an
decision) as to
why an amendment of the decision is proposed.105,
68 The EDPB considers that the AT SA puts forward several legal and factual arguments in its
objection in order to demonstrate why the Draft Decision of the BE SA should be amended106.
69 First, the AT SA indicates that the Draft Decision wrongfully concludes that the conditions for
an abuse of the right to lodge a complaint are met 107. To strengthen its argumentation, the
AT SA refers to CJEU case-law on abuse of law108 and to Austrian national case law dealing
with whether there was an abuse of the right to lodge a complaint in analogous cases109.
Moreover, the AT SA recalled different cases where the AT SA affirmed the existence of
abusive intent and dismissed the complaint pursuant to Article 57(4) GDPR, underlining that
in the case at hand, instead, no purposes unrelated to data protection are pursued by
exercising the right to lodge a complaint under Article 77 GDPR 110.
70 Secondly, the AT SA recalls that all other relevant SAs have decided on the merits in
comparable cases and none of them has considered any of the complaints discussed in the
context of the EDPB Cookie Banner Taskforce as constituting an abuse of law 111. In this
regard, the AT SA underlines that SAs and the EDPB are required to contribute to the
consistent application of the GDPR, in light of Article 57(1)(a) and Article 70(1) GDPR, and
this consistency would be jeopardised if certain SAs were to dismiss a complaint on the
grounds of apparent abuse of law while others examine similar or identical complaints on their
merits112.
71 Lastly, the AT SA also considers in its objection that the purpose of Article 80 GDPR has
been wrongfully interpreted in the Draft Decision recalling that As is apparent from
Article 80(1) GDPR, organisations such as NOYB are intended to be established precisely for
the
regard to the protection of their personal data. Where a Member State as in the case of
Austria has not made use for the option under Article 80(2) GDPR, NOYB has hardly any
other possibility than to systematically investigate certain infringements in advance and
113
72 Finally, the AT SA clearly indicates how its requested change would leave to a different
conclusion, i.e. the AT SA asks the BE SA to issue a decision on the merits and not to dismiss
the Complaint on formal grounds, specifically on the basis of apparent abuse of law. 114
73 In consequence, the EDPB finds the AT SA Objection to be reasoned.
105 EDPB Guidelines on RRO, paragraph 16.
106 EDPB Guidelines on RRO, paragraph 33. This was also argued in March 2026,
paragraph 44, p. 8.
107 AT SA Objection, p. 3.
108 AT SA Objection, p. 4, referring to the Judgment of the Court of Justice of9 January 2025 in case Österreichische
Datenschutzbehörde v F R, C-416/23, ECLI:EU:C:2025:3, paragraphs 49 et seq.
109 AT SA Objection, p. 3-4 (specifying that the Austrian court ruled there was no abuse of law in these cases and providing an
excerpt of the court ruling).
110 AT SA Objection, p. 5.
111 AT SA Objection, p. 2-3.
112 AT SA Objection, p. 3.
113 AT SA Objection, Section III, p.5.
114 AT SA Objection, Section III, p.6.
16 | Adopted
74 In order for an objection to meet the threshold set by Article 4(24) GDPR, it also needs to
clearly demonstrate the significance of the risks posed by the Draft Decision as regards the
fundamental rights and freedoms of data subjects and, where applicable, the free flow of
personal data within the Union 115.
75 The EDPB finds that the AT SA Objection sufficiently demonstrates the significance of the
risks for the fundamental rights and freedoms of data subjects posed by the Draft Decision. In
particular, the AT SA Objection notes that the ata [S]ubject is adversely affected 116 by the
[C] the AT SA
claims would follow if the Draft Decision were to be accepted. Further, the AT SA Objection
explicitly notes that, following Article 80(1) GDPR, organisations such as NOYB are
specifically established for rights and
Draft
D
rights and freedoms117.
76 Finally, the AT SA has clearly and explicitly demonstrated the existence of national case law
which, the AT SA Objection alleges, says that the Complaint should be held as admissible118.
The EDPB considers that it is clear from the AT SA Objection that the improper rejection of a
complaint on procedural grounds would have a significant risk for the fundamental rights and
freedoms of data subjects whose rights are the subject of that complaint. There is, therefore,
a specific and substantiated reason to find that the objection clearly demonstrates the risks for
data subjects and is therefore within the scope of Article 4(24) GDPR.
77 In addition, the AT SA objection also clearly demonstrates the significance of the risks posed
by the Draft Decision for the free flow of personal data within the Union. This risk can arise
119
. The AT SA Objection underlines, as mentioned, that no SA has considered any of
the complaints discussed in the context of the EDPB Cookie Banner Taskforce as constituting
an abuse of law120, and that consistency would therefore be jeopardised121.
78 In light of the above, the EDPB considers that the AT
of the risk is clear and self-evident from theAT SA Objection.
79 As a conclusion, the EDPB finds that the objection of the AT SA is relevant and reasoned
pursuant to Article 4(24) GDPR.
4.4.2 Assessment on the merits
80 In accordance with Article 65(1)(a) GDPR, the EDPB shall take a binding decision concerning
all the matters which are the subject of the relevant and reasoned objection. The EDPB
considers that the AT SA Objection found to be relevant and reasoned requires an
115 Art. 4(24) GDPR.
116 AT SA Objection, Section III, p.5.
117 AT SA Objection, Section III, p.5.
118 AT SA Objection, Section III, pp 4.5.
119 EDPB Guidelines on RRO, paragraph 48.
120 AT SA Objection, p. 2-3.
121 AT SA Objection, p. 3.
March 2026, p. 10, paragraph 60.
According to NOYB, this would undermine the aim of a consistent GDPR application across the EU resulting in data subjects
being granted different rights depending on the Supervisory Authority where they lodge their complaints and thus affecting the
free flow of data.
17 | Adopted
assessment of whether the Draft Decision needs to be changed in respect of the envisaged
dismissal of the Complaint.
81 More specifically, the EDPB needs to assess whether, on the basis of the information available
in the case at hand, the dismissal can be justified on the grounds of abuse by the Complainant
of the right to lodge a complaint under Article 77 GDPR and of the possibility of being
represented by an organisation based on Article 80(1) GDPR, consisting in a violation of the
general EU law principle prohibiting abuse of rights.
82 The EDPB deems it appropriate to start its analysis by first recalling the CJEU case law on
abuse of rights.
83 The prohibition of abuse of rights is a long-standing principle under EU law, which was
gradually developed by the Court of Justice122, and which requires national authorities and
courts to refuse to grant entitlement to rights conferred by provisions of EU law in situations
where these provisions are invoked for fraudulent or abusive ends123.
84 More specifically, as pointed out by the BE SA in the Draft Decision124, the Court of Justice of
the European Union has clarified It thus follows from that principle that a Member State must
refuse, even in the absence of provisions of national law providing for such a refusal, to grant
the benefit of the provisions of EU law where they are relied upon by a person not with
a view to achieving the objectives of those provisions, but with the aim of benefiting
from an advantage granted to that person by EU law when the objective conditions required
for obtaining the advantage sought, prescribed by EU law, are met only formally. 125
85 The EDPB notes that the AT SA in its objection
of Justice, 57(4)
according to which there is, in EU law, a general legal principle that EU law may not be relied
126
upon for abusive or fraudulent e . The CJEU has indeed underlined that, where a
122 See for example Judgment of the Court of Justice of 14 December 2000 in case Emsland-Stärke, C 110/99, EU:C:2000:695;
Judgment of the Court of Justice of 12 March 2014, in case O. and B., C 456/12, EU:C:2014:135; Judgment of the Court of
Justice of 22 November 2017, in case Cussens and Others, C 251/16; OJ C 22 Judgment of the Court of Justice of 26 February
2019, in case T Danmark and Y Denmark, C 116/16 and C 117/16, EU:C:2019:135 ; Judgment of the Court of Justice of 9
September 2021, in case Volkswagen Bank and Others, C 33/20, C 155/20 and C 187/20, OJ C 462; Judgment of the Court of
Justice of 21 December 2023 in joint cases VK and Others v BMW Bank GmbH and Others, , C 38/21, C 47/21 and C 232/21;
ECLI:EU:C:2023:1014, Judgment of the Court of Justice of 19 March 2026 in case Brillen Rottler GmbH & Co. KG v TC, C 526/24,
ECLI:EU:C:2026:216 . It is to be noted that in certain rulings the Court of Justice of the European Union refers to '
nt
remain the same.
123 Judgment of the Court of Justice of 26 February 2019 in case T Danmark and Y Denmark, C-116/16 and C-117/16,
EU:C:2019:135, paragraph 83, also referred to by the BE SA in paragraph 41 of the Draft Decision. For example, the Court of
Justice of the European Union has recognised that, taking into account all the circumstances of the case, an abuse could be
established where there was a purely formal dispatch of goods from Community territory with the sole purpose of benefiting from
export refunds and an intention on the part of the Community exporter to benefit from an advantage as a result of the application
of the Community rules by artificially creating the conditions for obtaining it (Judgment of the Court of Justice of the European
Union 14 December 2000, in case Emsland-Stärke, C 110/99, EU:C:2000:695, paragraphs 30 and 55); where, there were facts
showing that economic operators have carried out purely formal or artificial transactions devoid of any economic and commercial
justification, with the essential aim of benefiting improperly from the exemption from withholding tax provided for in Article 5 of
Directive 90/435 (Judgment of the Court of Justice of 26 February 2019, in case T Danmark and Y Denmark, C 116/16 and C
117/16, EU:C:2019:135, paragraph 108); and where the data subject has made a request for access under Article 15 GDPR for
the purpose of artificially creating the conditions laid down for obtaining compensation from the controller under Article 82 GDPR
(Judgment of the Court of Justice of 19 March 2026 in case Brillen Rottler GmbH & Co. KG v TC, C 526/24, ECLI:EU:C:2026:216,
paragraph 41).
124 Draft Decision, paragraph 41.
125 Judgment of the Court of Justice of 21 December 2023, in joint cases VK and Others v BMW Bank GmbH and Others, ,
C 38/21, C 47/21 and C 232/21; ECLI:EU:C:2023:1014, paragraph 283
126 AT SA Objection, p.4, referring to the Judgment of the Court of Justice of 9 January 2025 in case Österreichische
Datenschutzbehörde v F R, C-416/23, ECLI:EU:C:2025:3, paragraphs 49 and following; See also paragraph 34 of this Binding
Decision.
18 | Adopted
supervisory authority seeks to make use of the possibility under Article 57(4) GDPR and
class
intention on the part of the person submitting the request127.
86 The EDPB underlines that the assessment of the abuse requires a comprehensive approach,
in line with the test for the establishment of an alleged abuse developed by the CJEU, which
requires the existence of both an objective and a subjective component. In this regard,
the EDPB recalls the Court of Justice settled case law that proof of an abusive practice
requires, first, a combination of objective circumstances in which, despite formal
observance of the conditions laid down by the EU rules, the purpose of those rules has not
been achieved and, second, a subjective element consisting in the intention to obtain an
advantage from the EU rules by artificially creating the conditions laid down for obtaining it 128.
This is also recognised by the BE SA in the Draft Decision 129.
87 Furthermore, the EDPB highlights that in the Brillen Rottler ruling130, building on its previous
case law131, the Court clarified the reasoning to be followed for the assessment of the abuse
specifically in the context of the right of access under Article 15 GDPR. With regard to the
objective component of the abuse, which requires to verify whether the purpose of the legal
provisions at stake has been achieved, the Court explained, in summary, that the aim of
Article 15 GDPR is to confer on a data subject the right of access to personal data which have
been collected concerning him or her and to exercise that right easily and at reasonable
intervals132. On the basis of this, the Court held that, formally speaking, request for access
submitted by the data subjects could constitute an implementation of this right in order to
achieve the purpose of those rules 133 and therefore considered that the objective component
of the abuse did not seem to be present. However, the Court
formal observance of the conditions for applying Article 15 of the GDPR does not, in itself,
make it possible to rule out the existence of an abuse of rights 134.
88 The Court therefore moved on with the assessment of the subjective component of the abuse.
In line with its previous case law135, the Court reiterated in the Brillen Rottler ruling136 that, in
order to be able to characterise a
Article 12(5) GDPR, the controller must establish, having regard to all the relevant
127 Judgment of the Court of Justice of 9 January 2025, in case Österreichische Datenschutzbehörde v F R, C-416/23,
ECLI:EU:C:2025:3, paragraphs 50 and 59.
128 See for example Judgment of the Court of Justice of 14 December 2000 in case Emsland-Stärke GmbH v Hauptzollamt
Hamburg-Jonas, C-110/99, ECLI:EU:C:2000:695, paragraphs 52-53; Judgment of the Court of Justice of 26 February 2019, in
case T Danmark and Y Denmark, C-116/16 and C-117/16, EU:C:2019:135, paragraph 97; Judgment of the Court of Justice of 9
September 2021 in case Volkswagen Bank and Others, C-33/20, C-155/20 and C-187/20, ECLI:EU:C:2021:736, paragraph 122;
Judgment of the Court of Justice of 21 December 2023 in joint cases VK and Others v BMW Bank GmbH and Others, , C 38/21,
C 47/21 and C 232/21; ECLI:EU:C:2023:1014, paragraph 285.
129 Draft Decision, paragraph 26.
130 Judgment of the Court of Justice of 19 March 2026 in case Brillen Rottler GmbH & Co. KG v TC, C 526/24,
ECLI:EU:C:2026:216.
131 See footnote 130 of this Binding Decision.
132 Judgment of the Court of Justice of 19 March 2026 in case Brillen Rottler GmbH & Co. KG v TC, C 526/24,
ECLI:EU:C:2026:216, paragraph 38.
133 Judgment of the Court of Justice of 19 March 2026, in case Brillen Rottler GmbH & Co. KG v TC, C 526/24,
ECLI:EU:C:2026:216, paragraph 38.
134 Judgment of the Court of Justice of 19 March 2026 in case Brillen Rottler GmbH & Co. KG v TC, C 526/24,
ECLI:EU:C:2026:216, paragraph 39.
135 Judgment of the Court of Justice of 9 January 2025 in case Österreichische Datenschutzbehörde v F R, C-416/23,
ECLI:EU:C:2025:3, paragraphs 49, 50 and 56.
136
Judgment of the Court of Justice of 19 March 2026 in case, Brillen Rottler GmbH & Co. KG v TC, C 526/24,
ECLI:EU:C:2026:216.
19 | Adopted
enforced. In their view, compliance with the law cannot be considered an advantage under the
rule of law147.
96 Next, NOYB argues in essence that the Data Subject should not be required to justify why
they visited the C publicly available website, as this would lead to a reversal of the
burden of proof where the Data Subject would only have rights if they visited the website for a
correct reason148. NOYB also points out that there is no general European law principle that
test or model cases are unlawful and considers that none of the constitutive elements of the
abuse of right are fulfilled149.
97 On a preliminary note, the EDPB highlights that, if applied too broadly, the general EU law
principle prohibiting abuse of rights can have the effect of unduly restricting the application of
rights conferred by EU law, including of the fundamental right to data protection enshrined in
Article 8 CFR which finds a concrete expression in, among others, the right to lodge a
complaint under Articles 77 and 80 GDPR. Mindful of the need to balance the principle of
prohibition of abuse against other general principles of EU law, such as the principle of legal
certainty and the protection of legitimate expectations150, the EDPB considers that it has to be
subject to a strict interpretation and meet the threshold set out in the CJEU case law, including
in terms of burden of proof and evidential requirements.
98 Taking into account the CJEU case law explained above, in order to assess the existence of
the alleged abuse of rights, the EDPB deems it appropriate to check both the objective and
the subjective components of such abuse.
99 First, in so far as the objective component of the alleged abuse is concerned, the EDPB
notes that the relevant EU law provisions to take into account for the assessment of the alleged
abuse are Article 77 GDPR and Article 80(1) GDPR. This is also explicitly stated by the BE SA
in the Draft Decision151 and recognised by the AT SA Objection152. The main purpose of these
provisions is, first, to enable a data subject to lodge a complaint with a supervisory authority
where they consider that the processing of their personal data infringes the GDPR; and,
secondly, to allow a data subject, where they consider that their rights under the GDPR are
infringed, to mandate a representative meeting the conditions of Article 80(1) GDPR to lodge
the complaint on their behalf.
100 The EDPB also takes note of the BE ew that there are sufficient elements to conclude
that the objective element of the alleged abuse is present due to the artificial construction of
the complaint and the fact that the initiative for lodging the complaint lied with NOYB153. The
EDPB considers that it is, indeed, obvious from the information publicly shared by NOYB, as
well as from their written submissions154, that there has been an organised process of drafting
and filing of complaints as part of a project where NOYB played a leading role and which
147 65 submissions of 12 January 2026, paragraph 168.
148 65 submissions of 12 January 2026, paragraph 170.
149 65 submissions of 12 January 2026, p. 31, paragraph 172.
150 Opinion of AG POIARES MADURO of 7 April 2005 in Case C-255/02 Halifax, paragraph 84.
151 Draft Decision, paragraphs 27, 30, 38 and 41; see also Draft Decision, footnote 21.
152 AT SA Objection, p.3
153 Draft Decision, paragraph 29.
154 65 submissions of 12 January 2026, paragraphs 46 and 47 where NOYB explains that they have brought
complaints via volunteers working with them to ensure that ght
of day and that these cases came from walk-in complaints or public outrage.
21 | Adopted
consisted of targeting controllers on the basis of pre-defined criteria and the use of automated
means155.
101 However, considering that, in the present case, the Data Subject has successfully mandated
an organisation under Article 80(1) GDPR to file a complaint on their behalf under Article 77
GDPR156, the EDPB takes the view that the objective component of the abuse is absent since
not only have the conditions laid down by the EU rules been formally observed, but the aim
pursued by these rules also appears to have been fulfilled.
102 In the second place, the EDPB examines the subjective element of the alleged abuse, i.e. an
abusive intention to obtain an advantage other than fulfilling the purpose of the legal provisions
at stake.
103 In order to assess the subjective element of the alleged abuse, the EDPB needs to assess
whether by filing the complaint under Article 77 GDPR in conjunction with Article 80(1) GDPR,
the Complainant sought to rely on these provisions not with a view to achieving their
objectives, but with the aim of obtaining an undue advantage from them.
104 The EDPB notes that the BE SA in the Draft Decision makes a clear distinction between the
objectives pursued by the Data Subject and the objectives pursued by their representative
(NOYB) and takes the view that the actor of the alleged abuse is NOYB157. The EDPB also
158
notes that VRT shares the BE SA .
105 However, given that Article 77 GDPR and Article 80(1) GDPR are both phrased to refer to a
right of the data subject, the EDPB takes the view that the objectives pursued by the Data
Subject should not be distinguished from that of NOYB, considering that NOYB acts on behalf
of the Data Subject. In this regard, the EDPB also takes into account that the Data Subject
explicitly submitted on 7 January
159
.
106 In addition, the EDPB recalls that, in line with the CJEU case law, in order for an SA to be able
to refuse the benefit of a right conferred by EU law due to an alleged abuse of rights, it should
be able to sufficiently demonstrate the existence of such abuse, since it bears the burden of
proof 160.
107 The EDPB takes note of the BE policy objectives are linked to interests
other than those of the individual Data Subject, such as strategic objectives of the board or
the wishes of donors161 but finds no concrete evidence supporting this view. The EDPB notes
the [NOYB] board is not involved in any
day-to-day litigation , that almost all cases are typically run by the [NOYB]legal team alone 162
155 Draft Decision, p.5 65 submissions of 12 January 2026, paragraph 73 where NOYB explains that
the Data Subject (being native speaker) lik
65 submissions of 12 January 2026,
by the Data Subject, which pre-scanned websites and collected evidence of the visit, but the Data Subject was the one taking all
crucial acts.
156 The EDPB underlines that in the present case the validity of the mandate was not disputed in itself. The EDPB also recalls
the need for SAs to assess the validity of the mandate in light of Art. 80(1) GDPR and relevant national law.
157 Draft Decision, paragraphs 39-40.
158
See paragraph 91 of this Binding Decision
160 See for example Judgment of the Court of Justice of 9 January 2025 in case Österreichische Datenschutzbehörde v F R,
C 416/23, ECLI:EU:C:2025:3, paragraph 50; By analogy, see also Art. 57(4) GDPR.
161 Draft Decision, paragraph 22.
162 NOYB 65 submissions of 12 January 2026, paragraph 68.
22 | Adopted
and that having a personal interest in furthering the cause of [NOYB]is a precondition to be a
volunteer with [NOYB] 163.
108 It appears, on the basis of the information available to the EDPB, including the submissions
of the Complainant, that the interest in filing the Complaint was to bring the alleged
infringement by the Controller to the attention of the competent SA, provide it with sufficient
evidence thereof and put an end to this alleged infringement. In this regard, the EDPB finds it
particularly relevant that as underlined by the AT SA - during a complaint procedure, certain
evidence must be provided by the complainant and in the context of a website visit, such
evidence can only be submitted if screenshots and logfiles are created at the very time of
visiting the website164. The EDPB considers that some complainants may have an interest in
requiring technical assistance to provide such evidence165.
109 The EDPB agrees with the AT view that it is apparent from Article 80(1) GDPR that
organisations like NOYB are established precisely for the purpose of contributing to the
effective protection of personal data166.
110 Based on the documents available to the EDPB, there are insufficient elements to conclude
that NOYB has pursued its own interests and not those of the Data Subject, or that the Data
Subject has been instructed on how to act without being part of the initiative behind the
complaint.
111 The ability to file a complaint with professional assistance and representation by NOYB fits
with the intended purpose of Article 77 GDPR and Article 80(1) GDPR, and nothing
demonstrates that it allows the Complainant to obtain an undue benefit beyond achieving that
purpose. More specifically, neither the BE SA nor the Controller demonstrate that a
compensation under Article 82 GDPR or any other financial benefit has been sought.
112 For all these reasons and on the basis of the information available167, the EDPB considers
that, in this case, the Complainant did not abuse their right to lodge a complaint under
Article 77 GDPR and their right to representation under Article 80(1) GDPR.
113 Therefore, the EDPB decides that the BE SA should not dismiss the Complaint on the basis
of abuse of law, and orders the BE SA to assess the Complaint on its merits with a view to
submitting, in accordance with Article 60(3) GDPR, a new draft decision to the CSAs.
114 Consequently, the EDPB instructs the BE SA to inform the controller about the outcome of
this dispute resolution procedure and about the envisaged next steps168 within one month from
the notification of this Binding Decision169. The same communication has to be sent to the
Complainant by the AT SA170.
5 Binding Decision
163 NOYB 65 Submissions of 12 January 2026 , paragraph 77.
164 AT SA Objection, p.5.
165 This was also argued in NOYB Submissions to the EDPB of 26 March 2026, p. 2, paragraph 5.
166 AT SA Objection, p. 5.
167 Which does not include evidence justifying a different conclusion.
168 See also Judgment of the General Court of 29 January 2025, in Joined cases Data Protection Commission v European Data
Protection Board,T-70/23, T-84/23 and T-111/23, OJ C 127 paragraphs 36 and 45. The EDPB considers that, in the present case,
a partial decision, which would be limited to the conclusion that the Complaint is not dismissed on the basis of abuse of law,
would not be strictly necessary, without prejudice to national law and practice.
169 Art. 65(6) GDPR.
170 Art. 77(2) GDPR.
23 | Adopted
115 In light of the above, and in accordance with the task of the EDPB under Article 70(1)(t) GDPR
to issue binding decisions pursuant to Article 65 GDPR, the EDPB issues the following Binding
Decision in accordance with Article 65(1)(a) GDPR.
116 The EDPB addresses this Binding Decision to the LSA in this case (the BE SA) and to all the
CSAs, in accordance with Article 65(2) GDPR.
On the objection of the AT SA concerning whether the Complaint should be dismissed based
on an abuse of Article 77 GDPR and Article 80(1) GDPR
117 The EDPB decides that the objection of the AT SA meets the requirements of
Article 4(24) GDPR.
118 The EDPB instructs the BE SA not to dismiss the Complaint due to an abuse of
Article 77 GDPR and Article 80(1) GDPR.
6 Final remarks
119 The EDPB reiterates that its current decision is without any prejudice to any assessments the
EDPB may be called upon to make in other cases, including with the same parties, taking into
account the contents of the relevant draft decision and the objections raised by the CSAs.
120 The BE SA and the AT SA shall inform the Board of the date when the communication or
partial decision specifying that the Complaint will be assessed on the merits171 is notified to
the Controller and to the Complainant172. This Binding Decision will be made public pursuant
to Article 65(5) GDPR without delay after this information173.
121 The BE SA and/or the AT SA, as the case may be, will communicate its final decision to the
Board 174 . Pursuant to Article 70(1)(y) GDPR, the BE SA /AT
communicated to the EDPB will be included in the register of decisions which have been
subject to the consistency mechanism.
For the European Data Protection Board
The Chair
(Anu Talus)
171 See footnote 168.
172 Art. 65(6) and 77(2) GDPR.
173 Art. 65(5) and (6) GDPR.
174 This refers to the final decision on the merits, adopted pursuant to Art. 60(7), 60(8) and 60(9) GDPR.
24 | Adopted