Binding Decision 1/2026

24 6 Final remarks ............................................................................................................. 24 European Data Protection Board 2 | Adopted The European Data Protection Board Having regard to Article 63 and Article 65(1)(a) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter GDPR )1, Having regard to the European Economic Area (hereinafter EEA ) Agreement and in particular to Annex XI and Protocol 37 thereof, as amended by the Decision of the EEA joint Committee No 154/2018 of 6 July 20182, Having regard to Article 11 and Article 22 of its Rules of Procedure (hereinafter EDPB RoP )3, Whereas: (1) It follows from Article 60 GDPR that the lead supervisory authority (hereinafter LSA ) shall cooperate with the other supervisory authorities concerned (hereinafter CSAs ) in an endeavour to reach consensus, that the LSA and CSAs shall exchange all relevant information with each other, and that the LSA shall, without delay, communicate the relevant information on the matter to the other CSAs.

The LSA shall without delay submit a draft decision to the other CSAs for their opinion and take due account of their views. (2) Where any of the CSAs expressed a reasoned and relevant objection on the draft decision in accordance with Article 4(24) and Article 60(4) GDPR and the LSA does not intend to follow the objection or considers that the objection is not relevant and reasoned, the LSA shall submit this matter to the consistency mechanism referred to in Article 63 GDPR. (3) The main role of the European Data Protection Board (hereinafter t EDPB Board ) is to ensure the consistent application of the GDPR throughout the EEA. To this effect, pursuant to Article 65(1)(a) GDPR, the EDPB shall issue a binding decision concerning all the matters which are the subject of the relevant and reasoned objections, in particular whether there is an infringement of the GDPR. (4) The binding decision of the EDPB shall be adopted by a two-thirds majority of the members of the EDPB, pursuant to Article 65(2) GDPR in conjunction with Article 11(4) EDPB RoP, within one month after the Chair of the EDPB and the competent supervisory authority SA ) have decided that the file is complete.

The decision concerns the dispute arisen following a draft decision (hereinafter, Draft Decision té de r , BE SA LSA the Austrian supervisory authority , hereinafter, AT SA 2 Complaint August 2021 to the AT SA on a case concerning activities carried out by the Vlaamse Radioen Televisieomroeporganisatie, a public broadcasting company established in Brussels, Controller VRT complaint to the BE SA as LSA4. 3 Data Subject who requested the non-profit noyb NOYB 5 to represent them under Article 80 (1) GDPR Complainant 4 In particular, the Complaint concerned the Article 5(1)(a), Article 6(1)(a), Article 12(1), Article 12(2) andArticle 13(1)(c) GDPR and Article 5(3) ePrivacy Directive and was one of the multiple complaints lodged by NOYB with different supervisory authorities (he SAs set up a Taskforce6 to coordinate the response to these complaints by exchanging views among relevant SAs and streamlining communication.

The work of the Taskforce led to the publication of a report in 20237. 5 The Draft Decision envisages the dismissal of the Complaint on the ground that the general principle of EU law prohibiting abuse of law was violated due to an alleged abuse of the right to lodge a complaint under Article 77 GDPR in conjunction with Article 80(1) GDPR8. The Draft Decision is largely based on earlier case law of the Belgian Market Court, which had previously quashed another BE SA decision (Decision 113/2024) for not concluding on the existence of an abuse in a very similar case brought by NOYB9. 6 The following table presents a summary timeline of the events part of the procedure leading to the submission of the matter to the consistency mechanism: 4 Draft Decision, paragraph 3. 5 NOYB is an association established under Austrian law: Austrian Central Register of Associations (ZVR) nr. 1354838270. eu/news/news/2021/edpb-establishes-cookie-banner-taskforce_en.

eu/our-work-tools/our-documents/other/report-work-undertaken-cookie-banner-taskforce_en. 8 Draft Decision, paragraphs 21-43 and 46 and p. 17. 9 Draft Decision, paragraphs 12-20, referring to the Judgment of the Brussels Court of Appeal (section Market Court) of 19 March 2025 (Mediahuis), nr. 2024/AR/1690. ') issued by the Belgian supervisory authority ('Auteri protection des donnees' o 'Gegevensbeschermingsautoriteit', hereinafter the ' ', also referred to in this context as the ' ') and the subsequent objection expressed by ('Osterreichischen Datenschutzbehorde' the ' '). The Draft Decision at issue relates to a complaint (hereinafter, ' ') submitted on 10 Belgium (hereinafter, the ' 'or' '). On 6 June 2023, the AT SA transmitted the The Complaint was lodged by a data subject (hereinafter, the ' ') - "European Center for Digital Rights" (hereinafter, ' ') (collectively hereinafter referred to as the' ').

The BE SA expressed to the Controller and the Complainant its intention to initiate the dispute resolution procedure and invited them to make written submissions prior to a potential Article 65 GDPR procedure13 . VRT provided its submissions (hereinafter, 'VRT's Article 65 submissions of 1 December 2025'). NOYB provided its submissions, including 12 Annexes (hereinafter, 'NOYB's Article 65 submissions of 12 January 2026'). VRT provided additional written submissions (hereinafter, 'VRT's Article 65 submissions of 19 January 2026'). 7 Following the facts set out above, on 28 January 2026, the BE SA submitted the dispute to the EDPB in accordance with Article 60(4) GDPR, thus initiating the dispute resolution procedure under Article 65(1)(a) GDPR using the Internal Market Information system (hereinafter, 'IMI'). 8 The EDPB Secretariat assessed the completeness of the file on behalf of the Chair of the EDPB in line with Article 11 (2) EDPB RoP.

The EDPB Secretariat contacted the BE SA on 10 February 2026 to seek clarifications as to which documents had been shared with the parties prior to the submission of the dispute to the EDPB. On 10 February 2026 and 10 Article 11 (2) of the EDPB RoP provides that 'the lead supervisory authority shall submit the matter to the secretariat via the information and communication system mentioned in Article 17 of these Rules of Procedure. In case of Article 65 (1) (a) GDPR, the lead supervisory authority when submitting the matter to the secretariat shall include: ... b) a summary of the relevant facts and grounds'. The BE SA provided its Referral memo to the EDPB on 20 February 2026, summarising the main facts of the case and their views on the AT SA Objection (hereinafter, 'Referral by the BE SA to the EDPB'). 7. 11 AT SA Objection dated 22 September 2025. 12 As mentioned in the Referral by the BE SA to the EDPB, p.

12 The Chair of the EDPB decided, in compliance with Article 65(3) GDPR in conjunction with Article 11(4) EDPB RoP, to extend the default timeline for adoption of one month by a further month on account of the complexity of the subject-matter. 2 The Right to good administration 13 The EDPB is subject to the Charter, in particular Article 41 (right to good administration). This is also reflected in Article 11(1) EDPB RoP. Further details were provided in the EDPB Guidelines on Article 65(1)(a) GDPR15. 14 The EDPB assessed whether all documents received containing the matters of facts and law used by the EDPB to take its decision in this procedure had previously been shared with the Controller and the Complainant, and whether they were given the opportunity to exercise their right to be heard in relation to the procedure led by the BE SA and the subject matter of the dispute to be resolved by the EDPB.

In respect of the Complainant, the EDPB underlines in particular that the Complainant may potentially be adversely affected by the outcome of this specific procedure as the dispute pertains to the dismissal of the Complaint. 15 The EDPB takes the view that both the Controller and the Complainant had received the opportunity to exercise their right to be heard with regard to the documents containing the matters of fact and law considered and addressed by the EDPB to solve the dispute in the context of this Binding Decision. Their written observations were shared with the EDPB by the BE SA16. 14 Art. 11(2) EDPB RoP Article 65 submissions of 12 January 2026, there were some decisions adopted by SAs that were not available in English. These decisions were provided in Italian, Spanish, German and French. The translation of the documents was proofread and validated by the SAs who issued such decisions or who had the language of the decision as official language (IT SA, ES SA, AT SA, and BE SA).

Following the validation of the translations, the translated documents were added to the file by the EDPB Secretariat on 23 March 2026. 0 , paragraphs 94-108 (both hereinafter referred to as EDPB Article 65 (1)(a) Guidelines 16 As mentioned above in paragraph 6 of this Binding Decision, on 21 October 2025, the BE SA invited the Controller and the Complainant to submit their positions prior to a potential Article 65 GDPR procedure and therefore in the context of that procedure. The Controller provided written submissions on 1 December 2025 and 19 January 2026. The Complainant provided written submissions on 12 January 2026. European Union (hereinafter the ' 'or' ') provides that '[w]hen necessary, the documents submitted by the competent authority will be translated into English by the secretariat' and that the 'competent authority' needs to agree on the translation. Among the annexes to NOYB's (hereinafter, ' ') (version for public consultation) (hereinafter, ' ') ').

European Data Protection Board 6 | Adopted 16 However, for reasons of transparency, VRT and NOYB were provided with specific documents which they ha March 202617. These specific documents did not bring any new factual or legal elements to be relied on by the EDPB in the context of this Binding Decision. VRT and NOYB were thereby offered the opportunity to share further observations they might have. These written observations were provided by VRT and NOYB on 26 March 2026 and were subsequently added to the file March 2026 NO Submissions to the EDPB of 26 March 2026 17 Therefore, the EDPB notes that both VRT and NOYB received the opportunity to make their views known regarding all the legal and factual elements used by the EDPB to take this decision. 3 Conditions for adopting a binding decision 18 The general conditions for the adoption of a binding decision by the EDPB are set forth in Article 60(4) and Article 65(1)(a) GDPR18.

18 According to Art. 65(1)(a) GDPR, the Board will issue a binding decision when a supervisory authority has raised a relevant and reasoned objection to a draft decision of the LSA and the LSA has not followed the objection or the LSA has rejected such an objection as being not relevant or reasoned. 19 AT SA Objection, dated 22 September 2025. 8. 8. d not previously received, via the EDPB Chair's letters of 12 (hereinafter, 'VRT's Submissions to the EDPB of 26 'respectively). ' and ' YB's law on provisions related to the GDPR's complaint mechanism, notably Article European Data Protection Board 7 | Adopted 21 The case at issue fulfils, prima facie, all the elements listed by Article 65(1)(a) GDPR, since the AT SA raised an objection to the Draft Decision of the BE SA within the deadline provided by Article 60(4) GDPR, and the BE SA has not followed the objection. 22 Considering the above, in particular that the conditions of Article 65(1)(a) GDPR are met, the EDPB is competent to adopt a binding decision, which shall concern all the matters which are the subject of the relevant and reasoned objection, in particular whether there is an infringement of the GDPR or whether the envisaged action in relation to the controller or processor complies with the GDPR22.

23 The EDPB recalls that its current decision is without any prejudice to any assessments the EDPB may be called upon to make in other cases, including with the same parties, taking into account the contents of the relevant Draft Decision and the objection raised by the CSA. 24 VRT argues that the concerned matter falls 23, for two main reasons. 24 According to VRT, the fact that this dispute does not in itself concern whether the controller has infringed the GDPR brings the dispute 25. VRT also argues that all previous EDPB decisions have always concerned infringements of the GDPR by a controller26. 26 With respect to this first argument, the EDPB recalls that, pursuant to Article 65(1) GDPR and Article 70(1)(a) GDPR, the dispute resolution mechanism is indeed meant to ensure the correct and consistent application of the GDPR in cases involving cross-border processing of personal data.

27 However, for a matter to concern the application of the GDPR, it does not necessarily have to concern whether the controller committed an infringement of the GDPR. , whether envisaged action in relation to the controller or processor complies with [the GDPR] 27. Moreover, according to Article shall concern all the matters which are the subject of the relevant and reasoned objection, in particular whether there is an infringement of Recital 136 GDPR also explains that the Board is supervisory authorities, in particular in the cooperation mechanism between the lead 22 Art. 65(1)(a) GDPR and Art. 4(24) GDPR. 23 65 submissions of 1 December 2025 paragraphs 8- 65 submissions of 19 January 2026 paragraphs 8-14 and paragraph 37. 24 65 submissions of 1 December 2025 paragraphs 8- 65 submissions of 19 January 2026 paragraphs 8- Submissions to the EDPB of 26 March 2026, authority to adopt a binding decision in accordance with Article 65(1)(a) - - - an aspect emphasised by Article 65(1)(a) [GDPR], Article 70(1)(a) GDPR, as well as by recital 136 GDPR, Article 65 submissions of 1 December 65 submissions of 19 January 2026, p.

6, paragraph 8 and VRT's Article According to VRT, although the concerned matter does indeed mention "Article infringed and, in any case, "even if Article to VRT", as these articles do not place any obligations upon a controller, VRT's Articl paragraph 12, p. 7 and VRT's Article ", the VRT's Article and VRT's Article European Data Protection Board 8 | Adopted supervisory authority and supervisory authorities concerned on the merits of the case, in particular 28 In light of these provisions, the EDPB is competent to address the merits of all the objections that are found to be relevant and reasoned, and is competent to resolve disputes also concerning the envisaged action in relation to the controller or processor, including the envisaged corrective measures or the envisaged decision to dismiss or reject a complaint28. 29 29 30. If such objection is deemed to be relevant and reasoned within the meaning of Article 4(24) GDPR, which is analysed below, solving the dispute between the supervisory authorities.

30 consistency of the application of the GDPR as a whole, and not just of its provisions imposing obligations on controllers and processors31. 31 complainant (or its representative) is abusing its rights under Article 77 [GDPR] [in combination with] Article 80(1) GDPR because abuse of rights is not a GDPR- - 32. 32 The BE SA indicates t Article 77 [GDPR] [in combination with] Article 80(1) 33. However, the BE SA does not question the competence of the EDPB to address the matter. 33 The competence of the EDPB to address any dispute raised by a relevant and reasoned objection to a draft decision that concerns the compliance of the envisaged action with the GDPR necessarily also includes disputes on whether the relevant provisions of the GDPR were correctly applied. The dispute in this case pertains precisely to whether 28 Article 4(24) an infringement of [the GDPR], or whether envisaged action in relation to the controller or processor complies with [the GDPR] (emphasis added).

38 The EDPB will assess, in relation to each objection raised, whether the objection meets the requirements of Art. 4(24) GDPR and, if so, address the merits of the objection in the binding decision. 0, paragraph 63. 1 Analysis by the LSA in the Draft Decision 39 In its Draft Decision, the BE SA starts by recalling previous investigations carried out by the BE SA Inspection Service and public declarations made by NOYB on their website39. The BE SA also refers to a previous ruling of the Belgian Market Court in the Mediahuis case40, on which the Draft Decision is largely based41. More specifically, according to the Draft Decision, the Complaint should be dismissed due to an apparent abuse of the right to lodge a complaint under Article 77 GDPR in conjunction with Article 80(1) GDPR42. 40 The BE SA considers that the essential aspects of the Complaint have been identified by NOYB and not by the Data Subject, as in the BE the latter has been instructed on how to lodge the Complaint43.

In the BE Complaint pursues the policy objectives linked to interests other than those of an individual data subject (for instance, strategic objectives of the board or the wishes of donors) and which may de facto take precedence over the mandating in this context44. 41 The BE SA refers to the CJEU case law on abuse of law and takes the view that there is an abuse of law in the case at hand, given that both the objective and the subjective components of the abuse, as required by the CJEU case law, are present45. e. 4-6. 40 Judgment of the Brussels Court of Appeal (section Market Court) of 19 March 2025 (Mediahuis), nr. 2024/AR/1690. 2, p. 6-7. 42 Draf . 43 Draft Decision, Section III, paragraph 21 - according to the BE SA, these essential aspects include the claimed grievances but also the identity of the targeted controllers; the BE SA notes that NOYB has explicitly mentioned a target list .

Article 80(2) GDPR enables national legislators to to provide the organisations concerned the possibility to lodge complaints in an overarching manner, when they consider that a data subject's rights under the GDPR have been infringed as a result of the processing57. Neither the Austrian, nor the Belgian legislator availed themselves of this possibility58. 43 The BE SA considers that the subjective component of the abuse is present too, namely the intention to obtain an advantage conferred by the Union rules by artificially creating the conditions under which the right to that advantage arises59. According to the BE SA, the abuse of law is based on circumvention60 because: NOYB seeks to have the power to bring proceedings before the BE SA for its cookie banner complaints project61; a power to bring proceedings cannot exist without the data subject as an individual in Belgian or Austrian law (where Article 80(2) GDPR has not been implemented)62; NOYB asks trainees or staff if they want to become data subjects in model cases to artificially fall under Article 80(1) GDPR - the incitement to create a legal pathway to the BE SA constitutes the subjective element of the abuse law on the part of NOYB63.

the benefit is aimed at pursuing the general (policy) objectives of NOYB, which follows clearly from the declarations on the NOYB website, declaring NOYB aims to end cookie banner terror by filing the complaints64. 44 In light of the above, and referring to CJEU case law65, the BE SA takes the view that it must refuse NOY icle 77 GDPR in conjunction with Article 80(1) GDPR66. 2, paragraph 31. 2, paragraph 38. 2, paragraph 32. 2, paragraph 34. 2, paragraph 35. 2, paragraph 26. 1, paragraph 27. 3, paragraph 39. 3, paragraph 39. 3, paragraph 40. 3, paragraph 40. 65 BE SA refers to the Judgment of the Court of Justice of 21 December 2023 in joint cases VK and Others v BMW Bank GmbH and Others, C-38/21, C-47/21 and C-232/21, ECLI:EU:C:2023:1014, paragraph 283. 4, paragraph 41. • • driven' initiatives are precisely the • • • B's use of the right to lodge a complaint under Art European Data Protection Board 12 | Adopted 45 The AT SA raises an objection pursuant to Article 4(24) GDPR and Article 60(4) GDPR against the dismissal of the Complaint on the grounds that the case involves an apparent abuse of law.

The AT SA requests that the BE SA issues a decision on the merits and deals with the Complaint in accordance with Article 57(1)(f) GDPR67. 46 The AT SA emphasises that the Complaint forms part of the so-called complaints which NOYB lodged with various SAs and that no other supervisory authority has 68. The AT SA considers, thus, that the BE SA should analyse the Complaint on its merit and not dismiss the Complaint on the grounds of apparent abuse of law69. 47 To support its view, the AT SA refers to European and national case law dealing with the question of whether there has been an abuse of the right to lodge a complaint under Article 77 GDPR70 . Firstly, the AT SA relies on a previous ruling by the Austrian Federal Administrative Court: this Court held, in a similar case, that there were no doubts as to the existence of a valid power of attorney [referring to NOYB , flagged that the nonimplementation of Article 80(2) GDPR into Austrian law could not mean that employees or members of an association such as NOYB were barred from lodging individual data protection complaints in the event of alleged infringements arising from their personal activities, and highlighted that the GDPR does not take into account the motive of the data subject in connection with an activity that is ultimately relevant under data protection law71.

74 AT SA Objection, Section III, p. 735. 'Cookie Banner' considered these complaints to constitute an 'apparent abuse of law' 's mandate] stating that ' Regulation' if the decisive reasons for the complainant's '[ 'and that, 's Austria's European Data Protection Board 13 | Adopted purpose of acting in the field with regard 75. 51 According to the AT SA, with respect to Member States where Article 80(2) GDPR has not been transposed into national law, has hardly any other possibility than to systematically investigate certain infringements in advance and subsequently lodge complaints 76. The AT his also stems from the fact that during a complaint procedure, certain evidence must be provided by the complainant n the context of a website visit, such evidence can only be submitted if screenshots and logfiles are created at the very time of visiting the website 77. 52 In the AT 80(2) GDPR does not lead to the conclusion that representation under Article 80(1) GDPR cannot systematically take place and be organized according to specific thematic areas such as the Cookie Banner Complaints 78.

53 The AT SA further underlines its view that, regardless of NOYB Data Subject is adversely affected as the cookie banner on the C in compliance with the GDPR79. According to the AT SA, the Data S may be a reason why no right to compensation under Article 82 GDPR arises, due to the deliberate access to the website, but the objective infringement of the GDPR remains because the conditions for a valid consent under data protection law and, consequently, the lawfulness of the processing, were not met 80. 54 Moreover, the AT SA states that the consistent application of the GDPR is jeopardised if certain SAs such as, at least in this case, the BE SA dismiss a complaint on the grounds of apparent abuse of law, while others examine similar or even identical complaints on their merits81. 3 Position of the LSA on the objection 55 The BE SA considers that the AT SA Objection against the dismissal of the Complaint on the grounds that the case involves an apparent abuse of law constitutes a relevant and reasoned objection in accordance with Article 4(24) GDPR82.

The BE SA however states that it does not intend to follow the AT SA Objection because of the divergent national case law in Belgium and Austria with regard to this matter83. 1 Assessment of whether the objection was relevant and reasoned 56 The objection raised by the AT SA concerns, in a nutshell, whether the Draft Decision appropriately envisages the dismissal of the Complaint. 75 AT SA Objection, Section III, p. 5. 76 AT SA Objection, Section III, p. 5. 5. 5. 5. 5-6. 3. 8. 8. of the protection of data subjects' rights and freedoms to the protection of their personal data' 'NOYB SA argues that '[t] SA's view, the existence of Article ' and '[i] 's representation, the ontroller's website was not ubject's behaviour European Data Protection Board 14 | Adopted 57 SA Objection does not meet the threshold set by Article 4(24) GDPR84 85. 58 T SA Objection is not relevant because it only holds abstract and analysis86 , but the AT Decision would not be correct or why the LSA should have made another assessment of the factual circumstances stated in the Draft Decision87.

Further, i , there is no clear demonstration of what the alleged legal or factual errors in the Draft Decision are88. With respect to the subject matter of the AT SA Objection, VRT argues that none of the examples mentioned in the EDPB Guidelines on Article 65(1)(a) GDPR are at issue in the present case89. 59 Moreover, VRT argues that the AT SA Objection is not reasoned including because the AT SA attempts to substantiate its objection with elements that are not coherent or relevant90. 60 VRT also argues that the AT SA Objection does not clearly demonstrate the significance of the risks posed by the Draft Decision, as the AT SA Objection does not contain a clear statement regarding the risks and their significance91. Further, VRT claims that the fact that the Data Subject would be adversely affected due to allegedly unlawful cookie banners on 92, and that the fact that the LSA has not addressed the Complaint on its merits does not in any way lead to a significant risk for 93.

90 According to VRT, the fact that abuse of rights was not addressed in the report from the EDPB Cookie Banner Taskforce in no way excludes that complaints filed by NOYB on behalf of a complainant may constitute abuse of rights; also, it is incorrect to represented by an organisation in violation of the prohibition of abuse of right; moreover, VRT considers that the Austrian decisions mentioned in the AT SA Objection cannot support the AT and certain case law is incorrectly referenced. VRT also considers that the concerned matter is not related to Article 80(2) GDPR and therefore the arguments about this provision are not relevant, 65 submissions of 1 December 2025, p. 10-12, paragraphs. 26- 65 submissions of 19 January 2026, p. 10-12, paragraphs 26-31. 91 65 submissions of 1 December 65 submissions of 19 January 2026, paragraph 25, p. 10. a subjects and/or the free flow of data are not put in a clear, precise and detailed manner in the objection.

The same applies to the link between the envisaged consequences of the Draft Decision and the significance of the anticipated risks that have not been established or demonstrated. 92 65 submissions of 1 December 65 submissions of 19 January 2026, Complaint and therefore has not (yet) investigated whether the concerned cookie banner from VRT would actually infringe the GDPR. 93 65 submissions of 1 December 65 submissions of 19 January 2026 paragraph 33, p. 12. The EDPB takes note of VRT's view that the AT and of NOYB's view that, conversely, it is 'relevant and reasoned' VRT's view is that the A broad comments that are not specifically related to the Draft Decision's facts and legal . e. the complaint's dismissal) SA does not explain why the LSA's reasoning in the Draft n VRT's view VRT's website is a risk that is not substantial or plausible data subjects' rights and freedoms VRT's Article 16, p.

8 and VRT's NOYB's Article VRT's Article VRT's Article 65 VRT's Article VRT's Article 16, p. 8, VRT'sArticle 2025 paragraph 18, p. 9 and VRT's Article and VRT's Article 2025 paragraph 18, p. and VRT's Article 2025 paragraph 21, p. 9, and VRT's Article derive from the EDPB Cookie Banner Taskforce's report that a data subject may exercise his/her complaint right and/or may be SA's position as they are not relevant for the case at hand, VRT's Article 31 and VRT's Article VRT's Article 2025, paragraph 25, p. 12 and VRT's Article paragraph 32, p. 12. In VRT's view, the Draft Decision does not address the merits of the VRT's Article 2025, paragraph 33, p. 12 and VRT's Article European Data Protection Board 15 | Adopted 61 AT SA Objection is relevant. NOYB considers that the substance of the Draft Decision is correctly identified in the AT SA Objection94 and the AT SA Objection clearly identifies how if followed, it would entail a change leading to a different conclusion and more precisely that the BE SA shall not dismiss the Complaint based on an apparent abuse of law and instead issue a decision on the merits.

Further, NOYB considers that the AT SA Objection concerns the specific legal question of abuse of law in the complaint lodged by NOYB on behalf of the Data Subject 95 . e. the dismissal of the complaints) and suggests that instead a decision on the merits should be taken96. 62 Moreover, NOYB considers the AT SA Objection is reasoned because the AT SA Objection provides ample legal arguments for an amendment of the Draft Decision97. 63 NOYB also argues that the AT SA Objection sufficiently proves the risks posed by the Draft Decision because as outlined in the AT SA Objection the Draft Decision leads to a fragmented interpretation of the admissibility of similar cookie complaints across the Union98. According to NOYB, this would undermine the aim of a consistent GDPR application across the E[uropean] U[nion] resulting in data subjects being granted different rights depending on the SA where they lodge their complaints and thus affecting the free flow of data.

64 In order to analyse whether the AT SA O 4(24) GDPR, the EDPB notes , that the AT SA Objection has a direct connection with the Draft Decision and makes many references to its factual and legal content99. The AT SA Objection, if followed, would entail a change leading to a different conclusion100 since taking it on board would mean assessing the case on its merits and not dismissing the Complaint. The AT SA also points out that if the AT SA rejects the Complaint following a final decision taken by the BE SA, it is very likely that the Austrian Courts will quash this decision101. 65 The EDPB further considers the objection to concern whether the envisaged action in relation to the controller or processor complies with the GDPR, in line with Article 4(24) GDPR. The EDPB recalls that the decision to reject or dismiss a complaint, in whole or in part, also constitutes an envisaged action capable of being subject of a relevant and reasoned objection 102.

105, 68 The EDPB considers that the AT SA puts forward several legal and factual arguments in its objection in order to demonstrate why the Draft Decision of the BE SA should be amended106. 69 First, the AT SA indicates that the Draft Decision wrongfully concludes that the conditions for an abuse of the right to lodge a complaint are met107. To strengthen its argumentation, the AT SA refers to CJEU case-law on abuse of law108 and to Austrian national case law dealing with whether there was an abuse of the right to lodge a complaint in analogous cases109. Moreover, the AT SA recalled different cases where the AT SA affirmed the existence of abusive intent and dismissed the complaint pursuant to Article 57(4) GDPR, underlining that in the case at hand, instead, no purposes unrelated to data protection are pursued by exercising the right to lodge a complaint under Article 77 GDPR 110. 70 Secondly, the AT SA recalls that all other relevant SAs have decided on the merits in comparable cases and none of them has considered any of the complaints discussed in the context of the EDPB Cookie Banner Taskforce as constituting an abuse of law111.

In this regard, the AT SA underlines that SAs and the EDPB are required to contribute to the consistent application of the GDPR, in light of Article 57(1)(a) and Article 70(1) GDPR, and this consistency would be jeopardised if certain SAs were to dismiss a complaint on the grounds of apparent abuse of law while others examine similar or identical complaints on their merits112. 71 Lastly, the AT SA also considers in its objection that the purpose of Article 80 GDPR has been wrongfully interpreted in the Draft Decision recalling that As is apparent from Article 80(1) GDPR, organisations such as NOYB are intended to be established precisely for the regard to the protection of their personal data. e. the AT SA asks the BE SA to issue a decision on the merits and not to dismiss the Complaint on formal grounds, specifically on the basis of apparent abuse of law. 114 73 In consequence, the EDPB finds the AT SA Objection to be reasoned.

105 EDPB Guidelines on RRO, paragraph 16. 106 EDPB Guidelines on RRO, paragraph 33. This was also argued in March 2026, paragraph 44, p. 8. 107 AT SA Objection, p. 3. 108 AT SA Objection, p. 4, referring to the Judgment of the Court of Justice of9 January 2025 in case Österreichische Datenschutzbehörde v F R, C-416/23, ECLI:EU:C:2025:3, paragraphs 49 et seq. 109 AT SA Objection, p. 3-4 (specifying that the Austrian court ruled there was no abuse of law in these cases and providing an excerpt of the court ruling). 110 AT SA Objection, p. 5. 111 AT SA Objection, p. 2-3. 112 AT SA Objection, p. 3. 5. 6. e. the legal / factual mistakes of the LSA's draft [. ' NOYB's Submissions to the EDPB of 26 European Data Protection Board 17 | Adopted 74 In order for an objection to meet the threshold set by Article 4(24) GDPR, it also needs to clearly demonstrate the significance of the risks posed by the Draft Decision as regards the fundamental rights and freedoms of data subjects and, where applicable, the free flow of personal data within the Union 115.

There is, therefore, a specific and substantiated reason to find that the objection clearly demonstrates the risks for data subjects and is therefore within the scope of Article 4(24) GDPR. 77 In addition, the AT SA objection also clearly demonstrates the significance of the risks posed by the Draft Decision for the free flow of personal data within the Union. This risk can arise 119. The AT SA Objection underlines, as mentioned, that no SA has considered any of the complaints discussed in the context of the EDPB Cookie Banner Taskforce as constituting an abuse of law120, and that consistency would therefore be jeopardised121. 78 In light of the above, the EDPB considers that the AT of the risk is clear and self-evident from theAT SA Objection. 79 As a conclusion, the EDPB finds that the objection of the AT SA is relevant and reasoned pursuant to Article 4(24) GDPR. 2 Assessment on the merits 80 In accordance with Article 65(1)(a) GDPR, the EDPB shall take a binding decision concerning all the matters which are the subject of the relevant and reasoned objection.

The EDPB considers that the AT SA Objection found to be relevant and reasoned requires an 115 Art. 4(24) GDPR. 5. 5. 5. 119 EDPB Guidelines on RRO, paragraph 48. 120 AT SA Objection, p. 2-3. 121 AT SA Objection, p. 3. March 2026, p. 10, paragraph 60. According to NOYB, this would undermine the aim of a consistent GDPR application across the EU resulting in data subjects being granted different rights depending on the Supervisory Authority where they lodge their complaints and thus affecting the free flow of data. '[D] ontroller's alleged infringement and then goes on to set out the harm which 'acting in the field of the protection of data subjects" freedoms with respect to the protection of their personal data" and makes it clear that the ecision threatens their ability to do so in countries such as Austria, to the risk of data subjects' 'when unjustifiably different decisions are issued by SAs in situations that are identical or similar' SA's position regarding the significance In this regard, the EDPB also takes note of NOYB's argument that the Draft Decision would undermine the consistency of the application of the GDPR.

For example, the Court of Justice of the European Union has recognised that, taking into account all the circumstances of the case, an abuse could be established where there was a purely formal dispatch of goods from Community territory with the sole purpose of benefiting from export refunds and an intention on the part of the Community exporter to benefit from an advantage as a result of the application of the Community rules by artificially creating the conditions for obtaining it (Judgment of the Court of Justice of the European Union 14 December 2000, in case Emsland-Stärke, C 110/99, EU:C:2000:695, paragraphs 30 and 55); where, there were facts showing that economic operators have carried out purely formal or artificial transactions devoid of any economic and commercial justification, with the essential aim of benefiting improperly from the exemption from withholding tax provided for in Article 5 of Directive 90/435 (Judgment of the Court of Justice of 26 February 2019, in case T Danmark and Y Denmark, C 116/16 and C 117/16, EU:C:2019:135, paragraph 108); and where the data subject has made a request for access under Article 15 GDPR for the purpose of artificially creating the conditions laid down for obtaining compensation from the controller under Article 82 GDPR (Judgment of the Court of Justice of 19 March 2026 in case Brillen Rottler GmbH & Co.

KG v TC, C 526/24, ECLI:EU:C:2026:216, paragraph 41). 124 Draft Decision, paragraph 41. 4, referring to the Judgment of the Court of Justice of 9 January 2025 in case Österreichische Datenschutzbehörde v F R, C-416/23, ECLI:EU:C:2025:3, paragraphs 49 and following; See also paragraph 34 of this Binding Decision. the "abuse clause" of Article nds' states that '[a]ccording to the European Court GDPR reflects the Court's settled jurisprudence, abuse", in others to "abusive practice", "abuse of rights" or "abuse of law" depending on the context but the core idea and the assessme European Data Protection Board 19 | Adopted supervisory authority seeks to make use of the possibility under Article 57(4) GDPR and class intention on the part of the person submitting the request127. 86 The EDPB underlines that the assessment of the abuse requires a comprehensive approach, in line with the test for the establishment of an alleged abuse developed by the CJEU, which requires the existence of both an objective and a subjective component.

In this regard, the EDPB recalls the Court of Justice settled case law that proof of an abusive practice requires, first, a combination of objective circumstances in which, despite formal observance of the conditions laid down by the EU rules, the purpose of those rules has not been achieved and, second, a subjective element consisting in the intention to obtain an advantage from the EU rules by artificially creating the conditions laid down for obtaining it 128. This is also recognised by the BE SA in the Draft Decision129. 87 Furthermore, the EDPB highlights that in the Brillen Rottler ruling130, building on its previous case law131, the Court clarified the reasoning to be followed for the assessment of the abuse specifically in the context of the right of access under Article 15 GDPR. With regard to the objective component of the abuse, which requires to verify whether the purpose of the legal provisions at stake has been achieved, the Court explained, in summary, that the aim of Article 15 GDPR is to confer on a data subject the right of access to personal data which have been collected concerning him or her and to exercise that right easily and at reasonable intervals132.

On the basis of this, the Court held that, formally speaking, request for access submitted by the data subjects could constitute an implementation of this right in order to achieve the purpose of those rules 133 and therefore considered that the objective component of the abuse did not seem to be present. However, the Court formal observance of the conditions for applying Article 15 of the GDPR does not, in itself, make it possible to rule out the existence of an abuse of rights 134. 88 The Court therefore moved on with the assessment of the subjective component of the abuse. In line with its previous case law135, the Court reiterated in the Brillen Rottler ruling136 that, in order to be able to characterise a Article 12(5) GDPR, the controller must establish, having regard to all the relevant 127 Judgment of the Court of Justice of 9 January 2025, in case Österreichische Datenschutzbehörde v F R, C-416/23, ECLI:EU:C:2025:3, paragraphs 50 and 59.

KG v TC, C 526/24, ECLI:EU:C:2026:216, paragraph 38. 133 Judgment of the Court of Justice of 19 March 2026, in case Brillen Rottler GmbH & Co. KG v TC, C 526/24, ECLI:EU:C:2026:216, paragraph 38. 134 Judgment of the Court of Justice of 19 March 2026 in case Brillen Rottler GmbH & Co. KG v TC, C 526/24, ECLI:EU:C:2026:216, paragraph 39. 135 Judgment of the Court of Justice of 9 January 2025 in case Österreichische Datenschutzbehörde v F R, C-416/23, ECLI:EU:C:2025:3, paragraphs 49, 50 and 56. 136 Judgment of the Court of Justice of 19 March 2026 in case, Brillen Rottler GmbH & Co. KG v TC, C 526/24, ECLI:EU:C:2026:216. ify a complaint as 'excessive', it is required to demonstrate the existence of an abusive 's 's reasoning went on to state that request for access as 'excessive' in line with European Data Protection Board circumstances of each case, that there has been an abusive intention on the part of the data subject 137.

89 It is against this legal framework that the EDPB is called to assess the circumstances at stake in this case. The EDPB considers that there is clear guidance provided by the CJEU with regard to the reasoning that should be followed when assessing the existence of an alleged abuse of rights within the meaning of the general EU law principle prohibiting such abuse. 90 In this respect, the EDPB notes that the BE SA's reasoning in the Draft Decision is supported by the Controller who argues that there was indeed an abuse of rights 138. According to VRT, the Complaint does not concern a data subject pursuing their own interests as a user of the VRT website who believes their personal data have been processed unlawfully and would therefore have contacted NOYB to be represented by them 139. It also argues that the findings regarding VRT's cookie banner stated in the Complaint were carried out on behalf of and under the instructions of NOYB and are therefore directly attributable to NOYB140.

91 In VRT's view, NOYB has been given a very general and broad mandate by the Data Subject to represent them pursuing complaints before SAs regarding the subject matter of 'illegal processing activities because of an unlawful consent banner' which makes no reference to the VRT website 141. 92 VRT also points out that the Data Subject i~ native speaker with residence - ' consulting the website in Dutch from Austria while conducting a traineeship on behalf of NOYB and considers it highly questionable if this person would have a genuine interest in consulting the website 142. 93 The EDPB also takes note of the submissions of the Complainant, who supports the objection raised by the AT SA and underlines that the Complaint was filed with an SA to raise a violation of the GDPR, which is the core purpose of Article 77 GDPR. This would mean the objective element of an abuse of law is therefore not given in relation to Article 77 GDPR because Article 77 GDPR is used for the exact purpose it was drafted for143.

94 NOYB puts forward that there is no abusive intention but only the intention to bring a GDPR infringement to the attention of the SA 144 and claims that there is no 'other purpose, unconnected with the protection of those [GDPR] rights' in the case of the Complainant145. 95 NOYB argues that neither the Data Subject nor NOYB obtain an advantage from the EU rules (such as tax reduction, subvention, leniency, possibility to return a product) by complaining about an infringement 146 . They consider that pursuing general policy interests cannot reasonably be considered as an advantage, as it is rather an attempt to put an end to a violation of the fundamental right to data protection of the data subject, and a decision favourable to the Complainant is rather the expected result of the GDPR being properly 137 Judgment of the Court of Justice of 19 March 2026 in case Bri//en Rottler GmbH & Co.

KG v TC, C-526/24, ECLl:EU:C:2026:216, paragraph 40. 4. 4. 4. 5. 6. 143 NOYB's Article 65 submissions of 12 January 2026, paragraph 163. 144 NOYB's Article 65 submissions of 12 January 2026, paragraph 166. 145 NOYB's Article 65 submissions of 12 January 2026, paragraph 167. 146 NOYB's Article 65 submissions of 12 January 2026, paragraph 168. 20 I Adopted European Data Protection Board 21 | Adopted enforced. In their view, compliance with the law cannot be considered an advantage under the rule of law147. 96 Next, NOYB argues in essence that the Data Subject should not be required to justify why they visited the C publicly available website, as this would lead to a reversal of the burden of proof where the Data Subject would only have rights if they visited the website for a correct reason148. NOYB also points out that there is no general European law principle that test or model cases are unlawful and considers that none of the constitutive elements of the abuse of right are fulfilled149.

99 First, in so far as the objective component of the alleged abuse is concerned, the EDPB notes that the relevant EU law provisions to take into account for the assessment of the alleged abuse are Article 77 GDPR and Article 80(1) GDPR. This is also explicitly stated by the BE SA in the Draft Decision151 and recognised by the AT SA Objection152. The main purpose of these provisions is, first, to enable a data subject to lodge a complaint with a supervisory authority where they consider that the processing of their personal data infringes the GDPR; and, secondly, to allow a data subject, where they consider that their rights under the GDPR are infringed, to mandate a representative meeting the conditions of Article 80(1) GDPR to lodge the complaint on their behalf. 100 The EDPB also takes note of the BE ew that there are sufficient elements to conclude that the objective element of the alleged abuse is present due to the artificial construction of the complaint and the fact that the initiative for lodging the complaint lied with NOYB153.

NOYB's Article NOYB's Article NOYB's Article NOYB's Article ontroller's SA'svi 'procedures are stable, professionally run and[ ... ] just see the Ii European Data Protection Board 22 | Adopted consisted of targeting controllers on the basis of pre-defined criteria and the use of automated means155. 101 However, considering that, in the present case, the Data Subject has successfully mandated an organisation under Article 80(1) GDPR to file a complaint on their behalf under Article 77 GDPR156, the EDPB takes the view that the objective component of the abuse is absent since not only have the conditions laid down by the EU rules been formally observed, but the aim pursued by these rules also appears to have been fulfilled. e. an abusive intention to obtain an advantage other than fulfilling the purpose of the legal provisions at stake. 103 In order to assess the subjective element of the alleged abuse, the EDPB needs to assess whether by filing the complaint under Article 77 GDPR in conjunction with Article 80(1) GDPR, the Complainant sought to rely on these provisions not with a view to achieving their objectives, but with the aim of obtaining an undue advantage from them.

104 The EDPB notes that the BE SA in the Draft Decision makes a clear distinction between the objectives pursued by the Data Subject and the objectives pursued by their representative (NOYB) and takes the view that the actor of the alleged abuse is NOYB157. The EDPB also notes that VRT shares the BE SA 158. 105 However, given that Article 77 GDPR and Article 80(1) GDPR are both phrased to refer to a right of the data subject, the EDPB takes the view that the objectives pursued by the Data Subject should not be distinguished from that of NOYB, considering that NOYB acts on behalf of the Data Subject. In this regard, the EDPB also takes into account that the Data Subject explicitly submitted on 7 January 159. 106 In addition, the EDPB recalls that, in line with the CJEU case law, in order for an SA to be able to refuse the benefit of a right conferred by EU law due to an alleged abuse of rights, it should be able to sufficiently demonstrate the existence of such abuse, since it bears the burden of proof160.

107 The EDPB takes note of the BE policy objectives are linked to interests other than those of the individual Data Subject, such as strategic objectives of the board or the wishes of donors161 but finds no concrete evidence supporting this view. 5 65 submissions of 12 January 2026, paragraph 73 where NOYB explains that the Data Subject (being native speaker) lik 65 submissions of 12 January 2026, by the Data Subject, which pre-scanned websites and collected evidence of the visit, but the Data Subject was the one taking all crucial acts. 156 The EDPB underlines that in the present case the validity of the mandate was not disputed in itself. The EDPB also recalls the need for SAs to assess the validity of the mandate in light of Art. 80(1) GDPR and relevant national law. 157 Draft Decision, paragraphs 39-40. 158 See paragraph 91 of this Binding Decision 160 See for example Judgment of the Court of Justice of 9 January 2025 in case Österreichische Datenschutzbehörde v F R, C 416/23, ECLI:EU:C:2025:3, paragraph 50; By analogy, see also Art.

57(4) GDPR. 161 Draft Decision, paragraph 22. 162 NOYB 65 submissions of 12 January 2026, paragraph 68. 'sview 2026 that they 'personally consider [their] data protection rights to have been violated' and are 'seeking redress for the violation of these rights', and that the 'page visit and the complaint[ ... ] were based on [their] decision' SA's view that NOYB's NOYB's position on this matter which argues that ' See also NOYB's Article - ely looked at the 'most visited' list ■■■■Belgian Websites' and NOYB's Article paragraphs 97 and 197 where NOYB explains the use of NOYB's software 's Article European Data Protection Board 23 | Adopted and that having a personal interest in furthering the cause of [NOYB]is a precondition to be a volunteer with [NOYB] 163. 108 It appears, on the basis of the information available to the EDPB, including the submissions of the Complainant, that the interest in filing the Complaint was to bring the alleged infringement by the Controller to the attention of the competent SA, provide it with sufficient evidence thereof and put an end to this alleged infringement.

In this regard, the EDPB finds it particularly relevant that as underlined by the AT SA - during a complaint procedure, certain evidence must be provided by the complainant and in the context of a website visit, such evidence can only be submitted if screenshots and logfiles are created at the very time of visiting the website164. The EDPB considers that some complainants may have an interest in requiring technical assistance to provide such evidence165. 109 The EDPB agrees with the AT view that it is apparent from Article 80(1) GDPR that organisations like NOYB are established precisely for the purpose of contributing to the effective protection of personal data166. 110 Based on the documents available to the EDPB, there are insufficient elements to conclude that NOYB has pursued its own interests and not those of the Data Subject, or that the Data Subject has been instructed on how to act without being part of the initiative behind the complaint.

111 The ability to file a complaint with professional assistance and representation by NOYB fits with the intended purpose of Article 77 GDPR and Article 80(1) GDPR, and nothing demonstrates that it allows the Complainant to obtain an undue benefit beyond achieving that purpose. More specifically, neither the BE SA nor the Controller demonstrate that a compensation under Article 82 GDPR or any other financial benefit has been sought. 112 For all these reasons and on the basis of the information available167, the EDPB considers that, in this case, the Complainant did not abuse their right to lodge a complaint under Article 77 GDPR and their right to representation under Article 80(1) GDPR. 113 Therefore, the EDPB decides that the BE SA should not dismiss the Complaint on the basis of abuse of law, and orders the BE SA to assess the Complaint on its merits with a view to submitting, in accordance with Article 60(3) GDPR, a new draft decision to the CSAs.

114 Consequently, the EDPB instructs the BE SA to inform the controller about the outcome of this dispute resolution procedure and about the envisaged next steps168 within one month from the notification of this Binding Decision169. The same communication has to be sent to the Complainant by the AT SA170. 5 Binding Decision 163 NOYB 65 Submissions of 12 January 2026 , paragraph 77. 5. 165 This was also argued in NOYB Submissions to the EDPB of 26 March 2026, p. 2, paragraph 5. 166 AT SA Objection, p. 5. 167 Which does not include evidence justifying a different conclusion. 168 See also Judgment of the General Court of 29 January 2025, in Joined cases Data Protection Commission v European Data Protection Board,T-70/23, T-84/23 and T-111/23, OJ C 127 paragraphs 36 and 45. The EDPB considers that, in the present case, a partial decision, which would be limited to the conclusion that the Complaint is not dismissed on the basis of abuse of law, would not be strictly necessary, without prejudice to national law and practice.

120 The BE SA and the AT SA shall inform the Board of the date when the communication or partial decision specifying that the Complaint will be assessed on the merits171 is notified to the Controller and to the Complainant172. This Binding Decision will be made public pursuant to Article 65(5) GDPR without delay after this information173. 121 The BE SA and/or the AT SA, as the case may be, will communicate its final decision to the Board 174 . Pursuant to Article 70(1)(y) GDPR, the BE SA /AT communicated to the EDPB will be included in the register of decisions which have been subject to the consistency mechanism. For the European Data Protection Board The Chair (Anu Talus) 171 See footnote 168. 172 Art. 65(6) and 77(2) GDPR. 173 Art. 65(5) and (6) GDPR. 174 This refers to the final decision on the merits, adopted pursuant to Art. 60(7), 60(8) and 60(9) GDPR. 's SA's final decision European Data Protection Board