CJEU - T‑183/23 - Ballmann v European Data Protection Board

Facts — The ruling relates to the procedural aspects of a cross-border case involving Meta Platforms Ltd. The full summary for the case is available here. Context: The case against Meta — In May 2018 a Facebook user (the complainant) lodged a complaint against Meta Platforms Ireland Ltd with the Austrian DPA. In her complaint, she claimed that the collection of personal data via Facebook violated several rules of the GDPR, including Articles 6 and 9. Short after the complaint was filed, the Austrian DPA held that the case was cross-border in nature and forwarded the complaint to the Irish DPA as the lead supervisory authority. In 2021 the Irish DPA submitted a draft decision to all EEA supervisory authorities. Some of them raised “reasoned and relevant objections” to the draft within the meaning of Article 4(24) GDPR. The DPC decided not to follow some of those objections and, therefore, referred the matter to the EDPB under the GDPR’s consistency mechanism.

The EDPB decided the matter in December 2022 with its Binding Decision 3/2022. Following the Binding Decision, the Irish DPA decided the complaint and fined Meta €210,000,000 over the unlawful processing of personal data for targeted advertising on Facebook. The case against the EDPB — After the dispute resolution procedure of the EDPB the complainant requested access to the case file relating to her complaint. She invoked several provisions of EU primary and secondary law, including Article 41(2)(b) of the EU Charter of Fundamental Rights (“Right to good administration”). The EDPB replied with an email to the complainant (from now on: “the Contested Decision”), granting the complainant access to some of the documents relative to the procedure based on EU Regulation 1049/2001. However, the EDPB held that the complainant had no right of access under Article 41(2)(b) CFREU. As a result, the EDPB only granted the complainant access to parts of the file.

The complainant considered that the EDPB violated her rights and filed an action for the annulment of the contested decision under Article 263 TFEU. The complainant claimed that under Article 41(2)(b) CFREU, she had a right to access the EDPB case file in relation to her complaint. On this ground, she requested that the Court of Justice (General Court) set aside the Contested Decision. The EDPB, in turn, requested that the Court declare the complainant’s action inadmissible or, in the alternative, unfounded. Meta was granted the status of intervening party and put forwards the same demands as the EDPB. Holding — The Court upheld the complainant's demands and annulled the contested decision from the EDPB. The action was admissible — First, the Court held that the action was admissible. In this regard, the Court considered that the contested decision "contains a refusal to grant access to the file requested" under Article 41(2)(b) CFREU.

It "immediately and irreversibly affects the applicant’s legal position" to access the EDPB case file. According to the settled case law of the CJEU, it follows that the complainant could bring an action for annulment under Article 263 TFEU. In response to an argument from the EDPB, the Court also clarified that it was not relevant that the contested decision acknowledged the complainant's limited right of access under Regulation 1049/2001. In the case at hand, the complainant would have had a broader right of access under Article 41(2)(b) CFREU than she did under the Regulation (as the EDPB itself conceded). The right of access is independent from the right to be heard — The parties put forward different interpretations of Article 41 CFREU – in particular, with regard to the relationship between paragraphs (2)(a) and (2)(b) of the provision. The EDPB claimed that paragraph (2)(a) and (2)(b) embody corollary aspects of the rights of the defence.

In this interpretation, the complainant’s right of access was not protected under paragraph (2)(b) because the requirements of paragraph (2)(a) (being adversely affected), was not fulfilled. Therefore, the EDPB claimed the contested decision rightfully denied access to the file. The complainant claimed that the two paragraphs are independent from each other and embody autonomous rights. In other words: proving that the file concerned her, should have been sufficient grounds for accessing the file. The Court confirmed the complainant’s interpretation: “everyone has the right of access to his or her file based on Article 41(2)(b) of the Charter, including where that file is not linked to a procedure liable to culminate in a measure adversely affecting him or her” . Therefore, the EDPB erroneously applied the requirements of Article 41(2)(a) CFREU to the right to access the file under Article 41(2)(b) CFREU, as the complainant claimed.

The file concerned the complainant — After clarifying the interpretation of Article 41 CFREU, the Court assessed whether the file for the Article 65 GDPR procedure concerned the complainant. The Court held that even though the complainant is not a formal party to the procedure under Article 65(1)(a) GDPR, the complaint plays an essential role in that procedure as it constitutes the starting point of the entire decision-making process. The Court also pointed out that the relevant and reasoned objections (of supervisory authorities concerned) form part of the procedure initiated following the complaint. In particular, these objections determine the scope of the EDPB’s binding decisions under Article 65(1)(a) GDPR. For this reason, a complainant may legitimately want to ascertain whether elements of the complaint were reproduced in the objections or the extent they have been taken into account in the binding decision.

Finally, the Court held that complainants have a direct interest in the outcome of procedure, as it relates to the processing of their personal data. For these reasons, the Court held that in the case at hand, the EDPB’s file “concerned” the complainant. In consequence, the Court annulled the contested decision. Holding — The Court upheld the complainant's demands and annulled the contested decision from the EDPB. The action was admissible — First, the Court held that the action was admissible. In this regard, the Court considered that the contested decision "contains a refusal to grant access to the file requested" under Article 41(2)(b) CFREU. It "immediately and irreversibly affects the applicant’s legal position" to access the EDPB case file. According to the settled case law of the CJEU, it follows that the complainant could bring an action for annulment under Article 263 TFEU. In response to an argument from the EDPB, the Court also clarified that it was not relevant that the contested decision acknowledged the complainant's limited right of access under Regulation 1049/2001.

In the case at hand, the complainant would have had a broader right of access under Article 41(2)(b) CFREU than she did under the Regulation (as the EDPB itself conceded). The right of access is independent from the right to be heard — The parties put forward different interpretations of Article 41 CFREU – in particular, with regard to the relationship between paragraphs (2)(a) and (2)(b) of the provision. The EDPB claimed that paragraph (2)(a) and (2)(b) embody corollary aspects of the rights of the defence. In this interpretation, the complainant’s right of access was not protected under paragraph (2)(b) because the requirements of paragraph (2)(a) (being adversely affected), was not fulfilled. Therefore, the EDPB claimed the contested decision rightfully denied access to the file. The complainant claimed that the two paragraphs are independent from each other and embody autonomous rights.

In other words: proving that the file concerned her, should have been sufficient grounds for accessing the file. The Court confirmed the complainant’s interpretation: “everyone has the right of access to his or her file based on Article 41(2)(b) of the Charter, including where that file is not linked to a procedure liable to culminate in a measure adversely affecting him or her” . Therefore, the EDPB erroneously applied the requirements of Article 41(2)(a) CFREU to the right to access the file under Article 41(2)(b) CFREU, as the complainant claimed. The file concerned the complainant — After clarifying the interpretation of Article 41 CFREU, the Court assessed whether the file for the Article 65 GDPR procedure concerned the complainant. The Court held that even though the complainant is not a formal party to the procedure under Article 65(1)(a) GDPR, the complaint plays an essential role in that procedure as it constitutes the starting point of the entire decision-making process.

The Court also pointed out that the relevant and reasoned objections (of supervisory authorities concerned) form part of the procedure initiated following the complaint. In particular, these objections determine the scope of the EDPB’s binding decisions under Article 65(1)(a) GDPR. For this reason, a complainant may legitimately want to ascertain whether elements of the complaint were reproduced in the objections or the extent they have been taken into account in the binding decision. Finally, the Court held that complainants have a direct interest in the outcome of procedure, as it relates to the processing of their personal data. For these reasons, the Court held that in the case at hand, the EDPB’s file “concerned” the complainant. In consequence, the Court annulled the contested decision.