The CJEU’s pronouncements help in a correct reading of regulatory requirements, shedding light on aspects that have raised doubts by national courts in member states.
This roundup often offers an interesting insight into data protection regulation on different profiles.
CJEU
The Court, which is based in Luxembourg, has among its main powers to
- interpreting the law of the Union through preliminary rulings
- settling legal disputes between governments and institutions
- ruling as an appellate court on matters of law concerning decisions made by the so-called European Court.
European Court
The European General Court – a judicial body together with the CJEU – is a court of first instance. It has jurisdiction, among other things, to hear appeals by individuals against the institutions of the Union; as in the case of appeals by companies against decisions of the EDPS or EDPB or the EU Commission itself. See, for example, the appeals by Single Regulation Board against the EDPS or Meta against the EDPB, discussed below.
As mentioned, decisions of the Court can be appealed within two months to the CJEU on points of European Law.
Preliminary rulings of the CJEU
The CJEU’s interpretive activity is promoted by national courts-which are responsible for the correct application of EU law in their own legal system-through instances of preliminary rulings:
- on aspects of the law about which there are doubts of interpretation
- on the compatibility of national law with EU law.
The Court responds to the national courts’ questions with decisions that, even though they refer to the particular case, have general legal force. It is up to the national referring court to decide on the merits of the relevant dispute, applying the principle of law that is the subject of the CJEU’s decisions.
Appeals of European Court decisions
Two European General Court decisions that have raised clamor – T-557/20, CRU v. EDPS and T-709/21 WhatsApp Ireland v. EDPB – have been appealed to the CJEU.
T-557/20
Decision T-557/20 concluded that the determination of whether pseudonymized data provided to a third party can be framed as “personal data” requires a case-by-case assessment of the reasonable likelihood of the third party’s use of appropriate means to re-identify data subjects.
The two most innovative and relevant profiles raised by the Court concerned:
- the rejection of the automatic equation “pseudonym = personal data,” replaced by an assessment of the objective circumstances of the individual case
- the emphasis on the importance of putting oneself in the perspective of the third party receiving the pseudonymized data when making this assessment.
The EDPS appealed the Tribunal’s decision on July 5, 2023, seeking its full annulment on the grounds that it misinterpreted the law (in the case, Regulation 2018/1725, but also extendable to the specular GDPR regulation) as
- the court of first instance allegedly failed to consider the definition of “pseudonymization” by placing the burden on EDPS to assume the perspective of the recipient in ascertaining the “personal data” nature of the information at issue
- the principle of accountability would have been disregarded, as the court would have placed the burden on the authority to prove that the controller had actually anonymized (or not) the personal data it was processing.
T-709/21
In Case T-709/21, between WhatsApp Ireland Ltd. and EDPB, WA had challenged before the court of first instance the binding decision of the EDPB regarding the decision of the lead supervisory authority (in this case, the Irish one) to which the other national authorities involved had raised relevant and reasoned objections. The EDPB’s binding decision concerned the determination of the fines that the Irish authority intended to apply, which was deemed incorrect by the European Committee in application of the criteria of effectiveness, proportionality and dissuasiveness, dictated by the regulation.
The Court had dismissed WA’s appeal as inadmissible, in short, because:
- although the EDPB is a Union body with legal status, and although in this case it is a “binding decision” that produces legal effects vis-à-vis third parties (essential elements for the right to judicial action)
- the measure of the EDPB is not addressed to the plaintiff WA, nor does it change its legal situation because, unlike the final decision of the Irish authority, it cannot be enforced directly against WA and is only a preparatory or intermediate act in proceedings; on the contrary, the criterion of the change of the plaintiff’s legal situation is fulfilled in relation to the final decision of the supervisory authority, of which the undertaking itself is an addressee (see T-709/21, p. 42).
As a result, according to the Court, “WA is not directly affected by the appealed decision” and, therefore, does not have standing to take legal action against it.
On February 17, 2023, WA appealed the EU Tribunal’s order of 7/12/2022 arguing that the Tribunal misinterpreted the notion of ” appealable act” and “binding decision”.
