This document is an excerpt from the EUR-Lex website
Document 62023CC0097
Opinion of Advocate General Ćapeta delivered on 27 March 2025.###
Opinion of Advocate General Ćapeta delivered on 27 March 2025.
Opinion of Advocate General Ćapeta delivered on 27 March 2025.
ECLI identifier: ECLI:EU:C:2025:210
OPINION OF ADVOCATE GENERAL
ĆAPETA
delivered on 27 March 2025 (1)
Case C‑97/23 P
WhatsApp Ireland Ltd
v
European Data Protection Board
( Appeal – Protection of personal data – Regulation (EU) 2016/679 – Article 65 – Consistency mechanism – Dispute resolution by the European Data Protection Board – Action for annulment – First paragraph of Article 263 TFEU – Concept of ‘challengeable act’ – Fourth paragraph of Article 263 TFEU – Concept of ‘direct concern’ – Concepts of ‘preparatory act’ and ‘intermediate act’ – Question of the ‘non-enforceability’ of a decision against a natural or legal person – Discretion of the body implementing that decision )
I. Introduction
1. The present appeal raises the perennial question of the interpretation and application of the conditions for the admissibility of an action for annulment brought by applicants who are natural or legal persons. More specifically, the case concerns the concepts of ‘challengeable act’, for the purpose of the first paragraph of Article 263 TFEU, and of ‘direct concern’, within the meaning of the fourth paragraph of Article 263 TFEU.
2. That question arises in the context of the consistency mechanism provided for in Regulation (EU) 2016/679. (2) That mechanism consists of a composite procedure involving the participation of national supervisory authorities and the European Data Protection Board (EDPB).
3. In the order under appeal, the General Court considered inadmissible an action brought by WhatsApp Ireland Ltd (‘WhatsApp’ or ‘the appellant’) against Binding Decision 1/2021 (‘the contested decision’),(3) an EDPB decision adopted within the context of that mechanism. (4) Hence the present appeal. (5)
4. Beyond the appeal in this specific case, the Court of Justice has the opportunity to explain more generally how the rules on the admissibility of actions for annulment are to be applied to composite procedures.
II. Background
5. The present case arises out of the consistency mechanism introduced by the GDPR. More specifically, it concerns the part of that mechanism, provided for in Article 65 of the GDPR, according to which the EDPB is granted the power to adopt binding decisions by which it resolves certain types of disputes that arise among national supervisory authorities when they enforce the rules of the GDPR.
6. The consistency mechanism is one of numerous ‘composite administrative procedures’ established by EU secondary law. (6)
7. That term is used to describe procedures in which decision-making occurs in multiple steps, involving both EU and national institutions or bodies. (7)
8. One of the legal issues that arise in relation to such procedures is how to determine which of the acts adopted by multiple actors throughout that procedure constitute ‘challengeable acts’, and then before which courts such acts should be challenged. (8)
9. The present appeal must be placed in that context. The appellant considers that the General Court erroneously ruled that the contested decision, adopted under the consistency mechanism, is not an act challengeable before the EU Courts.
A. The GDPR’s consistency mechanism
10. The task of monitoring and enforcing the rules of the GDPR is entrusted to the various supervising authorities of the Member States within their respective territories. (9)
11. To tackle the possible fragmentation in the implementation of data protection rules across the European Union that may result from such a ‘decentralised’ system, the GDPR provides for cooperation between national supervisory authorities. (10)
12. When a data processing operation has a cross-border dimension, the authority in charge of the processor or controller at issue – the lead supervisory authority (LSA) – must circulate its draft decision enforcing the rules of the GDPR against the processor or controller under its competence to the concerned supervisory authorities of other Member States.
13. If those other authorities agree with the interpretation of the GDPR and with the enforcement measures proposed by the LSA, the latter may adopt its final decision, which is binding on the controller or processor at issue.
14. However, if those other supervisory authorities express relevant and reasoned objections with which the LSA disagrees or considers them not to be relevant or reasoned, the LSA must submit the matter to the EDPB for the latter to take a decision. (11)
15. The EDPB adjudicates the dispute between the national supervisory authorities involved and resolves that individual case by means of a binding decision. (12)
16. According to Article 65(2) of the GDPR, that decision is addressed to and binds the LSA and all the other supervisory authorities concerned. (13) The decision is also published on the EDPB’s website. (14)
17. Within prescribed deadlines (15) and on the basis of that binding EDPB decision, the LSA must adopt its final decision, (16) which is then notified to the controller or processor at issue.
B. Events leading to the present case
18. WhatsApp is a company that provides internet-based calling and messaging services (‘the messaging service’).
19. In order to create an account with that company for the use of that messaging service, a user must agree to its terms of service and its privacy policy. (17)
20. On 24 May 2018, WhatsApp changed its privacy policy to take account of changes introduced by the GDPR, which was to apply from 25 May 2018. (18) Existing users were presented with the option of accepting those changes or discontinuing their use of the appellant’s messaging service.
21. Thereafter, the Irish Data Protection Commission (‘the Irish supervisory authority’) received a number of complaints from individual data subjects concerning the appellant’s data processing activities. (19)
22. In December 2018, and following a preliminary assessment of the complaints, the Irish supervisory authority initiated an inquiry into whether WhatsApp had discharged its GDPR transparency obligations, under Articles 12 to 14 thereof, with regard to the provision of information to both users and non-users of its messaging service and the transparency of that information. (20)
23. As WhatsApp’s messaging service entails cross-border processing throughout the European Union, in line with its obligations arising from the GDPR, the Irish supervisory authority circulated its draft decision to the other national supervisory authorities concerned. (21)
24. In response, the Irish supervisory authority received objections from the supervisory authorities of Germany (at Federation level), Hungary, the Netherlands, Poland, France, Italy, Portugal and the German Federal State of Baden-Württemberg. (22) Additionally, a number of comments on that draft decision were received from the supervisory authorities of Austria, the Netherlands, Denmark, Poland, Belgium, France and the German Federal State of Hamburg. (23)
25. Since a number of supervisory authorities expressed relevant and reasoned objections to the draft decision with which the Irish supervisory authority did not agree, the latter referred the objections to the EDPB for resolution. (24)
26. On 28 July 2021, the EDPB adopted the contested decision and subsequently notified the Irish and other concerned supervisory authorities. (25)
27. In the contested decision, the EDPB instructs the Irish supervisory authority to alter a number of the findings contained in the draft decision and to increase the fines proposed therein.
28. In essence, the contested decision requires the Irish supervisory authority to find that ‘lossy hashed data’ (26) constitutes personal data within the meaning of Article 4(1) of the GDPR (27) and that the appellant breached the transparency rules of Article 5(1)(a), Article 13(1)(d) and (2)(e) and Article 14 of that regulation. (28)
29. In terms of procedural findings and fines, the contested decision requires that the appellant’s compliance period be reduced from six months to three months, claims that the Irish supervisory authority had misinterpreted the criterion relating to the quantum of the fines and states that the amounts of the fines envisaged by that authority should be increased. (29)
30. Acting on those instructions, the Irish supervisory authority altered its draft decision and adopted the final national decision on 20 August 2021. (30)
31. On 1 November 2021, the appellant brought an action before the General Court requesting the annulment of the contested decision.
32. On 7 December 2022, the General Court made the order under appeal, rejecting the appellant’s action as inadmissible.
33. In that order, the General Court considered, in essence, that the contested decision did not constitute a challengeable act for the purpose of the first paragraph of Article 263 TFEU and that the appellant was not directly concerned with that decision, within the meaning of the fourth paragraph of Article 263 TFEU.
34. The order under appeal is structured as follows.
– In paragraph 40, the General Court finds that the contested decision concerns the appellant individually.
– In paragraphs 42 to 49, that court addresses the issue of whether the contested decision constitutes a challengeable act for the purpose of the first paragraph of Article 263 TFEU, and concludes that it does not.
– In paragraphs 50 to 65, it examines whether the contested decision is of direct concern to the appellant within the meaning of the fourth paragraph of Article 263 TFEU. It concludes that it does not directly affect the appellant’s legal position and that it left discretion to the Irish supervisory authority such that the conditions for direct concern are not met.
– Concluding, therefore, against the admissibility of the appellant’s action for annulment, the General Court, in paragraphs 66 to 71, additionally explains how its finding is consistent with the logic of the system of judicial remedies established by the Treaties.
C. Procedure before the Court of Justice
35. By its appeal lodged on 17 February 2023, the appellant requests that the Court of Justice set aside the order under appeal, find the action admissible, refer the case back to the General Court to decide on the substance of the matter, and order the EDPB to pay the costs.
36. The German Government intervened in support of the EDPB.
37. A hearing was held on 26 November 2024 at which the appellant and the EDPB presented oral arguments.
III. Analysis
38. The appellant puts forward two grounds of appeal. By its first ground of appeal, it claims that the General Court misinterpreted the concepts of challengeable act, as arising from the first paragraph of Article 263 TFEU, and of direct concern, as contained in the fourth paragraph thereof. That error resulted in the misapplication of Article 263 TFEU in the case at hand, leading the General Court to incorrectly qualify the contested decision as not being an act challengeable by the appellant. By its second ground of appeal, the appellant claims that the General Court misinterpreted and incorrectly applied Article 65(1) of the GDPR in relation to the contested decision.
39. In this Opinion, I shall propose to the Court of Justice that it find that the General Court incorrectly applied the analysis that is required under the first and fourth paragraphs of Article 263 TFEU to the consistency mechanism established by the GDPR. The first ground of appeal should thus be upheld and the order under appeal set aside. For that reason, it is not necessary to deal with the second ground of appeal.
40. Beyond the immediate context of the present appeal, however, I observe that this case also raises an issue of a more horizontal nature: that is, the question of which analytical steps should be followed in order to determine the admissibility of an action for annulment brought against an act taken in the course of a composite procedure.
41. Composite procedures vary considerably, each being specifically designed by the EU secondary act introducing them to fit the purpose which that particular procedure fulfils in a given area of administrative decision-making based on EU law.
42. If the analytical steps in determining the admissibility of actions for annulment by natural or legal persons against acts taken in such procedures are misunderstood, there is a likelihood that, in future cases relating to different types of composite procedures, the General Court would again unjustifiably deny such persons access to the EU Courts.
43. However, the conditions governing Article 263 TFEU remain the same, notwithstanding those different structures. Accordingly, the general rules on the admissibility of actions introduced by natural or legal persons against acts adopted within a composite procedure should be applied in the same way – using the same analytical steps – to all such composite procedures, all the while taking into consideration the particularities of each procedure.
44. As I will try to show in my analysis, the General Court, inspired by the particularities of the GDPR consistency mechanism, introduced some unnecessary (and misleading) analytical steps into its assessment of the conditions for admissibility under Article 263 TFEU. In my view, for instance, asking whether the contested decision is an intermediary act within that procedure detracts from the relevant question of whether that decision is a final and binding act, which is the only appropriate question to ask in the context of an analysis to be undertaken under the first paragraph of Article 263 TFEU. Similarly, the inquiry into whether the contested decision can be enforced directly against the appellant detracts from the analytical question of whether that decision in itself affects the appellant’s legal position, as required by the fourth paragraph of Article 263 TFEU.
45. When it justifies its finding of (in)admissibility in a specific case, the Court of Justice often refers to the particularities of the composite procedure that was at issue in the case at hand and not rarely distinguishes those particularities from the characteristics of another procedure in which it arrived at a different conclusion. (31) Any such explanations of the Court cannot be generalised and mechanically transposed to new cases. (32)
46. The General Court relied in its analysis on several judgments of the Court of Justice, especially the judgments in IBM (33) and Deutsche Post. (34)
47. I will suggest to the Court of Justice that it revisit some of those judgments and clarify that certain statements made therein were not intended to add to the conditions established by the FEU Treaty. Rather, their purpose was to explain the application of the Treaty rules to the particular situation underlying those cases. The automatic reproduction in later judgments, which arise out of different circumstances, of the statements made by the Court in earlier cases might lead – as it did in the present case – the General Court to arrive at an incorrect conclusion on the admissibility of an action for annulment.
48. Accordingly, the present case offers the possibility to the Court of Justice to explain again the analytical steps that are necessary and sufficient to establish whether an individual can introduce a direct action for annulment.
49. In that respect, I believe it is important that the Court of Justice draw a clear distinction between two analytical steps underlying the conditions for admissibility under Article 263 TFEU: first, the analysis of the question of whether an act is a challengeable act for the purpose of the first paragraph of Article 263 TFEU; and, second, where that act is challengeable, the analysis, under the fourth paragraph of Article 263 TFEU, of whether a particular applicant, who is a natural or legal person, is entitled to challenge that act.
50. In the light of the foregoing, my analysis is structured as follows. I will commence with the preliminary issue that the underlying action was not brought out of time (A). I shall then move on to the substance of the appeal to lay out why I think that the Court should annul the order under appeal. Following the structure of the first ground of appeal, I will first explain that the General Court confused the conditions for establishing whether the contested decision is a challengeable act with the conditions for finding whether the appellant is directly concerned. It is on that basis that I find that that court incorrectly concluded that the contested decision is not a challengeable act (B). I will then explain that the General Court also committed an error of law when it considered that the contested decision does not concern the appellant directly (C). Finally, I will show that, contrary to the position of the General Court, the logic of the system of judicial remedies, as designed under the Treaties and interpreted by the Court of Justice, requires that the validity of the contested decision be decided in a direct action before the EU Courts (D).
A. The case was not brought out of time
51. In its response, the EDPB claims that the appellant’s action was brought out of time. (35) The EDPB refers to a letter in the Court’s file, dated 16 August 2021, from which it appears that the Irish supervisory authority had informed the appellant already on 13 August 2021 of ‘the relevant content’ of the contested decision prior to the EDPB’s publication thereof on its website. Accordingly, the EDPB argues that the period to lodge an action for annulment would have expired on ‘25 October 2021 at the latest’, that is to say, prior to 1 November 2021, the date on which the application before the General Court was filed.
52. I consider that that argument should be rejected.
53. It is clear from the case-law that the reference, in the sixth paragraph of Article 263 TFEU, to the day on which a measure came to the knowledge of an applicant is subsidiary to the criteria of publication or notification of the same measure. (36)
54. In the present case, there has been no notification of the contested decision to the appellant. The EDPB is only under the obligation to notify its decision directly to the Irish LSA and the concerned national supervisory authorities. (37)
55. It must accordingly be determined whether the contested decision was published, within the meaning of the sixth paragraph of Article 263 TFEU.
56. Article 263 TFEU does not attach any specific conditions to the act of publication.
57. However, since the Court of Justice favoured the interpretation of the time limits prescribed by the Treaties in such a way that any undue limitation of the right to an effective judicial remedy is avoided, (38) the concept of ‘publication’ must be understood broadly. (39)
58. In that respect, the Court has already had occasion to hold that the publication on a website, where mandated by EU secondary law, satisfies the requirement of ‘publication’, as contained in the sixth paragraph of Article 263 TFEU. (40)
59. In the present case, the publication of binding decisions of the EDPB, such as the contested decision, is mandated by the third sentence of Article 65(5) of the GDPR.
60. Given that the appellant challenged the contested decision within the applicable time limits from its date of publication on the EDPB’s website (2 September 2021), the fact that it may also have been aware of the material content of that decision prior to its mandated publication is irrelevant for the purposes of the admissibility of the present action for annulment. (41)
61. In the light of the above, there is no need to determine the precise point in time at which the appellant became aware of the content of the contested decision.
62. I accordingly propose that the Court reject the EDPB’s argument that the action before the General Court was brought out of time.
B. The contested decision is a challengeable act
1. Two analytically separate issues
63. By its first and second arguments of the first ground of appeal, the appellant claims that, contrary to the position of the General Court, the question of whether an act is a challengeable act does not require an analysis of whether that act brings about a distinct change in the appellant’s legal position.
64. I agree with the appellant. The question of whether a measure is a challengeable act is different from the question of whether a concrete applicant, who is a natural or legal person, can challenge that act – provided it is a challengeable act – in the first place.
65. The question of whether an act is a challengeable act pertains to the analysis under the first paragraph of Article 263 TFEU. That requires a different and separate method of analysis, one which asks different questions from those which are relevant for establishing whether an act affects the legal position of the applicant (which pertains to the fourth paragraph of Article 263 TFEU).
66. That conclusion follows from the text, structure and history of Article 263 TFEU (a) and is not contrary to the case-law of the Court of Justice (b).
(a) The text, structure and history of Article 263 TFEU
67. There are several reasons why the assessment of the question of whether the contested decision constitutes the type of act that can be the subject of a validity assessment by the EU Courts should be separate from the question of whether that act affects the appellant’s legal position.
68. First, the determination of the type of act that can be challenged before the EU Courts is provided for in the first paragraph of Article 263 TFEU. That determination is made without regard to the person that introduces the challenge.
69. Therefore, the answer to the question of whether an act is a challengeable act must be the same, whether the action for annulment was introduced by a privileged (as enumerated in the second paragraph of Article 263 TFEU), a semi-privileged (as enumerated in the third paragraph thereof) or a non-privileged (as enumerated in the fourth paragraph thereof) applicant.
70. Second, the answer to the question of whether an act is challengeable requires an assessment of whether that act is capable of producing binding legal effects vis-à-vis a third party. (42) That party does not need to be the same as the one bringing the action for annulment in question.
71. That requirement, as I will explain below, follows from the current wording of the first paragraph of Article 263 TFEU, which is the result of several amendments, and from the case-law of the Court, which was one of the driving forces behind those changes.
72. In its current version, the first paragraph of Article 263 TFEU provides as challengeable acts (i) legislative acts, (ii) acts of the Council, of the Commission and of the European Central Bank, other than recommendations and opinions, and (iii) acts of the European Parliament and of the European Council, as well as of bodies, offices or agencies of the European Union intended to produce legal effects vis-à-vis third parties.
73. The original EEC Treaty did not enumerate the acts open to challenge but only defined them negatively, as ‘legal acts of the Commission and Council, other than recommendations and opinions’. (43)
74. As the Treaty defines recommendations and opinions as acts having no binding force, (44) the Court concluded that all acts (of the EU institutions and other bodies), notwithstanding their form or name, that are intended to have binding legal effects are challengeable acts. (45)
75. If an act does not have binding legal effects, the action is inadmissible, whether it was brought by privileged applicants or by non-privileged applicants. (46)
76. There is therefore no need to ask the subsequent question of whether the act affects the applicant’s legal position, pursuant to the fourth paragraph of Article 263 TFEU. (47)
77. It follows from the case-law and the wording of the first paragraph of Article 263 TFEU that an act is legally binding if it is intended to produce legal effects vis-à-vis third parties. What does that mean?
78. To be considered as having binding legal effects vis-à-vis third parties, an act must have legal effects outside of the institution or body that adopted it. If the act creates obligations only ‘internally’, that is to say for the same institution that adopted it, but not ‘externally’, that is, for third parties, that act does not constitute a challengeable act. (48)
79. The third party for which the act has legally binding effects need not necessarily be the applicant. (49)
80. The Court has further clarified that an act has effects outside of the institution only if, by that act, that institution that adopted it expressed its final position. (50)
81. A position is final if the institution or body that adopted the act cannot further change it; that is to say, it could only prevent the legal effects arising from that act by revoking it. (51) If the final act is not revoked by its author, the only way its legal effects could be nullified is by that act’s invalidation in judicial proceedings.
82. On the basis of the aforementioned, that means the following for the present case: in order to decide on whether the contested decision is a challengeable act, it was necessary and sufficient that the General Court establish that the contested decision represented the EDPB’s final position and that that decision imposed an obligation on someone outside of that body; in this case, the Irish supervisory authority.
83. For that assessment, it was not necessary to assess whether or not that act also brings about a distinct change in the appellant’s legal position. The latter is a question that relates to direct concern and not to the quality of challengeable act.(52)
84. Does the case-law relied on by the General Court suggest a different conclusion?
(b) The case-law that seemingly merges the two conditions
85. In paragraph 41 of the order under appeal, the General Court explained that it must examine ‘whether the contested decision has legal effects bringing about a distinct change in WhatsApp’s legal position and whether it is of direct concern to WhatsApp within the meaning of the fourth paragraph of Article 263 TFEU’. (53)
86. The General Court’s conclusion that the assessment of whether the contested decision brings about a distinct change in WhatsApp’s legal position, on the one hand, and the assessment of whether that decision is of direct concern to that company, on the other hand, are two separate analyses to be undertaken appears to be based on the case-law that it cites, namely the judgments in IBM and Deutsche Post. (54)
87. I will therefore revisit those judgments.
88. In paragraph 9 of the judgment in IBM, the Court of Justice stated that ‘any measure the legal effects of which are binding on, and capable of affecting the interests of, the applicant by bringing about a distinct change in his legal position is an act or decision which may be the subject of an action under Article 173’. (55)
89. That wording, which was repeated in a large number of judgments that followed, by both the Court of Justice (56) and the General Court, (57) has been and might continue to be interpreted to imply that the question of whether an act constitutes a challengeable act under the first paragraph of Article 263 TFEU encompasses also the assessment of whether it affects an applicant’s legal position. (58) That is also how the General Court appears to have understood paragraph 9 of the judgment in IBM (see point 86 of this Opinion).
90. To my mind, that is not a correct (or useful) understanding of that paragraph.
91. I read paragraph 9 of the judgment in IBM as the Court of Justice’s expression – in a single sentence – of all the conditions necessary to be fulfilled if a non-privileged applicant is to gain access to the EU Courts: that it to say, those flowing from the first paragraph of Article 263 TFEU, on the one hand, and those flowing from the fourth paragraph of Article 263 TFEU, on the other hand.
92. With that sentence, the Court of Justice does not make the question of the effects of the act on the applicant a part of the assessment of the fulfilment of the conditions under the first paragraph of Article 263 TFEU. Indeed, an act may still be considered a challengeable act in general, even if it cannot be challenged in a specific case by a particular non-privileged applicant because it does not bring about a distinct change in that applicant’s legal position.
93. To my mind, the Court tried to dispel the possible confusion created by the repeatedly used phrase in the judgment in IBM in the following paragraphs of the judgment in Deutsche Post:
‘36 According to consistent case-law, developed in the context of actions for annulment brought by Member States or institutions, any measures adopted by the institutions, whatever their form, which are intended to have binding legal effects are regarded as acts open to challenge, within the meaning of Article 263 TFEU …
37 Where the action for annulment against an act adopted by an institution is brought by a natural or legal person, the Court of Justice [has] repeatedly held that the action lies only if the binding legal effects of that act are capable of affecting the interests of the applicant by bringing about a distinct change in his legal position … (59)
38 It must, however, be emphasised that the case-law cited in the paragraph above was developed in the context of actions brought before the EU judicature by natural or legal persons against measures of which they were the addressees. Where, as in the case giving rise to the order in Deutsche Post v Commission, [(60)] an action for annulment is brought by a non-privileged applicant against a measure that has not been addressed to it, the requirement that the binding legal effects of the measure being challenged must be capable of affecting the interests of the applicant by bringing about a distinct change in his legal position overlaps with the conditions laid down in the fourth paragraph of Article 263 TFEU.’
94. To my mind, in the judgment in Deutsche Post, the Court sought to clarify that paragraph 9 of its judgment in IBM pertains to a situation where a non-privileged applicant is the addressee of the challenged act. That is because, in such a situation, the answer to the question of whether an act has binding legal effects vis-à-vis third parties necessarily requires an assessment of whether that act has effects in relation to the applicant as the addressee of the act. In such a situation, the question of whether an act has binding legal effects and the question of whether it changes the legal situation of the applicant are the same question.
95. However, when the non-privileged applicant is not the addressee of the act at issue, the question of whether that act brings about a distinct change in its legal position is the question relating to direct concern, required to be assessed under the fourth paragraph of Article 263 TFEU – and not under the first paragraph thereof.
96. The often-misquoted wording, according to which the question of whether the act has legal effects bringing about a distinct change ‘overlaps’ with the requirement for direct concern in the fourth paragraph of Article 263 TFEU, in fact expresses the Court’s understanding that the question of direct concern has to be assessed separately and in addition to the question of whether the act produces binding legal effects.
97. In its more recent case-law, the Court has, after quoting paragraph 38 of the judgment in Deutsche Post, usually continued with the analysis of whether the act in question is of direct concern to the non-privileged applicant who is not an addressee of the challenged act. (61)
98. Therefore, the judgment in IBM, as explained by the judgment in Deutsche Post, should not be read as fusing the requirements under the first and fourth paragraphs of Article 263 TFEU for situations in which an act is addressed to a person other than the applicant.
99. In such a situation, that is to say, where the act is addressed to someone other than the applicant, the requirement that the act be legally binding is separate from the requirement that that act bring about a distinct change in the applicant’s legal position.
100. Here, in order to answer the question of whether the action introduced by an applicant is admissible, it is not sufficient for the act at issue to have binding legal effects on its addressee or someone else; the Court must also assess whether the act at issue affects the applicant’s legal position. That is what is required by the additional admissibility condition that results from the fourth paragraph of Article 263 TFEU.
101. In its judgment in Deutsche Post, the Court followed precisely that methodology and established, in two distinct steps, first, that the measure is legally binding, and, only thereafter, that it directly concerns the non-privileged applicant. It is also important that in the part of the analysis concerned with the question of whether the measure was legally binding, the Court did not deem it relevant to determine whether that measure was preparatory within the larger procedure in which it was enacted. (62) According to the Court, what mattered, for the purposes of that analysis, was that the decision produced independent legal effects, making it capable of forming the subject matter of an action for annulment. (63) Only after establishing that the General Court erred in law when it considered that the challenged act was not legally binding by reason of its preparatory nature, (64) the Court of Justice proceeded with the second step of its analysis, to find that that measure was also of direct and individual concern to the non-privileged applicant at issue, in that case, Deutsche Post AG. (65)
102. To my mind, therefore, the objective of the three paragraphs of the judgment in Deutsche Post cited in point 93 of the present Opinion is precisely to remove the possible confusion that arises from the judgment in IBM and to distinguish the analysis of the legally binding nature of the challenged act from the analysis of whether that act affects the legal position of the applicant.
103. In the present case, the General Court failed to distinguish between those two analytical steps. In considering that the contested decision does not, in itself, affect the appellant’s legal position, that court erroneously concluded that the contested decision does not constitute a challengeable act. In that analysis, it did not focus on the question of whether the contested decision produces legally binding effects vis-à-vis third parties. Rather, it concentrated on the question of whether that act should be viewed as intermediary from the point of view of the applicant. (66) In so doing, the General Court erred in a similar manner as it did in its order in Deutsche Post v Commission (67) many years prior, and which the Court of Justice annulled in its judgment in Deutsche Post.
104. To my mind, the question of whether an act is ‘intermediate’ or ‘preparatory’ is superfluous and unnecessarily complicates the analysis under the first and fourth paragraphs of Article 263 TFEU. As the present case shows, a dogmatic reliance on those concepts may, in fact, lead to an incorrect conclusion on the admissibility of an action for annulment. I will turn to that issue now.
2. The superfluous questions of whether an act is ‘preparatory’/‘intermediate’ and whether it is ‘enforceable’
105. In paragraph 42 of the order under appeal, the General Court considered it relevant for its assessment of admissibility that the contested decision (i) constitutes a ‘preparatory’ or ‘intermediate’ act in a procedure that must be closed by a final decision of a national supervisory authority and (ii) that that decision is not directly enforceable against the appellant.
106. Neither of those two factors – the ‘preparatory’ or ‘intermediate’ nature of the act or its direct enforceability against the appellant – are analytically relevant for answering the question of whether that act is a challengeable act for the purpose of the first paragraph of Article 263 TFEU.
107. Those factors are equally irrelevant in the assessment of whether that act is of direct concern to the appellant under the fourth paragraph of Article 263 TFEU (which I shall address in Section C below).
108. Likewise, the question of whether the act at issue is ‘final’, that is to say, whether it closes a certain composite procedure, or whether ‘another’ act of the same or different body is to follow is again not relevant for determining whether the act at issue is open to challenge. Indeed, as I explain in point 78 of this Opinion, the correct question to ask in relation to the assessment of whether an act may be challenged is whether that act produces independent legal effects – which it may only produce if it is definitive or final from the point of view of the institution or body that adopted it.
109. In the order under appeal, the General Court relied on paragraph 10 of the judgment in IBM to conclude that there exists a principle according to which intermediate acts are not acts open to challenge. (68) Having established that principle, the General Court explained that the possibility to challenge an intermediate act is an exception, which exists when that act produces independent legal effects. (69)
110. However, in paragraph 10 of its judgment in IBM, the Court of Justice laid down the following: ‘in principle an act is open to review only if it is a measure definitively laying down the position of the Commission or the Council on the conclusion of that procedure’. (70) Accordingly, the Court of Justice explained that the focus of the analysis of the challengeable nature of an act should be on the question of whether the act at issue expresses the definitive position of the institution, viewed from the perspective of that institution.
111. The judgment in IBM did not, therefore, reveal the existence of a principle according to which intermediate acts are not challengeable.
112. Furthermore, the judgment in IBM did not even concern a composite procedure, but a procedure conducted solely by the Commission. In the context of that procedure, the Court assessed the relevance of different stages of the internal procedure within the Commission to conclude that the letter that was challenged in that case did not express a definitive position of that institution. (71)
113. Thus, the term ‘intermediary’ or ‘preparatory’ may be relevant only if used in opposition to the term ‘definitive’ or ‘final’ within the internal procedure of an institution or body. (72)
114. If an act were to be understood as ‘intermediary’ and therefore not challengeable, purely by reason of its place in the composite procedure in which, from the applicant’s perspective, there will exist another act that will be addressed to that applicant, it would never be possible for an individual to challenge the actual act that affects its legal position and so is of direct concern to that individual. That would be contrary to the fourth paragraph of Article 263 TFEU.
115. As used in the present case, the General Court’s focus on the ‘intermediate’ or ‘preparatory’ nature of the contested decision thus detracts the analysis from the only relevant question under the first paragraph of Article 263 TFEU: that is, whether the position of the EDPB, as expressed in the contested decision, constitutes the final position of that body, namely one that is binding vis-à-vis a third party, irrespective of the fact that another act will follow to ‘close’ the procedure laid down in the GDPR’s consistency mechanism.
116. In the present case, the contested decision is the act of the EDPB. By that decision, that body adopts its final position on the question of, first, whether ‘lossy hashed data’ as used by the appellant constitutes ‘personal data’ within the meaning of the GDPR and, second, whether the appellant breached the transparency rules of the GDPR. Both of those final findings have the legal effect of obliging the Irish supervisory authority, in its role as LSA, to amend its draft decision (that is, the very decision in which it had previously proposed to conclude to the contrary). By the contested decision, the EDPB also obliges that authority to reduce the relevant compliance period and gives binding instructions on how to calculate the fines at issue. The latter will result in the increase of those fines in comparison to the fines that the Irish supervisory authority intended to impose. Those findings are final from the perspective of the EDPB in the sense that they lay down that body’s definitive position on the questions referred to it. They thereby create a obligation (73) for the Irish supervisory authorities which may be nullified only if the EDPB revokes its decision or if the EU Courts annul it.
117. As that decision is final, and as it produces binding legal effects outside of the body that adopted it, that is to say, vis-à-vis the Irish supervisory authority, the General Court should have concluded that the contested decision satisfies the conditions under the first paragraph of Article 263 TFEU and therefore should be classified a challengeable act.
118. The second superfluous element which the General Court introduced in its analysis is the direct enforceability of the EDPB’s decision against WhatsApp.
119. I can be brief on that point: given that the determination of the ability of an act to be challenged does not depend on whether or how it changes the legal position of an applicant, the question of the direct enforceability of the contested decision against WhatsApp cannot be relevant for the analysis under the first paragraph of Article 263 TFEU. Moreover, as I will argue later, the direct enforceability against that party as a criterion to assess whether the EDPB’s decision is of direct concern to that company is also irrelevant.
3. Interim conclusion
120. The answer to the question of whether an act of an institution or body of the European Union is a challengeable act before the EU Courts, for the purpose of the first paragraph of Article 263 TFEU, requires an assessment of whether that act expresses the definitive position of that institution or body which has binding legal effects for someone outside of that institution or body.
121. In order to answer the question of whether the act can be challenged before the EU Courts, the third person on which the act has binding legal effects does not need to be the same as that which introduced the action for annulment.
122. The question of whether the person that introduced the action against a challengeable act has the capacity to challenge that act is resolved under the fourth paragraph of Article 263 TFEU and not under the first paragraph thereof.
123. In order to establish whether an act is challengeable, it is irrelevant that that act constitutes an ‘intermediary’ step of a composite procedure.
124. By focusing on the fact that the contested decision does not constitute the final decision within the consistency mechanism envisaged by the GDPR instead of assessing whether that decision constitutes the final or definitive decision of the EDPB that produces binding legal effects on the Irish supervisory authority, the General Court erred, in the order under appeal, in its assessment of the conditions under the first paragraph of Article 263 TFEU.
125. I therefore suggest that the Court of Justice uphold the first two arguments of the first ground of appeal.
C. The appellant is directly concerned by the contested decision
126. By its third and fourth arguments of the first ground of appeal, the appellant claims that the General Court erred in finding that it is not directly concerned by the contested decision.
127. According to the appellant, while the General Court correctly lays down the Court of Justice’s case-law requiring that two conditions must be fulfilled to establish that an act is of direct concern to a natural or legal person that is not the addressee of that act, (74) the General Court however erroneously applies that case-law.
128. According to the case-law cited by the General Court, the ‘condition that a natural or legal person must be directly concerned by the measure being challenged requires two cumulative criteria to be met, namely, first, the contested measure must directly affect the legal situation of that person and, secondly, it must leave no discretion to its addressees who are entrusted with the task of implementing it, such implementation being purely automatic and resulting from EU rules alone without the application of other intermediate rules’. (75)
129. The treatment of those two criteria as ‘cumulative’ results from the case-law in which the challenged act necessitated implementing measures. (76)
130. In such a situation, the challenged measure could directly affect the legal situation of the applicant only if the implementing body had no choice as to whether and how to implement that measure. (77)
131. That is the situation in the present case. The contested decision, which concerns the appellant, is addressed to the Irish supervisory authority and not to the appellant. The decision requires the Irish authority to amend its draft decision when adopting the final decision, which is addressed to the appellant, in the way that it implements the findings contained in the contested decision. Therefore, the question of whether the Irish supervisory authority was left with discretion after the EDPB had adopted the contested decision is relevant for finding whether there is direct concern to the appellant.
132. In that context, the appellant claims that the General Court misinterpreted the fourth paragraph of Article 263 TFEU in two ways. First, in its assessment of the first condition for direct concern, the General Court applied the criteria of ‘enforceability’ and the ‘final step in procedure’, neither of which are relevant for establishing direct concern. Second, in its assessment of the second condition for direct concern, the General Court misapplied the criterion of discretion to the contested decision.
133. I agree with the appellant on both points.
1. Enforceability of the contested decision against the appellant
134. The first misinterpretation for which the appellant reproaches the General Court is that the latter considered, in paragraph 52 of the order under appeal, that the condition that the contested decision directly affects the legal position of WhatsApp is not fulfilled because that act is not enforceable against it.
135. The condition of ‘enforceability’ does not figure in the fourth paragraph of Article 263 TFEU nor does it arise from the case-law of the Court of Justice.
136. With good reason. In most situations in which an implementing measure is required at either EU or national level, the EU decision that is being implemented is not itself enforceable against natural or legal persons, even if those persons are the intended addressees of that measure. The very reason why an implementing measure is often required is that the EU measure at issue cannot of itself ‘reach’ the applicant. In those situations, only the implementing measure is enforceable against a natural or legal person.
137. If the ‘direct enforceability’ of a measure against a natural or legal person were a condition for direct concern, there would be hardly any situation in which non-privileged applicants would be capable of challenging an EU act that requires implementing measures.
138. In fact, it does not matter for the question of direct concern whether only the implementing measure at issue is enforceable against a natural or legal person, and not the measure whose validity that person challenges before the EU Courts. If the implementing measure is a mere replica of the measure that is the subject of the action because the implementing body had no choice as to whether and how to frame its decision, it is clear that the challenged measure is the real cause of affectation of the applicant’s legal position.
139. In the present case, that means that the General Court erred when it took into consideration the enforceability of the contested decision towards the appellant as a relevant factor for assessing whether the appellant is directly concerned by that decision.
2. The contested measure is not a final step in the procedure envisaged by the consistency mechanism
140. In the same paragraph 52 of the order under appeal, the General Court considered that the appellant is not directly affected by the contested decision because that decision does not constitute the final step in the procedure envisaged by the GDPR’s consistency mechanism, but that it instead requires implementing measures at national level.
141. It already follows from the preceding discussion that a person can be directly concerned by a measure even where that measure entails implementing measures. (78)
142. The second condition for establishing direct concern in the case-law of the Court of Justice (see point 128 of this Opinion), which the General Court referred to as applicable law in the order under appeal, (79) would make no sense if direct concern could not exist where a contested measure entailed implementing measures.
143. Additionally, that understanding disregards the distinction between the requirement that a regulatory act does not entail implementing measures and the requirement for direct concern, both of which must be fulfilled for a non-privileged applicant to establish standing under the fourth paragraph of Article 263 TFEU. (80)
144. Thus, the General Court erred when it considered that the fact that, under the consistency mechanism, the Irish supervisory authority must adopt a decision implementing the contested decision is a relevant criterion for the analysis of whether the latter decision is of direct concern to the appellant.
145. That court tried to distinguish the situation in the present case from situations as they arise in the area of State aid in which the Commission finds an aid incompatible with the internal market and orders the Member State concerned to recover the aid at issue. (81) In such situations, the Court of Justice has found that recipients of aid are directly concerned by a relevant Commission decision even where that decision had to be implemented by the Member State at issue and could only be enforced on the basis of said implementing measures. (82)
146. I must agree with the appellant that the General Court wrongly relied on those cases in order to distinguish the present situation and to find that WhatsApp is not directly concerned by the contested decision. (83)
147. Quite the contrary, as those cases instead provide arguments in favour of finding that WhatsApp is directly concerned by the contested decision. That decision is the source of the change in the appellant’s legal position, notwithstanding the need for the adoption of an ‘implementing’ decision by the Irish supervisory authority. At its heart, the logic is thus precisely that taken by the Court of Justice in the case-law cited by the General Court in paragraph 64 of the order under appeal.
148. Likewise, I consider that the General Court erred in finding the contested decision not to be analogous to Commission decisions demanding the recovery of aid by virtue of the fact that the contested decision did not complete the administrative procedure at issue at national level. (84) However, in so far as it concerns the issues decided on by the EDPB by means of the contested decision, the procedure governing the consistency mechanism was, in fact, completed, given that the Irish supervisory authority cannot change the findings contained in the contested decision. The fact that that authority might need to also decide about certain additional issues not covered by the contested decision does not change the ‘finality’ of the findings made in the contested decision as regards the issues that it settled.
149. From the above, it appears clear to me that the contested decision affects the legal position of the appellant because it, first, qualifies its ‘lossy hashing’ procedure as entailing personal data and, second, finds that company’s practice to be in breach of certain transparency rules imposed on controllers by the GDPR.
150. That finding alone creates the legal obligation for the appellant to change its practice. Furthermore, it represents the legal basis for the Irish supervisory authority to impose higher fines on the appellant. Without the contested decision, that authority could not do so. The only reason for which it included those findings in its final decision addressed to the appellant was because it was obliged to do so by the contested decision. To my mind, that makes it pretty clear that the real reason for the change in the appellant’s legal position is the contested decision and not, as the General Court wrongly concludes, the decision of the Irish supervisory authority.
3. Discretion of the Irish supervisory authority
151. If an act subject to an action for annulment requires implementing measures, it will be considered to be of direct concern to the applicant only if the body that adopts those implementing measures does not enjoy any discretion, but must instead automatically apply the findings of the contested decision.
152. In the present case, that would mean that the contested decision would be of direct concern to WhatsApp if the Irish supervisory authority had no discretion as to whether or how to implement that decision.
153. In the order under appeal, the General Court considered that the Irish supervisory authority enjoyed discretion and that the appellant was therefore not directly concerned by the contested decision, but only by that authority’s final decision. (85)
154. I agree with the appellant that here, too, the General Court erred in its assessment.
155. First, the EDPB’s finding that ‘lossy hashing’ constitutes the processing of personal data and that the appellant has, as data controller, infringed its obligations under Articles 5, 13 and 14 of the GDPR had to be transposed into the final decision of the Irish supervisory authority, leaving the latter no discretion on the possibility to come to a contrary conclusion.
156. Second, the contested decision imposed on the Irish supervisory authority an unconditional obligation to increase the fines and use the calculation methods stated in the EDPB’s decision, even if the final calculation and imposition of the amount of those fines was left to the Irish supervisory authority. That means that no discretion was left to that authority, in its capacity of ‘implementing body’, to either maintain the original fines or decrease them. (86)
157. Therefore, in relation to those aspects of the contested decision, the Irish supervisory authority did not enjoy any discretion as to whether or how to decide in relation to the appellant.
158. It follows that the General Court erred in finding that, with regard to those aspects, the Irish supervisory authority enjoyed discretion. (87)
159. Under Article 65(1)(a) of the GDPR, the EDPB decides only on those aspects of the application of the GDPR that were objected to by other supervisory authorities and not settled among the participating supervisory authorities. Therefore, the Irish supervisory authority is indeed left with discretion to decide on those issues that were not submitted to the EDPB but which nonetheless form part of the final national decision. (88)
160. Is this relevant for finding that the appellant is directly concerned by the contested decision?
161. In the order under appeal, the General Court considered that the limited scope of the contested decision mattered because the Irish supervisory authority’s final decision constitutes a whole that cannot be severed according to those aspects for which the Irish supervisory authority had and did not have discretion. (89)
162. To my mind, and again in agreement with the appellant, that element does not matter for the question of whether the contested decision is of direct concern to that party.
163. For an assessment of the question of direct concern, one must start from the substance of the challenged act. (90) In that respect, it suffices that the content of the contested decision, which affects the legal position of the appellant, left no discretion to the Irish supervisory authority on those points, even if its final decision also dealt with other issues.
164. In fact, as I will explain in the next part of this Opinion, if the appellant did not challenge the contested decision before the General Court, it would lose the possibility to plead the invalidity of that decision as part of its challenging the final decision of the Irish supervisory authority before the competent Irish courts.
165. As the appellant explained at the hearing, such proceedings before the Irish courts are indeed pending. There, the appellant seeks the invalidation of the final decision of the Irish supervisory authority also for those aspects that are not dealt with in the contested decision. At the same time, however, the appellant challenged the EDPB’s decision before the General Court to safeguard its right to plead the invalidity of those parts of the Irish supervisory decision over which that authority could not exercise any discretion.
166. It follows that the General Court also erred in its conclusion that the appellant was not directly concerned by the contested decision because the Irish supervisory authority enjoyed discretion in ‘implementing’ the contested decision due to the fact that the final national decision also contained aspects that were not covered by the contested decision.
4. Interim conclusion
167. The General Court erred in applying the conditions for assessing the existence of direct concern under the fourth paragraph of Article 263 TFEU.
168. First, it based its assessment on non-existing conditions that the challenged act (i) be directly enforceable towards the applicant in annulment procedures and (ii) not entail implementing measures.
169. Second, the General Court erred in the assessment that the contested decision left discretion to the implementing authority, in this case the Irish supervisory authority.
170. Finally, the General Court erred in concluding that the presence of parts not covered by the contested decision in the Irish supervisory authority’s final decision was relevant for the question of whether the contested decision left no discretion to that authority.
171. I therefore suggest that the Court of Justice uphold the third and fourth arguments of the first ground of appeal.
D. The logic of the EU system of judicial remedies requires admissibility of the action in the present case
172. By its fifth argument within the first ground of appeal, the appellant argues that the General Court misstated the procedural requirements of the EU system of judicial remedies.
173. In the order under appeal, the General Court considered that, in the procedure laid down by the consistency mechanism, legal proceedings against the final decision of the national supervisory authority must be introduced before the competent national courts. In the General Court’s view, the logic of the complete system of judicial remedies speaks in favour of the national court as the appropriate forum, (91) which would then initiate the preliminary ruling procedure before the Court of Justice on the validity of the part of the national decision that is dictated by the relevant EDPB decision.
174. There is some force in the position of the General Court to require the concentration of actions in one court. Its proposed solution would, in fact, resolve the current procedural inconvenience that effectively requires an applicant to introduce two separate actions, one before the General Court and another before a national court, if that party wants to ensure the effective safeguard all of its rights under EU law. That is, indeed, not the most efficient way to protect one’s rights.
175. In the present case, the appellant has done precisely that: it has introduced two actions, one before the General Court and the other before the competent Irish courts. However, at least in its current structure, the EU system of judicial protection provides for no other solution, as I shall explain.
1. The relationship between direct and indirect actions against an EU act
176. First, as is well known, national courts do not have the power to invalidate acts of EU institutions and other bodies. Therefore, if they consider that an EU act is invalid, they must initiate the preliminary ruling procedure before the Court of Justice and obtain confirmation of that invalidity from that court. (92)
177. Second, a national court cannot question the validity of an EU act if the party that relies on that invalidity satisfies the standing conditions under the fourth paragraph of Article 263 TFEU but did not challenge that act within the time limit provided for by the sixth paragraph thereof before the EU Courts. That follows from the judgment in TWD Textilwerke Deggendorf (93) and was confirmed in later judgments, including the judgment in Georgsmarienhütte and Others, (94) which was discussed by the parties to this procedure.
178. In the latter judgment, the Court held that ‘where a person seeking to challenge an EU measure undoubtedly has standing under the fourth paragraph of Article 263 TFEU, that person is bound to make use of the remedy provided for in that provision by bringing an action before the General Court’. (95) If the person who had the opportunity to do so did not introduce an action for annulment within the deadline provided for under the sixth paragraph of Article 263 TFEU, the national court cannot accept a plea of invalidity of an EU act, introduced by that person, but has to consider the challenged act to be final in relation to that person. (96) If seised by a national court in a preliminary reference procedure in such a situation, the Court of Justice would have to reject the reference as inadmissible, as it would be responding to a question the answer to which cannot be used by the referring court.
179. A recent example involving composite procedures is the judgment in Iccrea Banca. (97) In that judgment, the Court found inadmissible part of the preliminary reference of the Tribunale amministrativo regionale per il Lazio (Regional Administrative Court, Lazio, Italy), before which a bank, Iccrea Banca, challenged the calculation of the amount of its contribution to the Single Resolution Fund. The Court considered that that bank was directly and individually concerned by a decision of the SRB – which was the basis for establishing the amount of those contributions – but that it had failed to challenge that decision through an action for annulment before the General Court. (98) Iccrea Banca, therefore, had lost the opportunity to raise the plea of invalidity of the SRB decision indirectly before the national court, such that the Court of Justice had to dismiss the reference on that point as inadmissible.
180. Applying that case-law to the present situation, in which WhatsApp had standing to challenge the contested decision before the General Court, it is clear that the invalidity of the EDPB decision could not be raised before the national court if WhatsApp had not sought to challenge that decision also directly before the General Court within the time period laid down in the sixth paragraph of Article 263 TFEU. (99)
181. Accordingly, given that, first, the appellant is directly concerned by the contested decision and, second, as the General Court itself found, that the contested decision is of individual concern to the appellant, (100) the challenge against the contested decision must be introduced before the EU Courts and not before the national courts.
182. Recital 143 of the GDPR confirms that the proper organisation of judicial review in a situation, such as the one at issue in the present case, should be conducted through actions for annulment before the General Court. (101) Even if that recital is not binding, as rightly submitted by the EDPB, it nonetheless describes the consequences that result from the application of the binding norms of the Treaty relating to the organisation of judicial proceedings.
183. Finally, I might add to the preceding arguments that the direct action before the General Court, in which the EU body which is the author of the contested decision is a party to the proceedings, is, to my mind, the more appropriate avenue for deciding on the validity of its decision. After all, before the national court, the procedural role of that body would depend on the relevant national procedural rules, thus possibly denying it access to the debate surrounding its own act. (102)
2. Other procedural issues
184. In the order under appeal, the General Court also expressed its worries regarding the possibility of diverging decisions at EU and national level, which may result from overlapping judicial proceedings. (103)
185. This is not new territory. As the Court explained in its judgment in Masterfoods and HB, where the validity of an EU act is questioned before both the national courts and the EU Courts, the former are under an obligation, by virtue of the principle of sincere cooperation, not to take a decision which may present a risk of conflict with an existing or forthcoming decision by the EU Courts. (104) Thus, where an action for annulment is pending before the General Court and a validity question is raised in a parallel action in national proceedings, the division of competences between the EU Courts and the national courts may require the national courts to stay proceedings. (105) This appears to have been the decision of the competent Irish courts in the present case. (106)
186. If the national court initiated the preliminary procedure before the Court of Justice despite the pending action for annulment before the General Court, the Court of Justice may stay its own proceedings in order to give preference to that action for annulment by application of Article 54 of the Statute of the Court of Justice of the European Union and by virtue of the principle of good administration. (107)
3. Interim conclusion
187. The logic of the system of judicial protection established by the Treaties does not require that the action for annulment introduced by the appellant before the General Court is found to be inadmissible.
188. I therefore suggest that the Court of Justice also accept the fifth argument of the first ground of appeal.
189. In the light of all of the foregoing arguments, I propose that the Court uphold the appellant’s first ground of appeal.
E. Consequences
190. Under Article 61 of the Statute of the Court of Justice of the European Union, the Court may, where the state of proceedings so permits, give itself final judgment in the matter.
191. In the present case, that condition is satisfied in so far as it concerns the admissibility of the direct action brought before the General Court.
192. First, the contested decision constitutes a challengeable act, for the purpose of the first paragraph of Article 263 TFEU. Second, the appellant is directly concerned by that decision, within the meaning of the fourth paragraph of Article 263 TFEU. Third, the contested decision is of individual concern to the appellant, as the General Court itself found in the order under appeal. (108) It follows that the conditions laid down in the first and fourth paragraphs of Article 263 TFEU are fulfilled. The action is therefore admissible.
193. However, given that the General Court did not consider the merits of the action before it, the determination of which requires a detailed assessment in law and in fact, the state of proceedings does not permit the Court of Justice to rule on the merits of the appellant’s action.
194. Accordingly, the case must be referred back to the General Court and the costs reserved.
IV. Conclusion
195. I propose that the Court of Justice should:
– set aside the order of 7 December 2022, WhatsApp Ireland v European Data Protection Board (T‑709/21, EU:T:2022:783);
– declare the appellant’s action for annulment admissible;
– refer the case back to the General Court for a decision on the merits; and
– order that the costs be reserved.
1 Original language: English.
2 Regulation of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1) (‘the GDPR’), Articles 63 and 65.
3 Binding Decision 1/2021 on the dispute arisen on the draft decision of the Irish Supervisory Authority regarding WhatsApp Ireland under Article 65(1)(a) GDPR (‘the contested decision’), published at https://www.edpb.europa.eu/our-work-tools/our-documents/binding-decision-board-art-65/binding-decision-12021-dispute-arisen_en.
4 Order of 7 December 2022, WhatsApp Ireland v European Data Protection Board (T‑709/21; ‘the order under appeal’; EU:T:2022:783).
5 At the time of writing, there are seven other cases pending before the General Court against binding decisions issued by the EDPB through the consistency mechanism, those actions having been brought by data processors, controllers and national supervisory authorities alike. See Cases T‑682/22, Meta Platforms Ireland v European Data Protection Board; T‑70/23, Data Protection Commission v European Data Protection Board; T‑84/23, Data Protection Commission v European Data Protection Board; T‑128/23, Meta Platforms Ireland v European Data Protection Board; T‑129/23, Meta Platforms Ireland v European Data Protection Board; T‑111/23, Data Protection Commission v European Data Protection Board; and T‑153/23, WhatsApp Ireland v European Data Protection Board. Three additional cases, also pending, challenge decisions of the EDPB adopted outside the framework of the consistency mechanism; see Cases T‑325/23, Meta Platforms Ireland v European Data Protection Board; T‑1030/23, Tiktok Technology v European Data Protection Board; and T‑8/24, Meta Platforms Ireland v European Data Protection Board.
6 For categorisation efforts, see Eliantonio, M., ‘Access to justice in composite procedures for the fmplementation of EU law: The story so far’, in Van Creynenbreugel, P. and Wildemeersch, J. (eds.), Questions choisies de droit européen des affaires / Selected Issues in European Business Law: 60 ans d’études juridiques européennes à Liège / 60 years of European legal studies at Liège, Bruylant, 2023, pp. 189-221.
7 Hofmann, H.C.H. explains that ‘composite procedures are multiple-step procedures with input from administrative actors from different jurisdictions, cooperating either vertically between EU institutions and bodies and Member State institutions and bodies, or horizontally between various Member State institutions and bodies or in triangular procedures with different Member State and EU institutions and bodies involved’; see Hofmann, H.C.H., ‘Composite decision making procedures in EU administrative law’, in Hofmann, H.C.H. and Türk, A.H., Legal Challenges in EU Administrative Law, Edward Elgar, Cheltenham, 2009, p. 136.
8 For a recent account of theoretical and practical questions raised in composite procedures, see Bastos, F.B., Judging Composite Decision-Making: The Transformation of European Administrative Law, Hart Publishing, Oxford, 2024.
9 Article 55(1) of the GDPR lays down that ‘each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State.’
10 See, to that effect, recitals 9, 10 and 13 of the GDPR.
11 See Article 60(4) of the GDPR.
12 In that respect, the EDPB’s role is different to its predecessor, the Article 29 Working Party, which was established pursuant to Article 29(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31), and which merely held advisory status.
13 See also recital 136 thereof.
14 Article 65(5) of the GDPR.
15 Article 65(6) of the GDPR provides that such a national decision must be adopted at the latest by one month after the EDPB has notified the supervisory authority of its binding decision.
16 If a national supervisory authority does not agree with a binding EDPB decision, it may challenge its validity before the General Court. See, by way of example, the actions resulting in the judgment of 29 January 2025, Data Protection Commission v EDPB (T‑70/23, T‑84/23 and T‑111/23, EU:T:2025:116).
17 The privacy policy is meant to meet the appellant’s transparency rules arising from Articles 12 to 14 of the GDPR, and arguably from Article 8 of the Charter of Fundamental Rights of the European Union. See, generally, Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, adopted on 29 November 2017 (WP260).
18 See Article 99(2) of the GDPR.
19 See Data Protection Commission, Decision of the Data Protection Commission made pursuant to Section 111 of the Data Protection Act, 2018 and Articles 60 and 65 of the General Data Protection Regulation, 2021 (IN-18-12-2) (‘the final national decision’), paragraph 3; available at: https://www.dataprotection.ie/sites/default/files/uploads/2022-03/Full_decision_WhatsApp_Ireland-August_2021.pdf.
20 See final national decision, paragraph 4.
21 See order under appeal, paragraph 4. See also final national decision, paragraph 23.
22 See order under appeal, paragraph 5. See also final national decision, paragraph 23.
23 See order under appeal, paragraph 5. See also final national decision, paragraph 24.
24 See order under appeal, paragraph 5. See also final national decision, paragraph 25.
25 Final national decision, paragraph 25.
26 My understanding is that the appellant’s ‘lossy hashing’ procedure essentially constitutes an encryption technique to translate phone numbers of users and non-users of its messaging service into numerical codes. The appellant would then share the numerical codes with third parties. Contrary to the draft decision of the Irish supervisory authority, the EDPB considered that because the appellant had the capacity to single out and therefore re-identify data subjects even on the basis of those ‘hashed’ codes, the hashed data constituted personal data within the meaning of the GDPR. See, to that effect, contested decision, paragraphs 141 to 157.
27 See, to that effect, order under appeal, paragraph 11, and contested decision, paragraphs 427 and 428.
28 See, to that effect, order under appeal, paragraph 11, and contested decision, paragraphs 426 and 428.
29 See, to that effect, order under appeal, paragraph 11, and contested decision, paragraphs 429 and 430.
30 See, in that regard, order under appeal, paragraph 9.
31 Thus, for instance, in the judgment of 18 June 2024, Commission v SRB (C‑551/22 P, ‘the judgment in Commission v SRB’, EU:C:2024:520), the Court explained that the findings of the judgment of 6 May 2021, ABLV Bank and Others v ECB (C‑551/19 P and C‑552/19 P, EU:C:2021:369), could not automatically be transplanted to the situation arising in that case. In the latter judgment, the Court found that a European Central Bank decision that a bank is failing or likely to fail does not constitute a challengeable act as it does not bind the Single Resolution Board (SRB), such that an action for annulment should be introduced against the act adopted by the SRB. That, however, does not mean that an act adopted by the SRB in the resolution procedure always constitutes a challengeable act. When adopted at a different phase of the resolution procedure, the act adopted by that body does not constitute a challengeable act if it does not have binding legal effects on the European Commission, which, in that composite procedure, is empowered to adopt a final decision.
32 Thus, the Court sometimes must explain why the findings in its previous judgments cannot be applied to the judgment at hand. In that respect, see the judgment in Commission v SRB, paragraph 92.
33 Judgment of 11 November 1981, IBM v Commission (60/81, ‘the judgment in IBM’, EU:C:1981:264, paragraph 9).
34 Judgment of 13 October 2011, Deutsche Post and Germany v Commission (C‑463/10 P and C‑475/10 P, ‘the judgment in Deutsche Post’, EU:C:2011:656).
35 It is settled case-law that questions concerning the admissibility of an action for annulment constitute issues of public policy that may be raised at any time, even in the absence of a cross-appeal brought pursuant to Article 176(2) of the Rules of Procedure of the Court of Justice; see, ex multis, judgments of 2 September 2021, Ja zum Nürburgring v Commission (C‑647/19 P, EU:C:2021:666, paragraphs 52 and 53 and the case-law cited), and of 21 September 2023, China Chamber of Commerce for Import and Export of Machinery and Electronic Products and Others v Commission (C‑478/21 P, EU:C:2023:685, paragraphs 42 and 43 and the case-law cited).
36 See, ex multis, judgments of 10 March 1998, Germany v Council (C‑122/95, EU:C:1998:94, paragraph 35), and of 26 September 2024, WEPA Hygieneprodukte and Others v Commission (C‑795/21 P and C‑796/21 P, EU:C:2024:807, paragraphs 63 and 73).
37 See the first sentence of Article 65(5) of the GDPR.
38 See, to that effect, judgments of 5 April 1979, Orlandi v Commission (117/78, EU:C:1979:109, paragraph 11), and of 26 September 2013, PPG and SNF v ECHA (C‑625/11 P, EU:C:2013:594, paragraph 33).
39 See, ex multis, judgment of 26 September 2024, WEPA Hygieneprodukte and Others v Commission (C‑795/21 P and C‑796/21 P, EU:C:2024:807, paragraphs 68 to 71).
40 See, by analogy, judgment of 26 September 2013, PPG and SNF v ECHA (C‑625/11 P, EU:C:2013:594, paragraphs 29 to 33), which concerned the publication of a list of substances solely on the website of the European Chemicals Agency, which the Court nevertheless considered a published decision.
41 See, to that effect, ex multis, judgments of 26 September 2024, Covestro Deutschland and Germany v Commission (C‑790/21 P and C‑791/21 P, EU:C:2024:792, paragraph 82), and of 26 September 2024, WEPA Hygieneprodukte and Others v Commission (C‑795/21 P and C‑796/21 P, EU:C:2024:807, paragraphs 72 and 73), the latter judgment explaining that, in the interests of legal certainty, the time limits for bringing an action must be established objectively and with certainty in respect of all parties to which that decision has not been notified, irrespective of a possible prior awareness of the measure by the applicant.
42 On the possible practical difference between relying on binding legal effects or merely on legal effects in order to determine the ability of an act to be challenged, see Opinion of Advocate General Bobek in Belgium v Commission (C‑16/16 P, EU:C:2017:959, point 59 et seq.).
43 See Article 173 of the EEC Treaty (emphasis added). I might add that Article 33 of the European Coal and Steel Community Treaty provided for a positive list of the challengeable acts, enumerating ‘decisions’ and ‘recommendations’. According to Article 14 thereof, those acts were defined as acts with legally binding force. Therefore, the early case-law of the Court, which influenced its later case-law, enquired into the ‘binding’ nature of a measure in order to decide whether it is capable of forming the basis for an action for annulment. See, for example, judgments of 16 July 1956, Fédération charbonnière de Belgique v High Authority (8/55, EU:C:1956:7, p. 256); of 10 December 1957, Société des usines à tubes de la Sarre v High Authority (1/57 and 14/57, EU:C:1957:13, p. 114); and of 15 March 1967, CBR and Others v Commission (8/66 to 11/66, EU:C:1967:7, p. 91).
44 This is how recommendations and opinions are defined today in Article 288 TFEU, but the same definition was provided in Article 189 EEC.
45 In judgment of 31 March 1971, Commission v Council (22/70, EU:C:1971:32, paragraph 39), the Court referred to measures intended to have ‘legal force’. In its recent case-law, however, that expression has become one describing measures intended to have ‘binding legal effects’. See, for example, judgment of 12 July 2022, Nord Stream 2 v Parliament and Council (C‑348/20 P, EU:C:2022:548, paragraph 62 and the case-law cited).
46 See, in respect of privileged applicants, for example, order of 17 May 1989, Italy v Commission (151/88, EU:C:1989:201, paragraphs 22 and 23), and judgment of 25 October 2017, Slovakia v Commission (C‑593/15 P and C‑594/15 P, EU:C:2017:800, paragraphs 63 to 65).
47 When the action is introduced by a privileged applicant, that question is, in any event, irrelevant. Still, as I have explained, the Court must determine whether the challenged act is legally binding even for privileged applicants. However, in two decisions of the Court – which, to my knowledge, were never repeated – the Court rejected the privileged applicant’s action (in both cases the applicant was the Netherlands Government) on the ground that the Commission’s decision, the annulment of which was being claimed, had no binding legal effects on the applicant. See, in that respect, judgment of 5 October 1999, Netherlands v Commission (C‑308/95, EU:C:1999:477, paragraphs 26 and 29), and order of 28 January 2004, Netherlands v Commission (C‑164/02, EU:C:2004:54, paragraphs 18 and 22). For a critical reflection on those two judgments, see Opinion of Advocate General Jacobs in Italy v Commission (C‑301/03, EU:C:2005:550, points 52 and 53).
48 See, in that respect, as regards the case-law on internal instructions and guidelines, Lenaerts, K., Gutman, K. and Nowak, J.T., EU Procedural Law, 2nd edition, Oxford European Union Law Library, Oxford, 2023, p. 286, points 7.21 to 7.22.
49 This clearly follows from the case-law in the area of State aid, whereby the Commission’s decision declaring existing aid incompatible with the internal market and ordering the Member State to recover that aid is legally binding only on that Member State, but may also be challenged by the recipient of said aid. See, for example, judgment of 19 October 2000, Italy and Sardegna Lines v Commission (C‑15/98 and C‑105/99, EU:C:2000:570, paragraphs 31 to 37).
50 See, in that respect, the judgment in IBM, paragraph 10, and of 26 January 2010, Internationaler Hilfsfonds v Commission (C‑362/08 P, EU:C:2010:40, paragraph 58).
51 See, in that respect, Opinion of Advocate General Roemer in Joined Cases CBR and Others v Commission (8/66 to 11/66, not published, EU:C:1967:2, p. 103).
52 See, on that point, most recently, judgment of 13 February 2025, Swissgrid v Commission (C‑121/23 P, EU:C:2025:83, paragraph 46) (explaining that where the applicant in an action for annulment is not the addressee of a contested act, ‘it is sufficient to establish that that measure is intended to produce binding legal effects’ vis-à-vis, in particular, its addressees, since, at that stage, ‘it is not necessary to ascertain whether those legal effects are capable of affecting the interests of the applicant by bringing about a distinct change in his or her legal position’ since that element is determined at the stage of assessing the condition laid down in the fourth paragraph of Article 263 TFEU).
53 Emphasis added.
54 See paragraphs 38 and 39 of the order under appeal. Together with the judgment in IBM, the General Court also relies on the judgment of 18 November 2010, NDSHT v Commission (C‑322/09 P, EU:C:2010:701, paragraph 45), which refers to other cases that also cite paragraph 9 of the judgment in IBM.
55 Emphasis added.
56 See, for example, ex multis, judgment of 31 March 1998, France and Others v Commission (C‑68/94 and C‑30/95, EU:C:1998:148, paragraph 62); of 17 July 2008, Athinaïki Techniki v Commission (C‑521/06 P, EU:C:2008:422, paragraph 29); of 26 January 2010, Internationaler Hilfsfonds v Commission (C‑362/08 P, EU:C:2010:40, paragraph 51); and the judgment in Commission v SRB, paragraph 65).
57 See, ex multis, order of 3 July 2007, Commune de Champagne and Others v Council and Commission (T‑212/02, EU:T:2007:194, paragraphs 86 and 88), and judgments of 26 November 2018, Shindler and Others v Council (T‑458/17, EU:T:2018:838, paragraph 30), and of 10 March 2021, ViaSat v Commission (T‑245/17, EU:T:2021:128, paragraph 68).
58 See, for instance, the Opinion of Advocate General Sharpston in Reynolds Tobacco and Others v Commission (C‑131/03 P, EU:C:2006:228, points 102 and 103), in which she highlights that it would appear that the requirement that an act be binding on the applicant in question was added by the Court to the requirement that the act is binding generally.
59 References to the case-law cited omitted.
60 Order of 14 July 2010, Deutsche Post v Commission (T‑570/08, not published, EU:T:2010:311).
61 See, for example, judgment of 21 December 2021, Algebris (UK) and Anchorage Capital Group v SRB (C‑934/19 P, EU:C:2021:1042, paragraph 87 et seq.).
62 See, to that effect, the judgment in Deutsche Post, paragraphs 40 to 47.
63 Judgment in Deutsche Post, paragraph 54.
64 Judgment in Deutsche Post, paragraph 63.
65 Judgment in Deutsche Post, paragraphs 66 to 75.
66 Order under appeal, paragraphs 42 to 49.
67 Order of 14 July 2010, Deutsche Post v Commission (T‑570/08, not published, EU:T:2010:311).
68 See, to that effect, order under appeal, paragraphs 43 and 44 (first laying down that in composite procedures intermediate acts do not in principle constitute acts open to challenge and then laying down that ‘the exceptions to [that] principle … concern cases where the intermediate act produces independent legal effects’).
69 Order under appeal, paragraph 44.
70 Judgment in IBM, paragraph 10, emphasis added.
71 The same can be said of the Court’s statement in paragraph 52 of the judgment of 26 January 2010, Internationaler Hilfsfonds v Commission (C‑362/08 P, EU:C:2010:40), which the General Court also relied on in paragraph 43 of the order under appeal.
72 Even though, in describing the context of a particular case the Court of Justice refers to the concept of a ‘preparatory’ act in a composite procedure, it nevertheless does not preclude the possibility of challenging such an act if it is found to produce independent legal effects within that procedure. See, for example, the judgment in Commission v SRB, paragraph 93), which explains that ‘in a complex procedure of that sort, acts adopted during the preparatory stages leading to the adoption of the definitive act cannot, where they do not produce independent legal effects, form the subject matter of an action for annulment’) (emphasis added).
73 As I have explained, the binding effects on the relevant national supervisory authorities of an EDPB decision enacted within the course of the consistency mechanism is provided for by Article 65(1) of the GDPR.
74 Order under appeal, paragraph 51.
75 See judgment of 12 July 2022, Nord Stream 2 v Parliament and Council (C‑348/20 P, EU:C:2022:548, paragraph 43 and the case-law cited).
76 It appears to me that the first case to refer to the ‘cumulative’ nature of those criteria is the judgment of 10 September 2009, Commission v Ente per le Ville vesuviane and Ente per le Ville vesuviane v Commission (C‑445/07 P and C‑455/07 P, EU:C:2009:529, paragraph 45), which concerned financial assistance granted from the European Regional Development Fund through the assistance of national authorities.
77 A situation in which an EU measure will require an additional implementing measure to ‘reach’ the applicant occurs most often in practice. However, that kind of situation is not the only one in which an act may directly concern a natural or legal person. There are acts that affect the legal situation of an individual without any need for an implementing measure. That is true for acts of general application, such as regulations. Consider, in that respect, for instance, the situation that was at issue in the judgment of 1 April 2004, Commission v Jégo-Quéré (C‑263/02 P, EU:C:2004:210). In the circumstances of that case, the mandatory use of nets with a minimum mesh size to reduce the catch of juvenile hake was imposed directly on the applicant’s fishing company, without the need for any implementing measures. The latest amendment to the fourth paragraph of Article 263 TFEU, arising from the Treaty of Lisbon, opened the action for annulment up to challenges to regulatory acts that do not require implementing measures without the need to prove individual concern. Nevertheless, the applicant must still prove that he or she is directly concerned with the challenged measure. Such proof will not entail the second ‘cumulative’ criterion arising from the case-law – that of implementing measures – given that, in such a situation, there are no implementing measures that act as a ‘bridge’ between the contested measure and the applicant.
78 See, for a recent confirmation in relation to directives which always entail implementing measures, judgment of 12 July 2022, Nord Stream 2 v Parliament and Council (C‑348/20 P, EU:C:2022:548, paragraph 70).
79 See order under appeal, paragraph 51.
80 See judgment of 12 July 2022, Nord Stream 2 v Parliament and Council (C‑348/20 P, EU:C:2022:548, paragraphs 71 to 74).
81 Order under appeal, paragraph 64.
82 See, for example, judgments of 19 October 2000, Italy and Sardegna Lines v Commission (C‑15/98 and C‑105/99, EU:C:2000:570, paragraphs 31 and 34), and of 29 April 2004, Italy v Commission (C‑298/00 P, EU:C:2004:240, paragraph 39).
83 The same is also true for the case-law which the General Court relies on in paragraph 65 of the order under appeal, which concerned a Commission decision addressed to a Member State instructing that State to reduce certain EU financing provided to an undertaking. The Court found an undertaking in such a position to be directly concerned by the Commission’s decision, notwithstanding the need for implementing measures by a Member State.
84 Paragraph 64 of the order under appeal.
85 Paragraph 53 of the order under appeal.
86 The appellant additionally challenges the EDPB’s power to interfere with either the method for calculating or the amount of the fines, claiming that the GDPR left it in the hands of the national supervisory authority and under the rules provided for by national law. This latter claim will have to be assessed on the merits, and the Court of Justice cannot pronounce itself on that question in the present appeal.
87 See paragraphs 57 to 59 of the order under appeal. The fact that the EDPB did not express its position on whether WhatsApp acted as the controller or processor in relation to the personal data resulting from the ‘lossy hashing’ procedure does not change the fact that the Irish supervisory authority is bound by the EDPB’s finding that that procedure constitutes processing of personal data.
88 In paragraphs 55 and 56 of the order under appeal, the General Court enumerated those issues which were decided by the EDPB and those issues which were decided, in addition, by the Irish supervisory authority in its final national decision.
89 See order under appeal, paragraph 60.
90 See, ex multis, judgments of 3 June 2021, Hungary v Parliament (C‑650/18, EU:C:2021:426, paragraph 38 and the case-law cited), and of the judgment in Commission v SRB paragraph 65 and the case-law cited).
91 In that respect, the General Court relies on the judgment of 25 July 2002, Unión de Pequeños Agricultores v Council (C‑50/00 P, EU:C:2002:462, paragraph 40); see, also, order under appeal, paragraph 68.
92 See judgment of 22 October 1987, Foto-Frost (314/85, EU:C:1987:452, paragraph 17).
93 Judgment of 9 March 1994 (C‑188/92, EU:C:1994:90, paragraph 26).
94 Judgment of 25 July 2018 (C‑135/16, EU:C:2018:582, paragraph 17 and the case-law cited).
95 Judgment of 25 July 2018, Georgsmarienhütte and Others (C‑135/16, EU:C:2018:582, paragraph 18).
96 See, to that effect, for example, judgment of 10 March 2021, Von Aschenbach & Voss (C‑708/19, EU:C:2021:190, paragraphs 33 and 49).
97 Judgment of 3 December 2019, Iccrea Banca (C‑414/18, ‘the judgment in Iccrea Banca’, EU:C:2019:1036).
98 The judgment in Iccrea Banca, paragraphs 72 and 74.
99 That proposal is, of course, only valid if it was ‘beyond any doubt’ that WhatsApp indeed had standing before the EU Courts. If, on the contrary, WhatsApp did not have standing before the General Court to challenge the validity of the contested decision, as claimed by that court, that company should not be prevented to raise a plea of invalidity before the national court.
100 See order under appeal, paragraph 40.
101 In the relevant part, recital 143 of the GDPR reads as follows: ‘Where decisions of the Board are of direct and individual concern to a controller, processor or complainant, the latter may bring an action for annulment against those decisions within two months of their publication on the website of the Board, in accordance with Article 263 TFEU.’
102 See, in that respect, Opinion of Advocate General Campos Sánchez-Bordona in Georgsmarienhütte and Others (C‑135/16, EU:C:2018:120, point 43). See, also, the arguments raised by Opinion of Advocate General Jacobs in Unión de Pequeños Agricultores v Council (C‑50/00 P, EU:C:2002:197, point 40 et seq.), which remain valid.
103 See order under appeal, paragraph 70.
104 See judgment of 14 December 2000, Masterfoods and HB (C‑344/98, EU:C:2000:689, paragraph 39 and the case-law cited).
105 See judgments of 14 December 2000, Masterfoods and HB (C‑344/98, EU:C:2000:689, paragraph 57), and of 25 July 2018, Georgsmarienhütte and Others (C‑135/16, EU:C:2018:582, paragraph 24 and the case-law cited).
106 See Meta Platforms Ireland Ltd v Data Protection Commission (approved) [2024] IEHC 264 of 10 May 2024, noting in paragraph 49 that: ‘The statutory appeal and the judicial review proceedings will be adjourned generally to await the outcome of the WhatsApp proceedings currently pending before the CJEU.’
107 See judgment of 25 July 2018, Georgsmarienhütte and Others (C‑135/16, EU:C:2018:582, paragraph 25).
108 Order under appeal, paragraph 40.