21 July 2023 (*)

(Appeal – Intervention – Confidentiality)

In Case C‑97/23 P,

APPEAL under Article 56 of the Statute of the Court of Justice of the European Union, brought on 17 February 2023,

WhatsApp Ireland Ltd, established in Dublin (Ireland), represented by H.-G. Kamann, Rechtsanwalt, F. Louis and A. Vallery, avocats, B. Johnston, C. Monaghan, P. Nolan, Solicitors, D. McGrath, Senior Counsel, P. Sreenan, Senior Counsel, E. Egan McGrath, Barrister-at-Law, and C. Geoghegan, Barrister-at-Law,

appellant,

the other party to the proceedings being:

European Data Protection Board, represented by C. Foglia, M. Gufflet, G. Le Grand and I. Vereecken, acting as Agents, and by G. Haumont, E. de Lophem, G. Ryelandt and P. Vernet, avocats,

defendant at first instance,

THE PRESIDENT OF THE COURT,

having regard to the proposal from T. von Danwitz, Judge-Rapporteur,

having heard the Advocate General, T. Ćapeta,

makes the following

1By its appeal, the appellant, WhatsApp Ireland Ltd., seeks to have set aside the order of the General Court of the European Union of 7 December 2022, WhatsApp Ireland v European Data Protection Board (T‑709/21, EU:T:2022:783), by way of which the General Court dismissed its action seeking annulment of Decision 1/2021 of the European Data Protection Board of 28 July 2021, adopted pursuant to Article 5 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1), further to an investigation conducted by the Data Protection Commission (Ireland), pursuant to Article 56 of that regulation in view of WhatsApp Ireland’s cross-border processing in the context of the provision of its services in the European Union.

2By document lodged at the Registry of the Court of Justice on 11 May 2023, the Federal Republic of Germany applied, pursuant to the first paragraph of Article 40 of the Statute of the Court of Justice of the European Union and Article 130 of the Rules of Procedure of the Court of Justice, applicable to appeal proceedings under Article 190(1) of those rules, for leave to intervene in the present proceedings in support of the form of order sought by the European Data Protection Board.

3In accordance with the first paragraph of Article 40 of the Statute of the Court of Justice of the European Union, which provides that the Member States and institutions of the European Union may intervene in cases before the Court, that application to intervene must be granted.

4Furthermore, by letter lodged at the Court Registry on 30 May 2023, WhatsApp Ireland and the European Data Protection Board jointly requested, pursuant to Article 131(2) of the Rules of Procedure, that certain passages set out in Annexes A.3 and A.4 to the appeal, and in paragraphs of Annexes B.4 and B.5 to the response, which are referred to in the annex to the present order, be given confidential treatment vis-à-vis the Federal Republic of Germany. WhatsApp Ireland and the European Data Protection Board also lodged at the Court Registry a non-confidential version of each of the four annexes referred to in their request, in which those passages which they regard as confidential are redacted.

5More specifically, those passages contain, according to WhatsApp Ireland and the European Data Protection Board, detailed information relating, in essence, to the technical implementation of the lossy hashing process, user and non-user counts, use rates, and financial information concerning WhatsApp Ireland, since all of that information is covered by business secrecy. Moreover, those passages contain, according to those parties, personal data of certain individuals whose involvement in the present case must not be made public, and whose data, if disclosed, is of no use for the Federal Republic of Germany.

6In accordance with Article 131(3) and (4) of the Rules of Procedure, the President of the Court may, if a party so requests and at any stage in the proceedings, exclude certain secret or confidential items or documents from disclosure, to the interveners, of the procedural documents served on the other parties (see, to that effect, order of the President of the Court of 8 February 2006, Commission v Italy, C‑255/05, EU:C:2006:87, paragraph 5).

7In the present case, the application of Article 131(3) and (4) of the Rules of Procedure appears to be justified, having regard to the grounds on which WhatsApp Ireland and the European Data Protection Board rely in support of their joint request for confidential treatment of the appeal and the response, which justify that certain information set out in the paragraphs of Annexes A.3 and A.4 to that appeal and the paragraphs of Annexes B.4 and B.5 to that response, referred to in the annex to the present order, should remain confidential, in the absence of any effect resulting from the omission of such information on the procedural rights of the intervener in the present proceedings.

8It follows from the foregoing that the request submitted by WhatsApp Ireland and the European Data Protection Board for confidential treatment must be granted. Consequently, the Federal Republic of Germany shall be provided, pursuant to Article 131(3) of the Rules of Procedure, which is applicable to the appeal proceedings by virtue of Article 190(1) of those rules, with all the procedural documents served on the parties, except for those passages contained in the paragraphs of Annexes A.3 and A.4 to the appeal and the paragraphs of Annexes B.4 and B.5 to the response, which are referred to in the annex to the present order. Thus the non-confidential version of those annexes, referred to in paragraph 4 of the present order and in which those passages are redacted, shall be sent to the Federal Republic of Germany.

9As regards the intervener’s procedural rights, it should be observed that the application to intervene made by the Federal Republic of Germany was submitted within the period of one month laid down in Article 190(2) of the Rules of Procedure, with the result that it will be permitted, in accordance with Article 132(1) of those rules, to submit a statement in intervention within one month after service of the present order.

On those grounds, the President of the Court hereby orders:

4. A period of one month shall be prescribed within which the Federal Republic of Germany may submit a statement in intervention.

5. The costs are reserved.

Luxembourg, 21 July 2023.

K. Lenaerts

Registrar

Annex

The information which is the subject of the request submitted by WhatsApp Ireland and the European Data Protection Board for confidential treatment, and which is set out Annexes A.3 and A.4 to the appeal and in Annexes B.4 and B.5 to the response, is as follows:

Annex A.3, page 20, paragraph 81;

Annex A.3, page 29, paragraph 142;

Annex A.3, page 55, paragraph 269;

Annex A.3, page 56, paragraph 274;

Annex A.3, page 79, paragraph 391;

Annex A.4, page 14, paragraph 34;

Annex A.4, page 19, paragraph 44d;

Annex A.4, page 20, paragraph 44i;

Annex A.4, page 206, paragraph 714;

Annex A.4, page 207, paragraphs 716 and 717;

Annex A.4, page 207, paragraph 720;

Annex A.4, page 208, paragraphs 722 and 723;

Annex A.4, page 208, paragraphs 726 and 727;

Annex A.4, page 210, paragraph 728g;

Annex A.4, page 225, paragraph 800b;

Annex A.4, page 237, paragraph 825;

Annex A.4, page 253, paragraph 881;

Annex B.4, page 20, paragraph 30;

Annex B.4, page 25, paragraph 40d;

Annex B.4, page 26, paragraph 40i;

Annex B.4, page 183, paragraph 663;

Annex B.4, page 184, paragraph 665;

Annex B.4, page 184, paragraph 666;

Annex B.4, page 185, paragraph 669;

Annex B.4, page 185, paragraph 671;

Annex B.4, page 185, paragraph 672;

Annex B.4, page 186, paragraph 675;

Annex B.4, page 186, paragraph 676;

Annex B.4, page 187, paragraph 677g;

Annex B.4, page 202, paragraph 746b;

Annex B.4, page 209, paragraph 768;

Annex B.4, page 216, paragraph 797;

Annex B.5, page 225;

Annex B.5, page 226;

Annex B.5, page 233, paragraph 24;

Annex B.5, page 234, paragraph 26;

Annex B.5, page 234, paragraph 27;

Annex B.5, page 235, paragraph 30;

Annex B.5, page 235, paragraph 32;

Annex B.5, page 235, paragraph 33;

Annex B.5, page 236, paragraph 36;

Annex B.5, page 236, paragraph 37;

Annex B.5, page 237, paragraph 38g;

Annex B.5, page 252, paragraph 108b, and

Annex B.5, page 263, fifth paragraph, first indent.

(*) Language of the case: English.