delivered on 8 May 2025 (1)

Case C‑698/23 P

European Data Protection Supervisor (EDPS)

European Parliament

Council of the European Union

interveners:

Federal Republic of Germany

French Republic

European Commission

( Appeal – Law governing the institutions – Processing of personal data by the European Union Agency for Law Enforcement Cooperation (Europol) – Regulation (EU) 2016/794 – Regulation (EU) 2022/991 – Institutional prerogatives of the European Data Protection Supervisor (EDPS) – Action for annulment – Locus standi – Article 263 TFEU )

This appeal concerns the order of the General Court of 6 September 2023 in EDPS v Parliament and Council, (2) which ruled that the action for annulment brought by the European Data Protection Supervisor (EDPS) against Articles 74a and 74b of Regulation (EU) 2016/794, (3) as amended by Regulation (EU) 2022/991, (4) was inadmissible.

In his action before the General Court, the EDPS claimed that the contested provisions retroactively legalise certain practices of the European Union Agency for Law Enforcement Cooperation (Europol) in the field of data protection, against which the EDPS reacted in a decision of 3 January 2022.

The EDPS argued that the effectiveness of his decision of 3 January 2022 against Europol would be annulled de facto as a result of the amendment of Regulation 2016/794 by Regulation 2022/991. In his view, the new provisions (5) infringe his independence and undermine his powers as a supervisory authority.

In the contested order, the General Court held, in essence, that the EDPS:

–Does not enjoy the locus standi conferred on Member States and on certain EU institutions by the second and third paragraphs of Article 263 TFEU.

–May call into question the validity of the contested provisions only if he fulfils the conditions laid down in the fourth paragraph of Article 263 TFEU, which is not the case here.

I.Background to the dispute

The background to the dispute is set out in paragraphs 2 to 13 of the contested order, from which I transcribe the following:

‘2 Following an own-initiative inquiry and an admonishment decision of 17 September 2020, the EDPS adopted, on 3 January 2022, a decision against [Europol], pursuant to Article 43(3)(e) of the initial Europol regulation, finding that, “by providing for the continuous storage of datasets lacking a DSC [Data Subject Categorisation], the Action Plan provided by Europol d[id] not address the infringement identified in the admonishment decision of 17 September 2020” and that “the processing by Europol of datasets lacking a DSC, …, for the sole purpose of extracting relevant information in compliance with Articles 18(3), (5), and Annex II.B [of the initial Europol regulation], (6) as well as the principles of data minimisation and storage limitation (Article 28(1)(c) and (e) [of the initial Europol regulation), [could not] exceed a maximum period of six months as from the date of reception of the contribution”.

3 In order to arrive at that reasoning, the EDPS stated, in particular, that, “in the absence of an explicit legal provision laying down the retention period of personal data processed for this purpose, … [it was] appropriate to make an interpretation by analogy of Article 18(6) [of the initial Europol regulation]”. (7)

4 Thus, it is apparent from the decision of 3 January 2022 that the EDPS ordered Europol, in essence, for each contribution received as from 4 January 2022, to proceed to data subject categorisation, within the meaning of Article 18(5) of the initial Europol regulation, within 6 months as from the date of reception of that contribution, and to proceed to data subject categorisation within 12 months for all datasets existing as at 3 January 2022, after which periods Europol was required to erase those data.

…

8 On 8 June 2022, the European Parliament and the Council of the European Union adopted the amended Europol regulation. The wording of Articles 74a and 74b was confirmed in that regulation.

9 Those provisions lay down, in essence, the conditions in which Europol is to proceed, within a specified period, to the categorisation of the datasets in its possession at the time of entry into force of the amended Europol regulation, and specify the conditions and procedures according to which the processing of personal data not relating to categories of data subjects listed in Annex II to the amended Europol regulation, which were transferred to Europol before 28 June 2022, is to be authorised in support of an ongoing criminal investigation.

…

10 On 15 June 2022, the EDPS, taking the view that the scope of his decision of 3 January 2022 and of Articles 74a and 74b of the amended Europol regulation was not the same, requested the Parliament, the Council and the Commission to provide him with documents concerning the existence of a connection between the provisions of the amended Europol regulation and the past exercise of his supervisory powers. The Parliament and the Council replied to that request by letters of 12 July and 25 July 2022 respectively.

11 In Council Document No 5370/22 of 24 January 2022, on preparation for the trilogue, it is stated that “the recent decision of the [EDPS], which could have operational consequences for Europol’s action, confirms the need for a rapid adoption of the regulation”, that “the Presidency proposed to the delegations to introduce a new Article 74[a] which would aim at further clarifying the situation of data currently in the possession of Europol, in particular in the context of the abovementioned decision of the EPDS of 3 January 2022” and that “many delegations welcomed the principles of that proposal at the meeting of 19 January [2022], but approval by the committee is necessary in view of its recent presentation and the stakes that that subject represents following the decision of the EDPS”.

12 By letter of 15 July 2022, the EDPS asked Europol whether, in the light of Articles 74a and 74b of the amended Europol regulation, his decision of 3 January 2022 continued to be implemented or whether Europol considered that those articles had replaced or altered the scope of that decision.

13 By letter of 22 August 2022, Europol replied to the EDPS, stating, in essence, that it continued to implement certain points of the decision of 3 January 2022, but that it was not in a position to comment at that stage on the situation as at 3 January 2023 and on the further submission of implementation reports under that decision. That letter also mentions the fact that Articles 74a and 74b of the amended Europol regulation were not applied to certain contributions which had been deleted.’

II.The proceedings before the General Court and the contested order

In his application to the General Court, the EDPS sought the annulment of the contested transitional provisions.

In its defence, the Parliament contended that the General Court should dismiss the application.

For its part, the Council raised a plea of inadmissibility against the action ‘… on two grounds. … first, that the action is inadmissible on the ground that the EDPS is not referred to in the second and third paragraphs of Article 263 TFEU or again in terms of the judgment [in Parliament v Council ]… (8) and, secondly, that the EDPS is not directly and individually concerned within the meaning of the fourth paragraph of Article 263 TFEU’. (9)

In response to that plea of inadmissibility, the EDPS contended:

–‘… primarily, that his standing to bring an action for annulment under Article 263 TFEU is justified by the need to be able to have a judicial remedy in order to defend his institutional prerogatives, in particular his independence as a supervisory authority under Article 8(3) of [the Charter of Fundamental Rights of the European Union (‘the Charter’)], and the institutional balance between the role of supervisory authorities and the role of the legislature. In that regard, he states that he has standing to bring proceedings under the case-law resulting from the judgment [in Parliament v Council], which should be applied by analogy in the present case, since that judgment shows that the protection of institutional prerogatives allows, exceptionally, an institution to defend them without it being necessary for it to satisfy the conditions of admissibility applicable to natural or legal persons under the fourth paragraph of Article 263 TFEU.’ (10)

–‘… alternatively, the EDPS maintains that he is directly and individually concerned by the contested provisions, which he has a clear and actual interest to have annulled …’ (11)

The General Court held that the action brought by the EDPS was inadmissible on the following grounds:

–First, although the EDPS is an EU body with a particular status, it is not one of the applicants referred to in the second and third paragraphs of Article 263 TFEU or an institution referred to in the list of institutions in Article 13(1) TEU.

–Secondly, in response to the reliance by the EDPS on the case-law derived from the judgment in Parliament v Council, the locus standi conferred on the Parliament then is explained by the need to fill the gap presented at that time by the absence of remedies to challenge acts of the other institutions that could infringe the Parliament’s prerogatives. In the case of the EDPS, however, he is now entitled to bring an action for annulment under the fourth paragraph of Article 263 TFEU, as a body created by an act of secondary legislation which may be treated in the same way as a legal person.

–Thirdly, the EDPS may, as an EU body, be treated in the same way as a legal person within the meaning of the fourth paragraph of Article 263 TFEU, so that, as such, he has standing to bring an action for annulment of the contested transitional provisions, provided that he is directly and individually concerned by them.

–In that connection, the contested transitional provisions amend the legal regime applicable to data protection which the EDPS is responsible for monitoring, but have no bearing on the nature or scope of the powers entrusted to the applicant by EU legislation, from which it follows that the condition that a person must be directly concerned has not been met.

–Accordingly, since the contested transitional provisions do not directly concern the legal situation of the EDPS and since the requirements that the act whose annulment is sought should be of direct concern and individual concern are cumulative, the General Court found that the action is in part inadmissible and in part manifestly inadmissible.

III.The appeal and the procedure before the Court of Justice

In his appeal, the EDPS requests that:

–the contested order be set aside;

–the contested transitional provisions be annulled;

–the defendants at first instance be ordered to bear the costs of the proceedings.

The EDPS relies in his appeal on one main ground of appeal and one in the alternative.

–In the main, the EDPS complains of an infringement of the principle of institutional balance, within the meaning of the judgment in Parliament v Council, and of his right to an effective remedy to protect his prerogative of independence.

–In the alternative, the EDPS claims that the General Court erred in finding that the EDPS was not directly concerned by the contested transitional provisions, as required by the fourth paragraph of Article 263 TFEU.

The Parliament requests that:

–The appeal be dismissed.

–The EDPS be ordered to pay the costs.

The Council requests that:

–The appeal be dismissed on the grounds that it is manifestly inadmissible or, in the alternative, manifestly unfounded.

–The EDPS be ordered to pay the costs.

The French Republic and the Commission lodged written observations in support of the Parliament and the Council.

After the reply and rejoinders were lodged, a hearing was held on 11 March 2025 at which the EDPS, the Parliament, the Council and the Commission presented oral argument.

IV.Assessment

A.The main ground of appeal

1.Arguments of the parties

(a)Admissibility

The Council contends that the main ground of appeal is inadmissible, in that the EDPS merely repeats the arguments put forward at first instance and expresses his disagreement with the contested order without clearly identifying the errors in law complained of.

The EDPS contends that his appeal specifically identifies the contested points and that, in the appeal proceedings, he is entitled to dispute the interpretation of the law given by the General Court, which, moreover, failed to provide adequate reasoning.

(b)The substance

The EDPS argues that the General Court should have recognised his legal standing to challenge the contested transitional provisions, irrespective of the conditions laid down in the fourth paragraph of Article 263 TFEU, since otherwise that would deprive an independent supervisory authority, within the meaning of Article 8(3) of the Charter, of the right to bring proceedings before a court to protect the institutional balance.

In support of that claim, the EDPS relied on the judgment in Parliament v Council, which the General Court found was not relevant for reasons which, the EDPS argues, are unfounded. Similar to the Parliament in the case which gave rise to that judgment, the EDPS currently has no remedy enabling him to defend his independence, which is protected by Article 8(3) of the Charter as an essential component of the protection of personal data.

The EDPS submits that having legal personality, unlike the Parliament in the judgment in Parliament v Council, cannot deprive him of the possibility to defend his independence, which is inevitably undermined by the retroactive nature of the contested transitional provisions.

The decisive point, the EDPS maintains, is, as the Court of Justice held, to safeguard the system for distributing powers laid down by the Treaties. That criterion requires the existence of remedies that are accessible not only to the institutions but also to a body like the EDPS, in the interests of the principle of the balance of powers.

The EDPS claims that the fact that the General Court limited the remedy available to the EDPS to that provided for in the fourth paragraph of Article 263 TFEU has created a gap in the whole system of judicial remedies established by the Treaties. Only general and autonomous standing can ensure the judicial protection of the prerogatives of the EDPS in all circumstances, without being dependent on the fulfilment of conditions which, like those laid down in the fourth paragraph of Article 263 TFEU, are met only in very exceptional circumstances. The independence of the EDPS may be affected by measures which do not directly and individually concern him but are capable of fostering a risk of ‘anticipatory obedience’.

The EDPS also complains that the General Court suggested that he is claiming a ‘privileged’ right to challenge any legislation concerning the processing of personal data. Rather, his sole aim is the recognition of his right to protect his prerogative of independence, in the terms of the judgment in Parliament v Council, and, strictly to that extent, to object to the provisions of a particular legislative act in very specific circumstances.

26.The Parliament and the Council, supported by the Commission and the French Government, propose that the main ground of appeal be dismissed on the basis that the EDPS is not entitled to bring an action for annulment other than in the circumstances laid down in the fourth paragraph of Article 263 TFEU.

27.The Parliament and the Council contend that the wording of Article 263 TFEU is clear: the authors of the Treaties did not intend the EDPS to belong to the circle of persons having legal standing to bring an action without needing to fulfil the conditions laid down in the fourth paragraph of that article.

28.The Council denies the existence of the gap complained of by the EDPS and maintains that upholding his claim would mean that the EDPS would potentially be able to challenge any legislative act concerning data protection, thereby making it difficult to amend the legislation in the field.

29.The Parliament, the Council and the Commission all subscribe to the interpretation of the judgment in Parliament v Council adopted by the General Court. They point out that the Treaties do not confer on the EDPS (a body governed by secondary legislation, partly responsible for monitoring EU data protection law) a prerogative comparable to that at issue in that case.

30.The Commission argues that the interpretation proposed by the EDPS could be applied to all Union bodies, offices and agencies, undermining the conditions laid down in the fourth paragraph of Article 263 TFEU. Those conditions, interpreted in the light of the right to an effective remedy, do not preclude the proper protection of personal data, which is the ultimate reason for the independence granted to the EDPS, without it being necessary to recognise the EDPS as having direct and general legal standing.

31.In any event, the Parliament maintains that the independence of the EDPS has not been undermined at all and that, instead, legislative power was legitimately exercised in order to amend the legislative framework for the protection of personal data.

2.Analysis

(a)Admissibility

32.Contrary to the Council’s view, I do not believe that the main ground of appeal is inadmissible.

33.Certainly, an appeal which merely repeats or reproduces verbatim the pleas in law and arguments previously submitted to the General Court does not satisfy the requirements to state reasons laid down in Articles 168(1)(d) and 169(2) of the Rules of Procedure of the Court of Justice. (12)

34.However, in accordance with the judgment in Germany v Commission, ‘the points of law examined at first instance may be argued again in the course of an appeal, provided that the appellant challenges the interpretation or application of EU law by the General Court’. (13)

35.That occurs in the present case. Although the EDPS repeats the arguments put forward at first instance as justification for the admissibility of his action for annulment, he does so while now criticising the interpretation of Article 263 TFEU provided by the General Court. The EDPS identifies (and criticises) the legal grounds of the contested order, indicating precisely the legal arguments which support his claim.

(b)The substance

36.Paragraphs 26 to 35 of the contested order set out the reasons why, in the General Court’s view, the EDPS is not entitled to bring an action without fulfilling the conditions laid down in the fourth paragraph of Article 263 TFEU.

37.The General Court points out that the EDPS is not among the institutions expressly authorised, under Article 263 TFEU, (a) to bring actions on grounds of lack of competence, infringement of an essential procedural requirement, infringement of the Treaties or of any rule of law relating to their application, or misuse of powers (second paragraph); and (b) in the case of certain institutions, to bring actions for the purpose of protecting their prerogatives (third paragraph).

38.Parties that have such standing are, specifically:

–The Member States, the European Parliament, the Council and the Commission, on which the second paragraph of Article 263 TFEU confers general standing.

–The Court of Auditors, the European Central Bank and the Committee of the Regions which, under the third paragraph of Article 263 TFEU, are entitled to bring actions for the purpose of protecting their prerogatives.

39.In addition to not being one of the parties referred to in the second and third paragraphs of Article 263 TFEU, the EDPS is not included either in the list of institutions set out in Article 13(1) TEU. With the exception of the Committee of the Regions, those institutions are the same as those on which the FEU Treaty confers the legal standing to bring proceedings now claimed by the EDPS, who is not on that list. (14)

40.The EDPS is an EU body established by a provision of secondary law. (15) As such, and in accordance with the case-law of the Court of Justice, the EDPS cannot be considered to come under the definition of ‘institutions’: pursuant to Article 13(1) TEU, that concept refers to a precise list of entities which does not include the EU bodies, offices and agencies. (16)

41.In accordance with the first paragraph, in fine, of Article 263 TFEU, ‘the legality of acts of bodies, offices or agencies of the Union intended to produce legal effects vis-à-vis third parties’ is subject to review by the Court of Justice. However, those bodies, offices and agencies are not among the persons having legal standing to seek the exercise of the Court’s jurisdiction pursuant to the second and third paragraphs of Article 263 TFEU.

42.That is a deliberate exclusion, since, as the General Court rightly observes, the inclusion of the Committee of the Regions among the applicants to which the third paragraph of Article 263 TFEU refers shows that, ‘even though the drafters of the Treaty took into consideration legal persons other than the institutions in the list of persons entitled to defend their prerogatives under that provision, they chose not to include the EDPS.’ (17)

43.The EDPS is an independent authority which is required to monitor, under Article 16(2) TFEU, compliance by the Union institutions, bodies, offices and agencies with the EU rules on data protection. (18) That factor makes the EDPS a Union body endowed with independence but not a Union institution.

44.The EDPS did not bring an action before the Court of Justice to challenge the new provisions, as he would have been obliged to do had the EDPS been a Union institution. Article 51(b) of the Statute of the Court of Justice of the European Union reserves to the jurisdiction of the Court the actions referred to in Article 263 TFEU which are brought, inter alia, by an institution of the Union against a legislative act. That conduct demonstrates that the EDPS does not consider itself an institution of the Union.

45.Rather, what the EDPS disputes are the arguments relied on by the General Court to refuse the application by analogy of the judgment in Parliament v Council, which are developed in paragraphs 38 to 55 of the contested order.

46.The EDPS thus appears to accept, at least implicitly, that the second and third paragraphs of Article 263 TFEU would lead to the outcome adopted in the contested order. However, the EDPS takes the view that the wording of those two provisions must be overridden by the considerations which led the Court of Justice, in the judgment in Parliament v Council, to recognise the Parliament as having the standing to bring an action which was at issue in that case.

47.However, I agree with the General Court’s stance on that point.

48.As a result of its reading of the judgment in Parliament v Council, the General Court ‘pointed out’ that, in that judgment, ‘the Court of Justice held that the wording of Article 173 of the EEC Treaty did not offer the Parliament any opportunity to challenge, before the Courts of the European Union, the acts adopted by the other institutions liable to infringe its own prerogatives and it chose to fill that gap by having recourse to the general principle of institutional balance.’ (19)

49.In the judgment in Parliament v Council, the Court held that:

–The Parliament’s prerogatives ‘are one of the elements of the institutional balance created by the Treaties [which] set up a system for distributing powers among the different [Union] institutions, assigning to each institution its own role in the institutional structure of the [Union] and the accomplishment of the tasks entrusted to the [Union].’ (20)

–It was necessary ‘to maintain the institutional balance and, consequently, review the observance of the Parliament’s prerogatives when called upon to do so by the Parliament, by means of a legal remedy which is suited to the purpose which the Parliament seeks to achieve.’ (21)

–In the interests of that obligation, it was the Court’s duty ‘to ensure that the provisions of the Treaties concerning the institutional balance are fully applied and to see to it that the Parliament’s prerogatives, like those of the other institutions, cannot be breached without it having available a legal remedy, among those laid down in the Treaties, which may be exercised in a certain and effective manner.’ (22)

–‘The absence in the Treaties of any provision giving the Parliament the right to bring an action for annulment may constitute a procedural gap, but it cannot prevail over the fundamental interest in the maintenance and observance of the institutional balance laid down in the Treaties establishing the European Communities’. (23)

50.Accordingly, the Court recognised the Parliament as having ‘[standing to bring] an action for annulment … against an act of the Council or the Commission … provided that the action seeks only to safeguard its prerogatives and that it is founded only on submissions alleging their infringement’. (24)

51.The situation of the EDPS is very different from that which existed in relation to the Parliament at the time when the judgment in Parliament v Council was given.

52.First, the judgment in Parliament v Council refers to the institutional balance in relation to the distribution of powers ‘among the different [Union] institutions’. As I have already explained, the EDPS is not a Union institution.

53.Secondly, in the situation dealt with by the judgment in Parliament v Council, the Parliament only had ‘ineffective or uncertain’ legal remedies available to it to defend its prerogatives. Here, by contrast, the EDPS now has at its disposal an effective and reliable remedy. The EDPS states (25) that he is able to prove that he fulfils the conditions for standing to bring an action laid down by the fourth paragraph of Article 263 TFEU. (26)

54.In admitting that that option is a possibility, specifically in relation to this case, the EDPS largely renders inoperative his first ground of appeal, as far as the application of the case-law laid down in the judgment in Parliament v Council is concerned. The basic premise of that judgment was, I repeat, that the Parliament lacked any effective and reliable legal remedies.

55.That being so, it does not matter whether or not there are other situations in which, although his prerogatives are affected, the EDPS does not have standing to bring an action before the Court of Justice under the fourth paragraph of Article 263 TFEU. (27) Whether or not situations like those indicated by the EDPS may arise, all that matters here is the specific, actual situation brought before the General Court. The determination of whether the EDPS fulfils the conditions for challenging the contested transitional provisions must be made only in relation to that situation.

56.In summary, I believe that the EDPS does not have the standing to bring an action which is provided for in the second and third paragraphs of Article 263 TFEU, which means that his main ground of appeal must be dismissed.

B.The alternative ground of appeal

1.Arguments of the parties

(a)Admissibility

57.The Council submits that this ground is also inadmissible, for the same reasons which it claims should lead to the inadmissibility of the main ground.

(b)The substance

58.The EDPS begins by criticising the lack of clarity of paragraphs 76 and 77 of the contested order, which state that the decision of 3 January 2022 ‘is an administrative decision which cannot affect legislative acts such as the [AER] or affect the content thereof’ and that, ‘although the contested provisions alter the applicable legal framework, for which the EDPS is responsible for monitoring compliance, and do not have entirely the same scope as that of the decision of 3 January 2022, they do not, however, affect his legal situation.’

59.The EDPS submits that those statements are vitiated by two errors. First, they do not point out that the exercise of the EDPS’s powers requires legal certainty and that those powers have been harmed by the adoption of retroactive measures. Secondly, they do not acknowledge that the contested transitional provisions are aimed at neutralising the ongoing effects of a specific decision and, therefore, are directed at the EDPS and at Europol.

60.The EDPS claims that it is the retroactive nature of the contested transitional provisions specifically which undermines his independence, which would not be affected at all if the legislative amendment were applied as regards the future.

61.The EDPS further claims that those provisions also affect him in a particular way as regards the exercise of his supervisory role in the field of data protection. At issue here are personal data whose protection is undermined by transitional provisions which, for the same reason, necessarily concern the EDPS.

62.The Parliament and the Council, supported by the Commission and the French Government, essentially endorse the arguments of the General Court.

63.In particular, the Parliament contends that, if it were accepted that any amendment of provisions already applied by the EDPS affects the EDPS directly, that would amount to conferring on him the status of privileged applicant, contrary to Article 263 TFEU. In the same vein, the French Government points out that this would render meaningless the criterion of direct concern.

2.Analysis

(a)Admissibility

64.The reasons which I put forward in support of the rejection of the plea of inadmissibility of the main ground of appeal, raised by the Council, may be applied to the alternative ground.

(b)The substance

65.The General Court and the institutions involved in the present proceedings all agree that the EDPS does not enjoy the standing conferred by the second and third paragraphs of Article 263 TFEU (privileged standing). They also all agree that the EDPS’s standing is conditional on fulfilment of the conditions laid down in the fourth paragraph of Article 263 TFEU. Up to this point, I am in agreement with their assessments.

66.However, I do not agree that the EDPS does not fulfil, in this case, the conditions required by the fourth paragraph of Article 263 TFEU.

67.Having ruled out the privileged standing claimed by the EDPS, I believe that the nature of the role of monitoring data protection legislation, entrusted to that body, should discourage an excessively strict interpretation of the EDPS’s ordinary standing to bring court proceedings.

68.While I stated above that the EDPS does not have the status of an institution of the Union, I must now stress that he performs an important role, enshrined in the FEU Treaty, to ensure that the institutions, bodies, offices and agencies of the Union comply with the provisions on the protection of natural persons with regard to the processing of their personal data. The performance of that role, as regards the right to bring a challenge before the Courts of the Union, should not be undermined without very sound reasons.

69.For the reasons I shall set out below, I believe that even a strict interpretation of the conditions laid down in the fourth paragraph of Article 263 TFEU would make it possible to recognise that the EDPS has the standing which he was refused in the contested order.

70.The approach which I propose does not amount to prejudging the substance of the action for annulment. During the stage of the examination of the admissibility of an action, the decision as to the substance does not need to be anticipated: it is sufficient to determine whether the applicant has adequately explained the reasons why the contested decision produces effects on his or her legal situation. (28)

71.The General Court found that the EDPS is not directly concerned by the contested transitional provisions, as required by the fourth paragraph of Article 263 TFEU because, on the one hand, those provisions amended the legislation which the EDPS is responsible for monitoring, but not his own powers, (29) and on the other, those provisions ‘leave Europol a certain discretion’. (30)

72.The approach adopted by the General Court when setting out the criteria for determining whether there is ‘direct concern’ is, in principle, correct. The Court of Justice has stressed that, in order to challenge a specific measure, two cumulative criteria must be met, ‘… namely, first, the contested measure must directly affect the legal situation of that person and, secondly, it must leave no discretion to its addressees who are entrusted with the task of implementing it, such implementation being purely automatic and resulting from EU rules alone without the application of other intermediate rules’. (31)

73.However, in assessing whether the contested transitional provisions affect the legal situation of the EDPS in this case, I believe that the General Court in fact ruled on a matter which relates to the substance of the action rather than admissibility: its central arguments concern the possible effects of the contested transitional provisions on the independence of the EDPS. In particular, the General Court found that the (alleged) retroactive nature of the contested transitional provisions is not likely to undermine the independence of the EDPS.

74.In my view, all the General Court was required to do at that stage of the proceedings was to determine whether the EDPS adequately (that is, reasonably and realistically) explained the reasons why those provisions were capable of producing that effect.

75.Something similar occurs in relation to the second condition referred to: the General Court assumed that the contested transitional provisions afford Europol a margin of discretion to decide ‘whether or not to continue the processing of certain data’, which shows that ‘the contested provisions … are not … purely automatic in nature’. (32)

76.The General Court dismissed the EDPS’s complaint (regarding the consequences of the exercise of that discretion vis-à-vis his decision of 3 January 2022), stating that ‘the contested provisions do not prevent the EDPS from exercising, as he sees fit, his own powers’. (33)

77.However, there are two objections to that finding:

–First, it again deals with the substance of the dispute by prejudging, at the stage of the assessment of admissibility, the legal effects produced by the contested transitional provisions on the situation of the person seeking to challenge those provisions. (34) It also deals with the substance of the dispute by outlining the theoretical possibility that Europol acted in a particular manner when, in fact, the reply given by Europol to the EDPS on 22 August 2022 (35) made clear that, at least, Europol was no longer implementing part of the decision of the EDPS of 3 January 2022.

–Secondly, it shifts the issue to the potential reaction of the EDPS to (future) decisions of Europol, whereas the decisive point for the resolution of the dispute was to establish whether the contested transitional provisions overrode, by themselves and on an ad hoc basis, individual decisions previously adopted by the EDPS and directed against certain conduct, also in the past, on the part of Europol. In such circumstances, it was justifiable that the ‘discretion’ granted allowed Europol, ipso facto, to disregard the contents of the decision of the EDPS of 3 January 2022.

78.Irrespective of the foregoing, I am not at all sure that the requirement of discretion must refer, in the circumstances of this case, to Europol’s conduct. If, as I understand it, the contested transitional provisions directly – and, as we shall see, also individually – concern the EDPS, it is because they produce legal effects on a specific decision of the EDPS and, to that extent, are addressed to the EDPS. The EDPS had no discretion as to the subject matter of that decision since, by operation of the contested transitional provisions, it was mandatory for that decision to be consistent with the requirements of those provisions.

79.In my view, it follows from the EDPS’s account of the facts and the summary of the facts contained in the contested order that the contested transitional provisions directly affected the EDPS. Whether they did so in disregard of his powers or by undermining his independence is, I repeat, part of the substantive issue which the EDPS raised before the General Court.

80.The contrast between the content of the decision of the EDPS of 3 January 2022 and that of the contested transitional provisions shows that it was, at the very least, legitimate to argue that, by means of the amended Europol Regulation, the legislature was seeking to ‘correct’ a decision of the EDPS which had become final (it had not been challenged by Europol).

81.Indeed:

–On the one hand, the EDPS had called on Europol to categorise, within 12 months, the datasets in its possession on 3 January 2022.

–On the other hand, the contested transitional provisions: (a) increased to 18 months, with the possibility of an extension, the period within which Europol was required to categorise the data in its possession at the time of the entry into force of those provisions, in other words, 28 June 2022; and (b) specified the conditions and procedures according to which the processing of personal data not relating to categories of data subjects listed in Annex II to the AER, which were transferred to Europol before 28 June 2022, is to be authorised in support of an ongoing criminal investigation.

82.The EDPS is taking great care in pointing out that he is not seeking to have standing to challenge all amendments to the legislative framework applicable to the content of his role. Further, he has no difficulty admitting, as he did at the hearing, that he would have no objection to the new rules if they applied to him only as regards the future.

83.However, the EDPS states that, in this case, the amendment affects him to the extent that it alters the content of a prior decision adopted by him, which is now final and which was adopted under the legislation in force, thereby creating a risk of anticipatory obedience likely to call into question his independence.

84.It is possible to dispute, as the Parliament does, that the contested transitional provisions have retroactive effect. It is also open to question, even if it is accepted that those provisions do have retroactive effect, whether they undermine the independence of the EDPS. In general terms, I believe that, where the legislature amends the substantive content of the provisions which an administrative authority is required to apply, that does not infringe the independence of that authority. (36)

85.That, I stress, is the substantive issue raised by the EDPS in his action for annulment, which cannot be avoided by dismissing it in advance. In fact, the General Court sets out in advance its substantive grounds relating to the substantive claim raised by the EDPS, as the basis for the decision to rule that the action for annulment is inadmissible.

86.The ad hoc nature of the contested transitional provisions also makes it possible to find that the condition of individual concern is satisfied, that being a point which, although the General Court did not express a view, should be addressed in the present appeal. (37)

87.In my opinion, the individual concern is clear merely from the account of the vicissitudes of the legislative procedure which ended with the adoption of the contested transitional provisions. The General Court described those in detail in paragraphs 5 to 11 of the contested order.

88.Those paragraphs describe how the legislative procedure commenced before the decision of the EDPS of 3 January 2022 was adopted, to be specific, on 9 December 2020 with a proposal for the amendment of the IER, submitted by the Commission. In Opinion 4/2021, (38) the EDPS welcomed the proposal, subject to certain reservations.

89.It is significant that, shortly after the adoption of the EDPS’s decision of 3 January 2022, the contested transitional provisions were added on 1 February 2022, following the last trilogue negotiation. All the indications are that Council Document No 5370/22 of 24 January 2022, on preparation for the trilogue, (39) was at the origin of the inclusion of those provisions. That document states that:

–‘the recent decision of the [EDPS], which could have operational consequences for Europol’s action, confirms the need for a rapid adoption of the regulation’;

–‘the Presidency proposed to the delegations to introduce a new Article 74[a] which would aim at further clarifying the situation of data currently in the possession of Europol, in particular in the context of the abovementioned decision of the EPDS of 3 January 2022’; and

–‘many delegations welcomed the principles of that proposal at the meeting of 19 January [2022], but approval by the committee is necessary in view of its recent presentation and the stakes that that subject represents following the decision of the EDPS’. (40)

90.It is difficult to dispute that the contested transitional provisions constitute a ‘tailored’ response to the decision of the EDPS of 3 January 2022 and are, therefore, addressed to the EDPS on an individual basis. Those are rules which, in the light the ‘stakes’ represented by the decision of the EDPS, which it was no longer possible to challenge because it had become final, are intended to override the content and consequences of that decision.

91.I fail to see how, in those circumstances, it can be accepted that the EDPS is not directly and individually concerned by the contested transitional provisions, since those provisions are aimed, specifically, at counteracting an individual, and now final, decision adopted by him.

92.The EDPS is required to monitor and ensure the application of the provisions of Regulation (EU) 2018/1725 (41) ‘and of any other Union act relating to the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data by a Union institution or body’. (42)

93.If, in the exercise of that competence, the EDPS requires a Union body to carry out a particular action and, in response to that decision (which becomes final), a provision specifically aimed at neutralising it is subsequently adopted, I believe that the EDPS should be recognised as having the right to bring proceedings before the EU Courts for a ruling on the validity of the (new) provision.

C.In summary, I believe that, without prejudging the substance of the matter raised by the EDPS before the General Court in relation to the validity of the contested transitional provisions, those provisions concern him to a sufficient degree to justify the locus standi which he was refused in the contested order.

94.Final settlement of the dispute

95.In accordance with Article 61 of the Statute of the Court of Justice of the European Union, if the appeal is well-founded, the decision of the General Court must be set aside, and the Court of Justice may itself give final judgment in the matter, where the state of the proceedings so permits, or refer the case back to the General Court for judgment.

96.The EDPS requests that the Court of Justice give final judgment on the substantive issue raised at first instance.

97.In my view, the state of the proceedings does not permit final judgment to be given in the matter by the Court of Justice. In fact, the EDPS himself acknowledges this, requesting the Court to give ‘final judgment, having of course given all the parties the possibility to present their observations on every aspect of the case’. (43)

98.The arguments at first instance focused on the admissibility of the action brought by the EDPS against the contested transitional provisions. While that matter was resolved, as I have explained, by deciding in advance certain aspects of the substantive issue, that issue was not the subject of a full debate but rather merely an instrumental debate solely for the purpose of deciding on the standing of the EDPS, which is disputed by the Parliament and the Council. Accordingly, the case should be referred back to the General Court for it to give judgment following the proper exchange of views.

D.Final settlement of the dispute

99.Costs

100.In accordance with Article 184 of the Rules of Procedure of the Court of Justice, and since the EDPS has applied for costs, the Parliament and the Council should be ordered to pay the costs in these proceedings while the Federal Republic of Germany and the French Republic, interveners in these proceedings, should bear their own costs.

V.Conclusion

101.On those grounds, I propose that the Court of Justice:

–allow the appeal;

–set aside the order of the General Court of 6 September 2023 in EDPS v Parliament and Council (T‑578/22, EU:T:2023:522);

–in accordance with Article 61 of the Statute of the Court of Justice, refer the case back to the General Court for it to give judgment on the substance;

–order the European Parliament and the Council of the European Union to pay the costs;

–order the Federal Republic of Germany and the French Republic to bear their own costs.

—

1Original language: Spanish.

2T‑578/22, EU:T:2023:522; ‘the contested order’.

3Regulation of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (OJ 2016 L 135, p. 53); ‘the initial Europol regulation or IER’.

4Regulation of the European Parliament and of the Council of 8 June 2022 as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role in research and innovation (OJ 2022 L 169, p. 1); I refer to the version of the Europol regulation resulting from this amendment as ‘the amended Europol regulation or AER’.

5These are two transitional provisions (Articles 74a and 74b; ‘the contested transitional provisions’) concerning, respectively, in so far as is relevant for the present purposes, the processing of personal data in support of an ongoing criminal investigation and the processing of personal data held by Europol.

6Paragraphs 3 and 5 of Article 18 (‘Purposes of information processing activities’) of the IER provided:

7‘3. Processing for the purpose of operational analyses as referred to in point (c) of paragraph 2 shall be performed by means of operational analysis projects, in respect of which the following specific safeguards shall apply:

8(a) for every operational analysis project, the Executive Director shall define the specific purpose, categories of personal data and categories of data subjects, participants, duration of storage and conditions for access, transfer and use of the data concerned, and shall inform the Management Board and the EDPS thereof;

9(b) personal data may only be collected and processed for the purpose of the specified operational analysis project. Where it becomes apparent that personal data may be relevant for another operational analysis project, further processing of that personal data shall only be permitted in so far as such further processing is necessary and proportionate and the personal data are compatible with the provisions set out in point (a) that apply to the other analysis project;

10(c) only authorised staff may access and process the data of the relevant project.

11…

Article 18(6) of the IER provided: ‘Europol may temporarily process data for the purpose of determining whether such data are relevant to its tasks and, if so, for which of the purposes referred to in paragraph 2. The Management Board, acting on a proposal from the Executive Director and after consulting the EDPS, shall further specify the conditions relating to the processing of such data, in particular with respect to access to and use of the data, as well as time limits for the storage and deletion of the data, which may not exceed six months, having due regard to the principles referred to in Article 28.’

—

8Interlocutory judgment of 22 May 1990, Parliament v Council (C‑70/88, EU:C:1990:217; ‘the judgment in Parliament v Council’).

9Paragraph 23 of the contested order.

10Paragraph 21 of the contested order.

11Paragraph 22 of the contested order.

12Judgment of 17 December 2020, Germany v Commission (C‑475/19 P and C‑688/19 P, EU:C:2020:1036; ‘the judgment in Germany v Commission’ paragraph 33), relied on by the Council.

13The judgment in Germany v Commission, paragraph 33 and the case-law cited.

14As the General Court notes in paragraph 27 of the contested order.

15Article 41(1) of Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ 2001 L 8, p. 1).

16Paragraph 29 of the contested order, which cites the judgment of 14 July 2022, Italy and Comune di Milano v Council and Parliament (Seat of the European Medicines Agency) (C‑106/19 and C‑232/19, EU:C:2022:568, paragraphs 113 and 116).

17Paragraph 32 of the contested order.

18Paragraph 33 of the contested order reads: ‘the status of the EDPS as an independent supervisory authority is mentioned in Article 16(2) TFEU, which provides that compliance with the rules relating to the protection of individuals with regard to the processing of personal data by EU institutions, bodies, offices and agencies, is to be subject to the control of independent authorities, and in Article 8(3) of the Charter, which provides that compliance with the rules on the protection of personal data is to be subject to control by an independent authority.’

19Paragraph 41 of the contested order. The judgment in Parliament v Council acknowledged (paragraph 16) that the various legal remedies which, in the judgment of 27 September 1988, Parliament v Council (302/87, EU:C:1988:461), had been deemed sufficient for the purpose of submitting for review by the Court acts of the Council or the Commission adopted in disregard of the Parliament’s prerogatives may prove to be ‘ineffective or uncertain’.

20Judgment in Parliament v Council, paragraph 21.

21Judgment in Parliament v Council, paragraph 23.

22Judgment in Parliament v Council, paragraph 25.

23Judgment in Parliament v Council, paragraph 26.

24Judgment in Parliament v Council, paragraph 27. Emphasis added.

25Paragraph 30 of his appeal.

26It is irrelevant from that perspective that, in the EDPS’s view, the fulfilment of those conditions is a consequence of the ‘very exceptional’ circumstances of this case.

27Paragraphs 32 and 33 of his appeal.

28Judgment of 6 November 2018, Scuola Elementare Maria Montessori v Commission, Commission v Scuola Elementare Maria Montessori and Commission v Ferracci (C‑622/16 P to C‑624/16 P, EU:C:2018:873, paragraph 47: ‘Given that the condition of direct concern requires the contested measure to produce effects directly on the applicant’s legal situation, the EU judicature must ascertain whether the applicant has adequately explained the reasons why the Commission’s decision is liable to place him in an unfavourable competitive position and thus to produce effects on his legal situation.’ Emphasis added.

29Paragraph 74 of the contested order.

30Paragraph 78 of the contested order.

31See, inter alia, judgment of 12 July 2022, Nord Stream 2 v Parliament and Council (C‑348/20 P, EU:C:2022:548, paragraphs 43 and 44, and the case-law cited).

32Paragraphs 80 and 82 of the contested order.

33Paragraph 83 of the contested decision.

34Judgment of 12 July 2022, Nord Stream 2 v Parliament and Council (C‑348/20 P, EU:C:2022:548, paragraph 98, and the case-law cited).

35Paragraph 13 of the contested order.

36There was a lengthy discussion of this point at the hearing which, in my view, is part of the substantive adjudication of the claims put forward by the EDPS rather than the assessment of the admissibility of the action.

37Although the General Court ruled out the existence of direct concern, its decision that the action brought by the EDPS was inadmissible could ultimately be justified on other legal grounds, inter alia, if the condition of individual concern is not met. For example, judgment of 6 November 2018, Scuola Elementare Maria Montessori v Commission, Commission v Scuola Elementare Maria Montessori and Commission v Ferracci (C-622/16 P to C-624/16 P, EU:C:2018:873), paragraph 48 and the case-law cited, and of 22 June 2021, Venezuela v Council (Whether a third State is affected (C‑872/19 P, EU:C:2021:507), paragraphs 86 and 87.

38Opinion of the EDPS of 8 March 2021 on the Proposal for Amendment of the Europol Regulation, available at https://www.edps.europa.eu/data-protection/our-work/publications/opinions/edps-opinion-proposal-amendment-europol-regulation_en.

39Available at https://data.consilium.europa.eu/doc/document/ST‑5370-2022-INIT/fr/pdf.

40Paragraph 11 of the contested order.

41Regulation (EU) of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ 2018 L 295, p. 39).

42Article 52(3) of Regulation 2018/1725.

43Paragraph 68, in fine, of his appeal.