8.5.2023

EN

Official Journal of the European Union

C 164/50

(Case T-153/23)

(2023/C 164/66)

Language of the case: English

Parties

Applicant: WhatsApp Ireland Ltd (Dublin, Ireland) (represented by: J. Killick, G. Forwood, I. Sarmas, H. Gafsen, lawyers, P. Nolan, B. Johnston, C. Monaghan, D. Breatnach, Solicitors, D. McGrath, SC, E. Egan McGrath, B. Kennedy, SC, C. Geoghegan, Barristers)

Defendant: European Data Protection Board (EDPB)

Form of order sought

The applicant claims that the Court should:

—Order the requested measures of organisation of procedure;

—Annul Binding Decision 5/2022 of the EDPB on the dispute submitted by the DPC regarding WhatsApp Ireland Limited (Art. 65 GDPR) dated 5 December 2022 (Contested decision); and

—Order the EDPB to bear WhatsApp Ireland’s costs and expenses in connection with these proceedings.

Pleas in law and main arguments

In support of the action, the applicant relies on seven pleas in law.

1.First plea in law, alleging that EDPB failed to act as an impartial body, in violation of Article 41(1) of the Charter.

2.Second plea in law, alleging that, subject to confirmation through measures of organisation of procedure, the Contested Decision was vitiated by procedural irregularities in its adoption.

3.Third plea in law, alleging that the EDPB exceeded its competence by considering matters that were outside the scope of the Complaint.

4.Fourth plea in law, alleging that the EDPB erred by instructing the Irish Data Protection Commission to find that the Applicant could not rely on contractual necessity under Article 6(1)(b) GDPR.

5.Fifth plea in law alleging that the EDPB erred in law in instructing the Irish Data Protection Commission to find an infringement of the principle of fairness, enshrined in Article 5(1)(a) GDPR.

6.Sixth plea in law alleging that the EDPB erred in law and exceeded its competence by instructing the Irish Data Protection Commission to further investigate all of WhatsApp Ireland’s data processing to determine whether it includes special categories of data pursuant to Article 9 GDPR.

7.Seventh plea in law alleging that the EDPB exceeded its competence and erred in law in instructing the Irish Data Protection Commission to impose an administrative fine.