Possibility to challenge EDPB decisions: a win for accountability

Very glad to see the EU Court of Justice confirm that EDPB binding decisions are challengeable, like the Advocate General had suggested beforehand.

I commented the AG Opinion at the time, applauding it for its clear position in the topic.

The CJEU’s reasoning is very similar to that of the AG:

– “[the EDPB’s binding decision] definitively determines, within the meaning of that case-law, the position of the competent EU body, namely the EDPB, and deals exhaustively with all the issues which that body is required to resolve” (para. 72)

– “since the EDPB’s decision produces binding legal effects vis-à-vis third parties, it is of no bearing that the scope of the national supervisory authority’s final decision encompasses aspects which do not fall within the scope of the matters referred to the EDPB or the remit of the latter” (para. 74)

– this decision thus “constitutes an act of an EU body intended to produce legal effects vis-à-vis third parties and expressing the definitive position of that body on the points to be decided by it”, and therefore is “an act open to challenge, without it being necessary to assess, at the present stage, whether that decision had the effect of bringing about a distinct change in WhatsApp’s legal position” (para. 76)

I am glad to see this, as this also paves the way for challenges to Art. 64 GDPR Opinions of the EDPB (as they are by definition binding upon SAs). A step towards more accountability!

CJEU judgment: https://lnkd.in/eHZ7SbAc
My comment on the AG Opinion: https://lnkd.in/enW-gpn7

Data protection privacy