European Union: Data Protection Commission filed case against the European Data Protection Board concerning its authority to issue binding instructions for conducting an investigation (T‑70/23)

On 14 February 2023, the Data Protection Commission (DPC) filed a lawsuit seeking to annul specific lines in paragraphs 198 and 487 of the European Data Protection Board's (EDPB) Binding Decision 3/2022 (Data Protection Commission v European Data Protection Board, Case T-70/23). The DPC argues that the EDPB exceeded its competence under Article 65(1)(a) of the General Data Protection Regulation (GDPR) by instructing the DPC to conduct a new investigation and issue a new draft decision. The DPC also alleges that the EDPB misinterpreted Articles 4(24) and 65(1)(a) of the GDPR, incorrectly asserting the authority to issue such instructions. The DPC requests that the EDPB pay the costs associated with this application.