European Union: Data Protection Commission filed case against European Data Protection Board over competence to issue binding instructions to conduct an investigation (T‑111/23)

On 24 February 2023, the Data Protection Commission (DPC) filed a lawsuit seeking to annul specific lines paragraphs 222 and 326(8) of the European Data Protection Board's (EDPB) Binding Decision 5/2022 (Data Protection Commission v European Data Protection Board, Case T‑111/23). The DPC argues that the EDPB exceeded its competence under Article 65(1)(a) of the General Data Protection Regulation (GDPR) by instructing the DPC to conduct a new investigation and issue a new draft decision. The DPC also alleges that the EDPB misinterpreted Articles 4(24) and 65(1)(a) of the GDPR, incorrectly asserting the authority to issue such instructions. The DPC requests that the EDPB pay the costs associated with this application.