European Union: General Court upheld European Data Protection Board’s authority to issue binding decisions instructing a national supervisory authority to conduct further investigations

On 29 January 2025, the General Court issued a judgment in the joined cases T‑70/23, T‑84/23, and T‑111/23, affirming the European Data Protection Board's (EDPB) authority under Article 65(1)(a) of the General Data Protection Regulation (GDPR) concerning the legally binding decisions. The Data Protection Commission (DPC) of Ireland challenged the EDPB's binding decisions, which required it to broaden the scope of its investigations and issue new draft decisions concerning the data processing practices of Facebook, Instagram, and WhatsApp. The General Court ruled that the EDPB has the competence to issue binding decisions requiring the lead supervisory authority to broaden its investigations and submit new draft decisions. The Court found that the EDPB's instructions were within its legal authority under Article 65(1)(a) of the GDPR. Additionally, the Court noted that the EDPB's decisions are subject to judicial review, ensuring that the lead supervisory authority's independence and ability to prioritise tasks are not compromised. The General Court dismissed the DPC's actions and ordered the DPC to pay the costs. The case originated from complaints filed in 2018 by individuals in Belgium, Germany, and Austria against Meta (formerly Facebook Ireland) and WhatsApp, alleging GDPR violations. Following objections from other EU data protection authorities to the DPC's draft decisions, particularly concerning targeted advertising and sensitive data processing, the EDPB directed the DPC to revise its findings and conduct further investigations. The DPC argued that the EDPB exceeded its authority but sought annulment of only specific provisions of the binding decisions, which the Court rejected.