European Union: General Court issued ruling in lawsuit against European Data Protection Board over refusal to grant access to file concerning Meta Platforms Ireland Ltd (Lisa Ballmann v European Data/Case T-183/23)

On 16 July 2025, the General Court of the European Union (Tenth Chamber, Extended Composition) delivered its judgment in Lisa Ballmann v European Data Protection Board (EDPB)(Case T-183/23), with Meta Platforms Ireland Ltd intervening in support of the EDPB. The Court annulled the EDPB’s decision of 7 February 2023, insofar as it rejected Ms Ballmann’s request for access to the file prepared for the purposes of Binding Decision 3/2022. Her request had been made under Article 41(2)(b) of the Charter of Fundamental Rights of the European Union. Ms Ballmann had submitted a complaint under Article 77 of Regulation (EU) 2016/679 against Meta Platforms Ireland Ltd. The Court found that she had the right to access the relevant file, as it concerned her directly. This right was not conditional on her being adversely affected by the final decision. The EDPB had initially denied access on the basis that Ms Ballmann was not adversely affected, and thus not entitled to be heard under Article 41(2)(a) of the Charter. However, the Court clarified that the right to access one’s file under Article 41(2)(b) is distinct and autonomous. It is not limited to persons who are the subject of an adverse measure. The Court also held that Regulation (EU) 2016/679 contains no specific rule limiting this right of access. It rejected the EDPB’s and Meta’s attempt to draw an analogy with State aid or competition proceedings, where legal restrictions on access are expressly laid down. As a result, the EDPB was ordered to bear its own costs and those of the applicant. Meta Platforms Ireland Ltd was ordered to bear its own costs.