ORDER OF THE PRESIDENT OF THE SEVENTH CHAMBER OF THE GENERAL COURT, SITTING WITH FIVE JUDGES
6 July 2026 (*)
( Protection of personal data – Regulation (EU) 2016/679 – Article 65 – Dispute resolution by the European Data Protection Board – Binding decision – Action for annulment – Intervention – Application by the European Data Protection Supervisor – Dismissal )
In Case T‑709/21 RENV,
WhatsApp Ireland Ltd, established in Dublin (Ireland), represented by E. Egan McGrath and C. Geoghegan, Senior Counsel, D. McGrath and P. Sreenan, Senior Counsel, by B. Johnston, C. Monaghan and P. Nolan, Solicitors, and by H.‑G. Kamann, F. Louis and A. Vallery, lawyers,
applicant,
v
European Data Protection Board, represented by C. Foglia, M. Gufflet, G. Le Grand and I. Vereecken, acting as Agents, and by E. de Lophem, G. Ryelandt, H. Verschueren and E. Volcansek, lawyers,
defendant,
supported by
Republic of Finland, represented by A. Laine and H. Leppo, acting as Agents,
and by
European Commission, represented by A. Bouchagiar and H. Kranenborg, acting as Agents,
interveners,
the other party to the proceedings being
Federal Republic of Germany, represented by J. Möller and V. Piegsa, acting as Agents,
intervener in the appeal,
makes the following
Order
1 By its action under Article 263 TFEU, the applicant, WhatsApp Ireland Ltd (‘WhatsApp’), seeks the annulment of Binding Decision 1/2021 of the European Data Protection Board (‘the EDPB’) of 28 July 2021 on the dispute between the supervisory authorities concerned arising from the draft decision regarding WhatsApp drawn up by the Data Protection Commission (Ireland) (‘the Irish supervisory authority’) (‘the contested decision’).
Facts prior to and subsequent to the contested decision and procedure
2 Following the entry into force of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’), the Irish supervisory authority received complaints from users and non-users of the ‘WhatsApp’ messaging service concerning the processing of personal data by WhatsApp. The Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) (Federal Data Protection and Freedom of Information Officer, Germany) also requested the assistance of the Irish supervisory authority in relation to WhatsApp’s compliance with the obligations of transparency incumbent on controllers of personal data as regards any sharing of such data with other entities in the Facebook group, renamed ‘Meta’ as of September 2021.
3 In December 2018, the Irish supervisory authority initiated of its own volition a general investigation into WhatsApp’s compliance with the obligations of transparency and the obligations to provide information with regard to individuals laid down in Articles 12, 13 and 14 of the GDPR, without prejudice to the action it might take on the individual complaints or requests made to it. The Irish supervisory authority acted in that regard as lead supervisory authority, as provided for in Article 56(1) of the GDPR.
4 After the investigation phase was completed in September 2019 with the submission of a final report by the investigator, the Irish supervisory authority, following intermediate procedural phases, submitted a draft decision in December 2020 to all the other supervisory authorities involved in the case, namely all the other supervisory authorities of the Member States, for their opinion, in accordance with Article 60(3) of the GDPR.
5 In January 2021, eight of those other supervisory authorities expressed objections to certain aspects of that draft decision. The Irish supervisory authority issued a composite response to those objections, proposing compromise positions. Although, following that response, one of those eight supervisory authorities withdrew one of its objections, the Irish supervisory authority found that a consensus had not been reached concerning other aspects objected to. It decided to reject all the objections received and to refer the matter to the EDPB for it to resolve the dispute between the supervisory authorities concerned on the aspects covered by those objections, in accordance with Article 60(4) and Article 65(1)(a) of the GDPR.
6 In June 2021, the Irish supervisory authority launched the dispute resolution procedure.
7 On 28 July 2021, the EDPB adopted the contested decision, on the basis of Article 65(2) of the GDPR. In the contested decision, the EDPB adopted a position on the issues regarding which relevant and reasoned objections had been raised, within the meaning of Article 65(1)(a) of the GDPR.
8 After the Irish supervisory authority had received the contested decision and was provided with observations from WhatsApp regarding the fines which it ultimately intended to impose on WhatsApp in the light of that decision, that authority adopted, on 20 August 2021, in accordance with Article 65(6) of the GDPR, a final decision addressed to WhatsApp (‘the final decision’).
9 In the final decision, the Irish supervisory authority found that WhatsApp had breached the principle and the obligations of transparency laid down in Article 5(1)(a), Article 12(1), Article 13(1)(c) to (f), Article 13(2)(a), (c) and (e) and Article 14 of the GDPR. By way of corrective measures adopted on the basis of Article 58(2)(b), (d) and (i) of the GDPR, that authority issued WhatsApp with a reprimand and ordered it to implement a number of actions intended to bring it into compliance, within a period of three months, with the provisions of the GDPR that had been infringed, and imposed on it four administrative fines totalling EUR 225 million. In addition, the Irish supervisory authority identified the aspects in respect of which the contested decision required it to review the assessment set out in its draft decision.
10 By application lodged at the Registry of the General Court on 1 November 2021, WhatsApp brought an action based on Article 263 TFEU, seeking the annulment of the contested decision in its entirety or, in the alternative, of the relevant parts of that decision.
11 On 1 February 2022, the EDPB lodged at the Court Registry a defence in which it claimed that the action should be dismissed as inadmissible or, in the alternative, as unfounded or, in the further alternative, that only the relevant parts of the contested decision should be annulled.
12 By a document lodged at the Court Registry on 11 February 2022, the European Data Protection Supervisor applied for leave to intervene in the case in support of the form of order sought by the EDPB.
13 The application to intervene was served on the main parties, in accordance with Article 144(1) of the Rules of Procedure of the General Court.
14 By a document lodged at the Court Registry on 14 March 2022, WhatsApp raised objections to the application to intervene in so far as it concerned some of the pleas in law put forward in the application.
15 By a document lodged at the Court Registry the same day, the EDPB stated that it raised no objection to the application to intervene.
16 By order of 7 December 2022, WhatsApp Ireland v European Data Protection Board (T‑709/21, EU:T:2022:783), the General Court dismissed the action as inadmissible. It also decided that there was no longer any need to adjudicate, inter alia, on the European Data Protection Supervisor’s application to intervene.
17 That order was appealed before the Court of Justice, which, by judgment of 10 February 2026, WhatsApp Ireland v European Data Protection Board (C‑97/23 P, EU:C:2026:81), set it aside and referred the case back to the General Court.
The application to intervene
18 The first paragraph of Article 40 of the Statute of the Court of Justice of the European Union (‘the Statute’) provides that Member States and institutions of the Union may intervene in cases before the Court. Under the first sentence of the second paragraph of Article 40 of the Statute, the same right is open to the bodies, offices and agencies of the Union and to any other person if they can establish an interest in the result of a case submitted to the Court.
19 As regards the European Data Protection Supervisor more specifically, his standing to act in proceedings before the Courts of the European Union is expressly enshrined in Article 58(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/CE (OJ 2018 L 295, p. 39), which provides that the European Data Protection Supervisor ‘shall have the power to refer the matter to the Court of Justice under the conditions provided for in the Treaties and to intervene in actions brought before the Court of Justice’.
20 In this connection, it has already been held that the European Data Protection Supervisor must establish an interest in the result of a case in order to exercise the right to intervene derived from the second paragraph of Article 40 of the Statute in a specific case, since that authority is not amongst the ‘privileged’ interveners referred to in the first paragraph of Article 40 of the Statute, which may intervene without having to establish any particular interest, and that that right is circumscribed within the limits deriving from the task entrusted to him (see, to that effect, order of the President of the Court of 21 July 2023, WhatsApp Ireland v European Data Protection Board, C‑97/23 P, EU:C:2023:609, paragraphs 9 and 10 and the case-law cited).
21 It is settled case-law that the concept of an ‘interest in the result of a case’, within the meaning of the second paragraph of Article 40 of the Statute, must be defined in the light of the precise subject matter of the case and be understood as meaning a direct, existing interest in the ruling on the form of order sought, and not as an interest in relation to the pleas in law raised or the arguments put forward. The words ‘result of a case’ refer to the final decision sought, as set out in the operative part of the forthcoming judgment or order (see order of the President of the Court of 17 September 2021, Parliament v Commission, C‑144/21, EU:C:2021:757, paragraph 10 and the case-law cited).
22 However, it should be pointed out that bodies, offices and agencies of the Union, unlike natural and legal persons, are likely to apply for leave to intervene in a case before the Court not to defend private interests, but rather, where the measure giving rise to the dispute was adopted following a procedure in which the body, office or agency in question was called upon to participate, in order to defend the opinion it had issued or the assessments it had made in the course of that procedure. Therefore, in so far as concerns applications to intervene by bodies, offices and agencies of the Union, the requirement that the applicant have a direct and existing interest in the result of a case must be applied in a way that reflects that particular situation (see order of the President of the Court of 21 July 2023, WhatsApp Ireland v European Data Protection Board, C‑97/23 P, EU:C:2023:609, paragraph 12 and the case-law cited).
23 Thus, as regards applications to intervene in a case concerning the annulment of an EU measure and made by a body, office or agency of the Union, the requirement that the relevant body, office or agency should have a direct and existing interest in the result of the case should be regarded as having been met, inter alia, if that body, office or agency is able to establish that the EU measure at issue was adopted following a procedure in which, in accordance with EU law, its participation is envisaged through, as the case may be, the adoption of opinions or the carrying out of assessments (see order of the President of the Court of 21 July 2023, WhatsApp Ireland v European Data Protection Board, C‑97/23 P, EU:C:2023:609, paragraph 13 and the case-law cited).
24 In the present case, the European Data Protection Supervisor observes that, under Article 52(3) of Regulation 2018/1725, he is responsible for monitoring and ensuring the application of the provisions of that regulation and of any other Union act relating to the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data by a Union institution or body, and for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data. To that end, he enjoys the powers set out in Article 58 of that regulation, and in particular that mentioned in paragraph 4 thereof, which is the power to intervene in actions brought before the Court of Justice of the European Union.
25 The European Data Protection Supervisor argues that the result of the present case will affect the performance of his task of ensuring the application of Regulation 2018/1725, and also his advisory role in relation to data protection legislation.
26 As regards the task referred to in paragraph 25 above, the European Data Protection Supervisor refers to Article 2(3) of the GDPR and to recitals 4 and 5 of Regulation 2018/1725 and states that the data protection rules applicable to Union institutions, bodies, offices and agencies have been aligned, as far as possible, with the data protection rules applicable to the public sector in the Member States. He submits that both the wording and the legislative history of those regulations confirm the legislature’s intention to ensure a homogeneous interpretation of their respective provisions, so as to ensure equivalent protection schemes. The present case, which is the first action for the annulment of a binding decision that has been brought before the General Court, raises important questions of principle, concerning, in particular, the concept of ‘personal data’, and also concerning other fundamental principles and rules of EU data protection legislation, such as the detailed rules for giving effect to the right to be heard.
27 It is important to note that the subject matter of the present case is an application for the annulment of a decision adopted by the EDPB on the basis of Article 65 of the GDPR, in support of which WhatsApp argues, in particular, ‘grave failings’ in the manner in which that authority exercised the powers conferred on it by that provision. Regulation 2018/1725 does not, however, contain an analogous provision, so that the question of the uniform application of those two regulations, having regard to Article 65 of the GDPR, does not appear to arise in the present case (order of the President of the Court of 21 July 2023, WhatsApp Ireland v European Data Protection Board, C‑97/23 P, EU:C:2023:609, paragraph 14).
28 It should also be noted that, in that context, the European Data Protection Supervisor claims that he can establish a direct and existing interest in the result of the case by referring to important questions of principle which, in his view, some of the pleas put forward by WhatsApp raise, even though that contradicts the settled case-law referred to in paragraph 21 above, according to which the interest required under the second paragraph of Article 40 of the Statute is to be understood as meaning a direct, existing interest in the ruling on the form of order sought.
29 Furthermore, the mere fact that the present case touches upon important questions of principle, concerning the concept of ‘personal data’ and other fundamental principles and rules of EU data protection legislation, does not suffice to establish that the European Data Protection Supervisor has an interest in the result of the case, within the meaning of the second paragraph of Article 40 of the Statute. Such an interpretation would, in practice, lead to every body, office and agency of the European Union having the right to intervene before the EU Courts whenever they consider that a case raises important questions concerning their field of action, even though such an interest, which is of a general nature, is not sufficiently direct having regard to the result of the case (see, to that effect, order of 26 October 2023, Data Protection Commission v European Data Protection Board, T‑70/23, T‑84/23 and T‑111/23, not published, EU:T:2023:683, paragraph 20).
30 As regards his role as advisor to the EU legislature, the European Data Protection Supervisor states that he is regularly requested to give his opinion on mechanisms to reinforce the protection of personal data in the context of the developing digital economy. Those mechanisms imply governance models and decision-making models to be implemented at Union level. The European Data Protection Supervisor states that he may be called upon to give his opinion on the functioning and future modification of the cooperation and consistency mechanisms provided for by the GDPR, especially in the context of the preparation of the periodic reports which the Commission is required to issue in accordance with Article 97 of the GDPR. The European Data Protection Supervisor claims that the result of the present case is therefore highly relevant to the opinions which he will be called upon to give concerning pending and future proposals for EU legislation in the field of data protection.
31 Those arguments are likewise insufficient to establish that the European Data Protection Supervisor has a direct and existing interest in the result of the case. Indeed, whatever the result of the present case and its importance for the future development of EU data protection legislation, it will have no impact on the performance of the European Data Protection Supervisor’s advisory task. That task will be carried out whatever the circumstances and it will be for that authority, where appropriate, to issue opinions to the EU legislature tailored to the solution adopted by the General Court in the present case (see, to that effect, order of 26 October 2023, Data Protection Commission v European Data Protection Board, T‑70/23, T‑84/23 and T‑111/23, not published, EU:T:2023:683, paragraph 20).
32 The European Data Protection Supervisor also argues that he participated in the adoption of the contested decision. He points out that he is a member of the EDPB and, in that capacity, is involved in the resolution of disputes between supervisory authorities, as provided for by Article 65 of the GDPR, which may concern the question of whether that regulation has been infringed. In the present case, he voted in favour of the contested decision. He states that he was also the lead rapporteur for the adoption of the EDPB’s Guidelines 03/2021 of 13 April 2021 on the application of Article 65(1)(a) of the GDPR, which is one of the provisions that WhatsApp argues has been infringed here. He therefore has an interest in supporting decisions of the EDPB such as the contested decision. His intervention would shed useful light in the adjudication of the present case.
33 In the present case, the European Data Protection Supervisor’s participation in the preparation of the contested decision was limited, according to his own statements, to voting in favour of it within the EDPB, of which he is a member. A simple vote is not sufficient to transform participating in the preparation of a decision into having played a role therein. The situation is thus different from that of the lead supervisory authority for the cases examined in the context of the EDPB’s dispute resolution mechanism, since it is in relation to that authority’s draft decision that the EDPB’s binding decision is drawn up, and from that of the other supervisory authorities concerned which raised objections to that draft decision that were not accepted by the lead supervisory authority, which thus triggered the implementation of the EDPB’s dispute resolution mechanism. The European Data Protection Supervisor cannot therefore draw a sufficient argument from his participation in the vote within the EDPB in relation to the contested decision to establish an interest in the result of the case, in accordance with the case-law mentioned in paragraphs 22 and 23 above. Furthermore, it has been held that such participation in favour of such a decision does not establish any specific interest, distinct from that of the EDPB, which is already a party to the case and in support of which the European Data Protection Supervisor wishes to intervene (see order of 26 October 2023, Data Protection Commission v European Data Protection Board, T‑70/23, T‑84/23 and T‑111/23, not published, EU:T:2023:683, paragraph 23 and the case-law cited).
34 As for the argument which the European Data Protection Supervisor draws from the fact that he was the lead rapporteur for the adoption of the guidelines referred to in paragraph 32 above, it is of the same kind as the arguments set out in paragraph 30 above, which were found to be insufficient to establish his interest in the result of the present case, in so far as that role in the preparation of such a general document is too remote from the particular procedure which led to the contested decision in the present case for it to be taken into account in accordance with the case-law referred to in paragraphs 22 and 23 above. Furthermore, it has also been held that having played such a role in the adoption of those guidelines likewise does not establish a specific interest, distinct from that of the EDPB, which is already a party to the case and in support of which the European Data Protection Supervisor wishes to intervene (see order of 26 October 2023, Data Protection Commission v European Data Protection Board, T‑70/23, T‑84/23 and T‑111/23, not published, EU:T:2023:683, paragraph 24 and the case-law cited).
35 It follows from all of the foregoing considerations that the European Data Protection Supervisor’s application for leave to intervene must be dismissed.
Costs
36 Under Article 133 of the Rules of Procedure of the General Court, the decision as to costs is to be given in the judgment or order which closes the proceedings. Since the present order closes the proceedings as far as the European Data Protection Supervisor is concerned, it is appropriate to give a decision on the costs relating to his application to intervene.
37 Under Article 134(1) of the Rules of Procedure, read in conjunction with Article 144(6) thereof, an unsuccessful applicant for leave to intervene is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings. Since the European Data Protection Supervisor has been unsuccessful in his application to intervene, and neither WhatsApp nor the EDPB has applied for costs, it is appropriate to decide that each of the three parties is to bear its own costs relating to that application.
On those grounds,
THE PRESIDENT OF THE SEVENTH CHAMBER OF THE GENERAL COURT, SITTING WITH FIVE JUDGES
hereby orders:
1. The application to intervene lodged by the European Data Protection Supervisor is dismissed.
2. The European Data Protection Supervisor, WhatsApp Ireland Ltd. and the European Data Protection Board shall each bear their own costs relating to the application to intervene.
Luxembourg, 6 July 2026.