ORDER OF THE PRESIDENT OF THE SEVENTH CHAMBER OF THE GENERAL COURT, SITTING WITH FIVE JUDGES
6 July 2026 (*)
( Protection of personal data – Regulation (EU) 2016/679 – Article 65 – Dispute resolution by the European Data Protection Board – Binding decision – Action for annulment – Intervention – Professional association – Dismissal )
In Case T‑709/21 RENV,
WhatsApp Ireland Ltd, established in Dublin (Ireland), represented by E. Egan McGrath and C. Geoghegan, Senior Counsel, D. McGrath and P. Sreenan, Senior Counsel, by B. Johnston, C. Monaghan and P. Nolan, Solicitors, and by H.‑G. Kamann, F. Louis and A. Vallery, lawyers,
applicant,
v
European Data Protection Board, represented by C. Foglia, M. Gufflet, G. Le Grand and I. Vereecken, acting as Agents, and by E. de Lophem, G. Ryelandt, H. Verschueren and E. Volcansek, lawyers,
defendant,
supported by
Republic of Finland, represented by A. Laine and H. Leppo, acting as Agents,
and by
European Commission, represented by A. Bouchagiar and H. Kranenborg, acting as Agents,
interveners,
the other party to the proceedings being
Federal Republic of Germany, represented by J. Möller and V. Piegsa, acting as Agents,
intervener in the appeal,
makes the following
Order
1 By its action under Article 263 TFEU, the applicant, WhatsApp Ireland Ltd (‘WhatsApp’), seeks the annulment of Binding Decision 1/2021 of the European Data Protection Board (‘the EDPB’) of 28 July 2021 on the dispute between the supervisory authorities concerned arising from the draft decision regarding WhatsApp drawn up by the Data Protection Commission (Ireland) (‘the Irish supervisory authority’) (‘the contested decision’).
Facts prior to and subsequent to the contested decision and procedure
2 Following the entry into force of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’), the Irish supervisory authority received complaints from users and non-users of the ‘WhatsApp’ messaging service concerning the processing of personal data by WhatsApp. The Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) (Federal Data Protection and Freedom of Information Officer, Germany) also requested the assistance of the Irish supervisory authority in relation to WhatsApp’s compliance with the obligations of transparency incumbent on controllers of personal data as regards any sharing of such data with other entities in the Facebook group, renamed ‘Meta’ as of September 2021.
3 In December 2018, the Irish supervisory authority initiated of its own volition a general investigation into WhatsApp’s compliance with the obligations of transparency and the obligations to provide information with regard to individuals laid down in Articles 12, 13 and 14 of the GDPR, without prejudice to the action it might take on the individual complaints or requests made to it. The Irish supervisory authority acted in that regard as lead supervisory authority, as provided for in Article 56(1) of the GDPR.
4 After the investigation phase was completed in September 2019 with the submission of a final report by the investigator, the Irish supervisory authority, following intermediate procedural phases, submitted a draft decision in December 2020 to all the other supervisory authorities involved in the case, namely all the other supervisory authorities of the Member States, for their opinion, in accordance with Article 60(3) of the GDPR.
5 In January 2021, eight of those other supervisory authorities expressed objections to certain aspects of that draft decision. The Irish supervisory authority issued a composite response to those objections, proposing compromise positions. Although, following that response, one of those eight supervisory authorities withdrew one of its objections, the Irish supervisory authority found that a consensus had not been reached concerning other aspects objected to. It decided to reject all the objections received and to refer the matter to the EDPB for it to resolve the dispute between the supervisory authorities concerned on the aspects covered by those objections, in accordance with Article 60(4) and Article 65(1)(a) of the GDPR.
6 In June 2021, the Irish supervisory authority launched the dispute resolution procedure.
7 On 28 July 2021, the EDPB adopted the contested decision, on the basis of Article 65(2) of the GDPR. In the contested decision, the EDPB adopted a position on the issues regarding which relevant and reasoned objections had been raised, within the meaning of Article 65(1)(a) of the GDPR.
8 After the Irish supervisory authority had received the contested decision and was provided with observations from WhatsApp regarding the fines which it ultimately intended to impose on WhatsApp in the light of that decision, that authority adopted, on 20 August 2021, in accordance with Article 65(6) of the GDPR, a final decision addressed to WhatsApp (‘the final decision’).
9 In the final decision, the Irish supervisory authority found that WhatsApp had breached the principle and the obligations of transparency laid down in Article 5(1)(a), Article 12(1), Article 13(1)(c) to (f), Article 13(2)(a), (c) and (e) and Article 14 of the GDPR. By way of corrective measures adopted on the basis of Article 58(2)(b), (d) and (i) of the GDPR, that authority issued WhatsApp with a reprimand and ordered it to implement a number of actions intended to bring it into compliance, within a period of three months, with the provisions of the GDPR that had been infringed, and imposed on it four administrative fines totalling EUR 225 million. In addition, the Irish supervisory authority identified the aspects in respect of which the contested decision required it to review the assessment set out in its draft decision.
10 By application lodged at the Registry of the General Court on 1 November 2021, WhatsApp brought an action based on Article 263 TFEU, seeking the annulment of the contested decision in its entirety or, in the alternative, of the relevant parts of that decision.
11 On 1 February 2022, the EDPB lodged at the Court Registry a defence in which it claimed that the action should be dismissed as inadmissible or, in the alternative, as unfounded or, in the further alternative, that only the relevant parts of the contested decision should be annulled.
12 By a document lodged at the Court Registry on 23 February 2022, the Computer & Communications Industry Association (‘the CCIA’) applied for leave to intervene in the case in support of the form of order sought by WhatsApp.
13 The application to intervene was served on the main parties, in accordance with Article 144(1) of the Rules of Procedure of the General Court.
14 By a document lodged at the Court Registry on 25 March 2022, WhatsApp stated that it raised no objection to the application to intervene.
15 By a document lodged at the Court Registry the same day, the EDPB raised objections to the application to intervene.
16 By order of 7 December 2022, WhatsApp Ireland v European Data Protection Board (T‑709/21, EU:T:2022:783), the General Court dismissed the action as inadmissible. It also decided that there was no longer any need to adjudicate, inter alia, on the CCIA’s application to intervene.
17 That order was appealed before the Court of Justice, which, by judgment of 10 February 2026, WhatsApp Ireland v European Data Protection Board (C‑97/23 P, EU:C:2026:81), set it aside and referred the case back to the General Court.
The application to intervene
18 In accordance with the second paragraph of Article 40 of the Statute of the Court of Justice of the European Union, applicable to proceedings before the General Court pursuant to the first paragraph of Article 53 of that statute, any person establishing an interest in the result of a case submitted to the Court, other than a case between Member States, between institutions of the European Union or between Member States, on the one hand, and such institutions, on the other hand, may intervene in that case.
19 It is settled case-law that the concept of an ‘interest in the result of a case’, within the meaning of the second paragraph of Article 40, must be defined in the light of the precise subject matter of the case and be understood as meaning a direct, existing interest in the ruling on the form of order sought, and not as an interest in relation to the pleas in law raised or the arguments put forward. The words ‘result of a case’ refer to the final decision sought, as set out in the operative part of the forthcoming judgment or order (see order of the President of the Court of 17 September 2021, Parliament v Commission, C‑144/21, EU:C:2021:757, paragraph 10 and the case-law cited).
20 In that regard, it is necessary to draw a clear distinction between prospective interveners establishing a direct interest in the ruling on the specific act whose annulment is sought and those who can establish only an indirect interest in the result of the case, by reason of similarities between their situation and that specifically referred to in that act. In principle, an interest in the result of a case can be regarded as sufficiently direct only in so far as that result is such as to change the legal position of the applicant seeking leave to intervene (see order of 6 May 2019, KPN v Commission, T‑691/18, not published, EU:T:2019:321, paragraphs 19 and 20 and the case-law cited).
21 It is settled case-law that a representative professional association, whose objective is to protect the interests of its members, may be granted leave to intervene where the case raises questions of principle which are liable to affect those interests. Therefore, the requirement that such an association have a direct, existing interest in the result of a case, within the meaning of the second paragraph of Article 40 of the Statute of the Court of Justice of the European Union, must be found to be fulfilled where that association establishes that it is in such a situation, irrespective of whether the result of the case is likely to alter the legal position of the association as such (see order of the President of the Court of 10 March 2023, Illumina v Commission, C‑611/22 P, EU:C:2023:205, paragraph 8 and the case-law cited).
22 Indeed, such a broad interpretation of the right to intervene in favour of representative professional associations is intended to facilitate assessment of the context of such cases submitted to the EU Courts while avoiding multiple individual interventions which would compromise the efficiency and the proper course of the procedure. Unlike natural and legal persons acting on their own behalf, representative professional associations are likely to apply for leave to intervene in a case before the Court not in order to defend individual interests, but rather to defend the collective interests of their members. Intervention by such an association offers an overall perspective of those collective interests, which are affected by a question of principle on which the result of the case depends, and is, accordingly, of such a nature as to enable the Court better to assess the context in which a case is submitted to it (see order of the President of the Court of 10 March 2023, Illumina v Commission, C‑611/22 P, EU:C:2023:205, paragraph 9 and the case-law cited).
23 Thus, an association may be granted leave to intervene in a case if (i) it represents a significant number of undertakings active in the sector concerned, (ii) its objects include the protection of the interests of its members, (iii) the case may raise questions of principle affecting the functioning of the sector concerned, and (iv) the interests of its members may be affected significantly by the forthcoming judgment (see order of 20 March 2024, Amazon Services Europe v Commission, T‑367/23, not published, EU:T:2024:203, paragraph 8 and the case-law cited).
24 In support of its application to intervene, the CCIA submits that each of the four conditions mentioned in paragraph 23 above is satisfied in the present case.
25 In the first place, the CCIA states that it represents an appreciable number of undertakings active in the information and communications technology sector, which carry out a wide range of activities in that sector.
26 In the second place, the CCIA states that it is clear from its bylaws that its objects include, in particular, the representation of its members and protection of their interests.
27 In the third place, the CCIA submits that, while the rules on the protection of personal data laid down in the GDPR apply to all industries, they take on special importance in the information and communications technology sector. It also submits that the legal and policy issues relating to privacy and the protection of personal data are core to its mission and objectives. In that connection, it points out that it regularly participates in public consultations on the regulation of personal data.
28 In the fourth place, the CCIA argues that the present case raises questions of principle liable appreciably to affect the functioning of the information and communications technology sector as well as the interests of its members. It states that this is the first case in which the General Court will be asked to rule on the dispute resolution mechanism provided for in Article 65 of the GDPR and to identify ground principles that could apply to similar cases in the future. It adds that the Court will be led to clarify fundamental concepts of the GDPR, such as the concept of ‘personal data’, or the obligations of transparency, as well as to clarify the scope of certain fundamental rights that come into play in proceedings concerning data protection, such as the burden of proof, the right to good administration and the principle of legal certainty.
29 As the Court of Justice has held, an association which seeks leave to intervene in a case cannot establish that the first and third conditions referred to in paragraph 23 above are satisfied where it confines itself to relying on the fact that the case raises questions of principle which concern the sector in which its members operate in circumstances where those questions also affect a considerable number of other sectors of activity. Were it otherwise, the objective referred to in paragraph 22 of the present order – which consists, in particular, in preventing multiple interventions – would be undermined. Such an association must therefore demonstrate, in addition, on the basis of objective and credible evidence, that the sector in which its members operate is impacted in a qualitatively different way compared to those other sectors (order of the President of the Court of 21 July 2023, WhatsApp Ireland v European Data Protection Board, C‑97/23 P, EU:C:2023:608, paragraph 16).
30 In the present case, as the EDPB points out, the CCIA has not, however, established that the information and communications technology sector is the ‘sector concerned’ by the questions of principle that are raised by the present dispute, in the sense that the outcome of the case would affect the functioning of that sector in a qualitatively different way compared to other sectors of activity.
31 Admittedly, the information and communications technology sector is concerned by the rules on the protection of personal data laid down in the GDPR.
32 Nevertheless, as the EDPB rightly notes in its observations on the application to intervene, those rules concern all sectors of activity in which undertakings process significant amounts of personal data in accordance with the GDPR, such as, for example, the health-care sector, the education sector, the media sector and the financial services sector. Nor does the fact that the CCIA participates in public consultations concerning personal data protection legislation distinguish it from the numerous other associations which represent other sectors of the economy that are also active in public debate on this matter, some of which specifically pursue objectives relating to it.
33 Furthermore, the arguments which the CCIA puts forward to demonstrate that the present dispute raises questions of principle liable appreciably to affect the functioning of the information and communications technology sector, as well as the interests of its members, cannot succeed.
34 Indeed, those arguments do not prove that the answers that might be given to the questions raised in the present case would be liable to affect the functioning of that sector, still less the interests of the undertakings active in that sector, in a qualitatively different way compared to undertakings active in other sectors which also process significant amounts of personal data.
35 Thus, as regards the first plea in law, alleging infringement of Article 65 of the GDPR, that plea essentially concerns the division of powers between the national supervisory authorities and the EDPB in the context of the dispute resolution mechanism provided for by that provision, rather than the manner in which undertakings in the information and communications technology sector are required to comply with the substantive provisions of the GDPR. The issues raised in the context of the fourth, fifth and seventh pleas in law, which relate respectively to an alleged shifting of the burden of proof onto WhatsApp, an alleged breach of the right to good administration and an alleged breach of the principle of legal certainty, are closely tied to the particular circumstances of the case and are not, as such, likely specifically to affect the interests of the members of the CCIA. In so far as the second, third and sixth pleas in law are concerned, the issues which they raise, relating respectively to the interpretation of the obligations of transparency imposed by the GDPR, the interpretation of the concept of ‘personal data’ and the determination of the amount of the fines under Article 83 of the GDPR, are likely to concern all economic operators that are subject to the GDPR, but are not likely to concern those active in the sector which the CCIA represents in a qualitatively different way.
36 It follows from the foregoing considerations that the CCIA has not established that it has an interest in the result of the case, within the meaning of the second paragraph of Article 40 of the Statute of the Court of Justice of the European Union, and that its application to intervene must therefore be rejected.
Costs
37 Under Article 133 of the Rules of Procedure of the General Court, the decision as to costs is to be given in the judgment or order which closes the proceedings. Since the present order closes the proceedings as far as the CCIA is concerned, it is appropriate to give a decision on the costs relating to its application to intervene.
38 Under Article 134(1), read in conjunction with Article 144(6) of the Rules of Procedure, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings. WhatsApp has not applied for costs, while the EDPB has requested that the CCIA bear its own costs.
39 It is therefore appropriate to decide that the CCIA, which has been unsuccessful in its application, is to bear its own costs and that WhatsApp and the EDPB are each to bear their own costs relating to that application.
On those grounds,
THE PRESIDENT OF THE SEVENTH CHAMBER OF THE GENERAL COURT, SITTING WITH FIVE JUDGES
hereby orders:
1. The application to intervene lodged by the Computer & Communications Industry Association is dismissed.
2. The Computer & Communications Industry Association, WhatsApp Ireland Ltd. and the European Data Protection Board shall each bear their own costs relating to the application to intervene.
Luxembourg, 6 July 2026.