Irish DPC to Challenge Fellow Regulators in Court Over ‘Problematic’ Direction

An “Open-Ended and Speculative Investigation”

The DPC’s strongly-worded statement came in the final paragraph of the press release announcing the two new Meta fines.

The EPDB’s (supposed) order requires the DPC to conduct a new investigation spanning the entirety of Facebook and Instagram’s processing operations.

The DPC stated that the EDPB directed the regulator to look into the special categories of personal data that “may or may not be processed” across Meta’s systems.

The DPC claims this investigation would be “open-ended and speculative”.

‘Problematic in Jurisdictional Terms’

The DPC argues that it is not open to the EDPB to instruct a national authority to conduct such an investigation. 

 

“The EDPB does not have a general supervision role akin to national courts in respect of national independent authorities,” the statement says.

“The direction is then problematic in jurisdictional terms…”

The DPC argues that such an order would go against the GDPR’s “cooperation and consistency” process, which seeks to resolve disputes between data protection authorities (DPAs) and ensure the consistent enforcement of data protection law across the EU.

The DPC’s claim hinges on the notion that the EDPB does not have the authority to order DPAs to bring new investigations. The body is designed to help resolve disputes over existing investigations.

A Challenge in Court

The DPC’s statement concludes that the EDPB’s instructions “may involve an overreach”.

As such, the DPC states that it will be bringing an action for annulment before the Court of Justice of the European Union (CJEU), asking the court to set aside the EDPB’s directions.

This action would presumably be taken by the DPC under Article 263 of the Treaty on the Functioning of the European Union (TFEU).

Article 263 TFEU is a process for challenging the legality of acts of EU institutions, bodies, offices, or agencies. The acts must be addressed to the person bringing the challenge or affect them directly. 

Decisions, regulations, and directives, binding agreements, non-binding instruments can be challenged under this annulment procedure.

To succeed the claimant must demonstrate that the act in question violates EU law and directly and individually affects them.

A Troubled History

The DPC has a history of disputes with its fellow regulators at the EDPB.

The two decisions against Meta announced today are just the latest in a long chain of decisions that have raised disagreements among other EU regulators.

DPC decisions against Twitter in December 2020, and against WhatsApp, Instagram and Facebook last year, all had to be revised following EDPB intervention.

But the DPC’s challenge against the EDPB’s direction will be the first time that the regulator has challenged its colleagues in court.