Lisa Ballmann v European Data Protection Board (T-183/23)

Contents

Judgment of the general Court (Tenth Chamber, Extended Composition)16 July 2025^note(Protection of personal data — Complaint against the controller of personal data of users of an online social network in the European Union — Article 65(1)(a) of Regulation (EU) 2016/679 — Binding decision of the European Data Protection Board — Complainant’s request for access to the file prepared for the purposes of the binding decision — Refusal to grant access — Action for annulment — Actionable measure — Admissibility — Article 41(2)(b) of the Charter of Fundamental Rights)In Case T‑183/23,Lisa Ballmann, residing in Innsbruck (Austria), represented by F. Mikolasch, lawyer,vEuropean Data Protection Board, represented by I. Vereecken, M. Gufflet and N. Peris Brines, acting as Agents, and by G. Ryelandt, E. de Lophem and P. Vernet, lawyers,supported byMeta Platforms Ireland Ltd, established in Dublin (Ireland), represented by M. Braun, H.-G. Kamann, F. Louis, A. Vallery, lawyers, D. Breatnach, B. Johnston, C. Monaghan, P. Nolan, L. Joyce, solicitors, D. McGrath, E. Egan McGrath, Senior Counsel and H. Godfrey, Barrister-at-Law,THE GENERAL COURT (Tenth Chamber, Extended Composition),composed of O. Porchia, President, M. Jaeger, L. Madise (Rapporteur), P. Nihoul and S. Verschuur, Judges,Registrar: S. Spyropoulos, Administrator,having regard to the written part of the procedure, in particular the order of 17 April 2024, Ballmann v European Data Protection Board (T‑183/23, not published, EU:T:2024:261), granting Meta Platforms Ireland leave to intervene in support of the European Data Protection Board,having regard to the Court’s written question to the parties of 4 December 2024,further to the hearing on 4 February 2025,gives the following

Judgment

1By her action under Article 263 TFEU, the applicant, Ms Lisa Ballmann, seeks to have set aside the decision of the European Data Protection Board (‘the EDPB’), contained in an email dated 7 February 2023, rejecting her request for access, made on the basis of Article 41(2)(b) of the Charter of Fundamental Rights of the European Union (‘the Charter’), to the file prepared for the purposes of Binding Decision 3/2022 of the EDPB relating to the dispute, submitted by the Data Protection Commission (Ireland) (‘the Irish supervisory authority’), concerning the intervener, Meta Platforms Ireland Ltd (‘Meta’), and its Facebook service (‘the contested decision’).

Background to the dispute and events subsequent to the action being brought

2On 25 May 2018, the applicant, acting through the non-profit association NOYB – European Center for Digital Rights (‘NOYB’) lodged a complaint with the Österreichische Datenschutzbehörde (Austrian Data Protection Authority) pursuant to Article 77 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1), against Facebook Ireland Ltd (which, in 2022, became Meta), concerning the processing of data related to the use of the social network Facebook. The complaint alleged possible infringements of a number of provisions of that regulation, and, in particular, Articles 6 and 9 thereof.

3On 30 May 2018, the Austrian Data Protection Authority sent the complaint to the Irish supervisory authority, concluding that, in view of the cross-border nature of the processing of data related to the use of the social network Facebook and Meta’s place of establishment in Ireland, the Irish supervisory authority was the authority competent to act as a ‘lead supervisory authority’, in accordance with Article 56(1) of Regulation 2016/679.

4On 6 October 2021, following the investigation it had carried out, the Irish supervisory authority submitted to the other supervisory authorities concerned, that is to say, all the supervisory authorities of the Member States and other States party to the Agreement on the European Economic Area (EEA), a draft decision, as provided for in Article 60(3) of Regulation 2016/679. A number of those other authorities raised relevant and reasoned objections, within the meaning of Article 4(24) of that regulation, to certain assessments contained in that draft decision.

5After having received the Irish supervisory authority’s draft decision, the applicant, following a difference of opinion between the applicant and that authority regarding the confidentiality of that draft decision and other documents exchanged in the course of the procedure, was no longer involved in that procedure. In particular, she did not receive a copy of the relevant and reasoned objections of the supervisory authorities concerned, and, unlike Meta, she was unable submit comments on those objections and did not have access to Meta’s observations.

6On 25 July 2022, after having corresponded with the other supervisory authorities concerned and having decided not to follow certain relevant and reasoned objections drafted in relation to its draft decision, the Irish supervisory authority referred the matter to the EDPB under the consistency mechanism established by Regulation 2016/679, in accordance with Article 60(4) thereof, in order for it to adopt a position on those objections by adopting a binding decision based on Article 65(1)(a) of that regulation.

7On 10 August 2022, NOYB wrote to the EDPB in order to avoid, in its view, a continuing infringement in the procedure before that body of the applicant’s right to be heard and of the principle of equal treatment, enshrined in Articles 41 and 20 of the Charter respectively. NOYB invited the EDPB to comply with those provisions by allowing it to be heard after having given it access to the complete case file.

8By letter dated 21 November 2022, the EDPB replied to NOYB that, in accordance with Article 41(2)(a) of the Charter and Article 11 of its Rules of Procedure, it was responsible for ensuring that any party likely to be adversely affected by a binding decision adopted on the basis of Article 65(1)(a) of Regulation 2016/679 was heard before such a decision was adopted. It recalled that its decisions were addressed to the lead supervisory authority and the supervisory authorities concerned, to the exclusion of any other party, and that, in the context of Article 65(1)(a) of Regulation 2016/679, it was not required to carry out a full examination of the lead supervisory authority’s draft decision or of that authority’s decision-making process. It informed NOYB that, following a thorough analysis of the scope of the dispute, it had concluded that the applicant was not likely to be adversely affected by the binding decision which it would be called upon to take in the procedure in question and that she therefore did not have the right to be heard before it.

9On 5 December 2022, the EDPB issued Binding Decision 3/2022. In paragraph 19 of that decision, the EDPB states that it concludes that the applicant is not likely to be adversely affected by that decision, and consequently that she does not meet the conditions to be granted a right to be heard by it in line with Article 41 of the Charter, the applicable case-law and Article 11 of its Rules of Procedure. It is stated, in the same paragraph, that that is without prejudice to any right to be heard or related rights which the applicant may have before the national supervisory authorities.

10On 31 December 2022, the Irish supervisory authority adopted a final decision, in accordance with Article 60(7) of Regulation 2016/679, for the purposes of implementing Binding Decision 3/2022.

11By email dated 6 January 2023, NOYB requested the EDPB to send to it Binding Decision 3/2022, the Irish supervisory authority’s final decision, together with the relevant and reasoned objections raised by the supervisory authorities concerned in relation to the draft decision of the Irish supervisory authority, relying on Article 41 of the Charter, Articles 60 and 65 of Regulation 2016/679, and ‘the right to access to documents under EU law’.

12In response to that email, the EDPB informed NOYB on 11 January 2023 that it would provide it with internet links to the text of the requested decisions as soon as they were published and that its request for access to the relevant and reasoned objections would be treated as a request for access to documents in accordance with Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ 2001 L 145, p. 43). On the same day, NOYB informed the EDPB that it had received the Irish supervisory authority’s final decision. On 12 January 2023, the EDPB provided NOYB with the internet link to the text of Binding Decision 3/2022.

13By email dated 25 January 2023, NOYB submitted to the EDPB a new request for access to the EDPB’s entire case file, relying primarily on the applicant’s rights under Article 41 of the Charter ‘as a party’ as well as ‘any other legal basis’, such as Article 42 of the Charter, Article 15 TFEU or Regulation No 1049/2001.

14On 26 January and 2 February 2023, referring to NOYB’s email dated 6 January 2023, the EDPB granted NOYB full access to some of the relevant and reasoned objections requested and partial access to some of the other requested objections, on the basis of Regulation No 1049/2001.

15On 31 January 2023, in response to a request from the EDPB to NOYB for clarification, NOYB stated that its request for access to the file was mainly based on Article 41 of the Charter, ‘but also on any other legal basis’, and was not limited to relevant and reasoned objections.

16In the contested decision, first, the EDPB, considering the request for access to the file under Regulation No 1049/2001, invited NOYB to clarify the scope of that request, in accordance with Article 6(2) of that regulation, and to accept a fair solution pursuant to paragraph 3 of that article. Second, it stated that, in parallel, it had made a thorough assessment of the request for access to the file under Article 41(2)(b) of the Charter and that it had concluded that the applicant, as the complainant, did not have a right of access on that basis. As regards the latter aspect, the EDPB referred in particular to paragraph 19 of Binding Decision 3/2022 (see paragraph 9 above) and to its letter dated 21 November 2022 (see paragraph 8 above), reiterating that the applicant was not likely to be adversely affected by that binding decision.

17The applicant brought the present action by application lodged at the Registry of the General Court on 7 April 2023.

18By decision of 12 April 2023, the EDPB, on the basis of Regulation No 1049/2001, granted NOYB full access to some of the documents requested by it in its email dated 25 January 2023 and partial access to some of the other documents requested.

Forms of order sought

19The applicant claims that the Court should:– annul the contested decision in so far as the EDPB rejects her request for access to the file pursuant to Article 41(2)(b) of the Charter;– order the EDPB to pay the costs of the proceedings;– order Meta to bear its own costs.

20The EDPB contends that the Court should:– dismiss the action as being inadmissible,– in the alternative, dismiss the action as being unfounded;– order the applicant to pay the costs and, failing that, order Meta to bear its own costs.

21Meta contends that the Court should:– dismiss the application as being inadmissible,– in the alternative, dismiss the action as being unfounded;– order the applicant to pay the costs, including those incurred by it.

Law

Whether the action is admissible

22The EDPB submits that the action is inadmissible on the ground that the contested decision does not bring about a change in the applicant’s legal position. In its view, the action is merely an intermediate act as regards the applicant, an act by which the applicant sought to obtain clarification of the subject matter of its request for access, in accordance with Article 6(2) of Regulation No 1049/2001, and to find a fair solution with it pursuant to paragraph 3 of that article, having regard to the large number of documents concerned, which, moreover, the applicant accepted. The contested decision therefore does not contain a final position of the EDPB regarding the substance of the request for access and, in particular, does not reject it.

23In that regard, the EDPB states that it dealt with the applicant’s request for access under one of the various legal bases put forward by NOYB in its email dated 25 January 2023, in the present case Regulation No 1049/2001, and that that resulted in it sending numerous documents to it, both prior to and subsequent to the contested decision. It maintains that the sole purpose of that request was to obtain certain documents, irrespective of the legal basis relied on. Accordingly, the applicant submitted an application founded on a number of legal bases, rather than a number of applications, each founded on a different legal basis. Referring to its decision of 12 April 2023 (see paragraph 18 above), it argues that, on the basis of Regulation No 1049/2001, the applicant ultimately had access to the same documents as if her request had been examined under Article 41(2)(b) of the Charter.

24Meta maintains that the action is inadmissible on the ground that the contested decision, in so far as it relates to Article 41(2)(b) of the Charter, is merely a measure confirming the EDPB’s response contained in its letter to NOYB dated 21 November 2022 (see paragraph 8 above), which was itself merely an intermediate act in the procedure which led to the adoption of Binding Decision 3/2022. By that letter, the EDPB rejected the applicant’s request for access made on 10 August 2022 (see paragraph 7 above). That rejection could have been challenged only in the context of an action against Binding Decision 3/2022 closing that procedure.

25The applicant maintains that its action is admissible.

26According to settled case-law, an action for annulment, provided for in Article 263 TFEU, must be available against all acts adopted by the institutions, bodies, offices or agencies of the European Union, whatever their nature or form, which are intended to have legal effects capable of affecting the interests of the applicant by bringing about a distinct change in his or her legal position (see, to that effect, judgments of 11 November 1981, IBM v Commission, 60/81, EU:C:1981:264, paragraph 9, and of 18 November 2010, NDSHT v Commission, C‑322/09 P, EU:C:2010:701, paragraph 45 and the case-law cited).

27In order to determine whether an act produces binding legal effects, it is necessary to examine the substance of that act and to assess those effects on the basis of objective criteria, such as the content of that act, taking into account, as appropriate, the context in which it was adopted, and the powers of the institution which adopted the act (see judgment of 20 February 2018, Belgium v Commission, C‑16/16 P, EU:C:2018:79, paragraph 32 and the case-law cited).

28In that regard, it is, in principle, acts which definitively determine the position of the institutions, bodies, offices or agencies of the European Union upon the conclusion of an administrative procedure, and which are intended to have legal effects capable of affecting the interests of the applicant, which are open to challenge, and not intermediate measures whose purpose is to prepare for the definitive decision or measures which are mere confirmation of an earlier measure which was not challenged within the prescribed period (see judgment of 25 June 2020, SatCen v KF, C‑14/19 P, EU:C:2020:492, paragraph 70 and the case-law cited).

29In the first place, the plea of inadmissibility put forward by the EDPB is based on the premiss that, in the contested decision, it did not rule on the request for access based on Article 41(2)(b) of the Charter, having chosen to deal with the request for access solely under Regulation No 1049/2001, a legal basis also relied on in NOYB’s email dated 25 January 2023 (see paragraph 13 above), which would have led to the same result as if it had applied the provision mentioned above. That premiss is incorrect.

30The contested decision constitutes a response from the EDPB to the request for access to the file contained in NOYB’s email dated 25 January 2023. In that email, the applicant based that request principally on Article 41 of the Charter and, additionally, ‘on any other legal basis’, that is to say, in essence, Regulation No 1049/2001.

31It is apparent from the contested decision that, in that decision, the EDPB ruled both on the request for access based on Article 41 of the Charter, correctly understanding that paragraph 2(b) of that article was more specifically referred to, and on the request based on Regulation No 1049/2001. Accordingly, as regards the request for access under that regulation, it invited the applicant to clarify its scope and to accept a fair solution. To that extent, as the EDPB maintains, the contested decision is merely an intermediate measure the purpose of which is to prepare for the definitive decision – which was made in the present case on 12 April 2023 (see paragraph 18 above) – which has no binding legal effect capable of affecting the applicant’s interests. That part of the contested decision is not, however, the subject of the present action.

32As regards the request for access to the file under Article 41(2)(b) of the Charter, the EDPB stated that it had assessed it ‘thoroughly’, before concluding that it ought to be rejected on the ground that the applicant, since it was not likely to be adversely affected by Binding Decision 3/2022, did not enjoy such a right of access. Consequently, it must be stated that the contested decision contains a refusal to grant access to the file requested by the applicant on the basis of Article 41(2)(b) of the Charter. In addition, since the request for access to the file and, as a result, the contested decision took effect at a time when both Binding Decision 3/2022 and the final decision of the Irish supervisory authority had already been adopted, it must be held that the contested decision definitively fixes the EDPB’s position in relation to that request for access, in so far as it is based on Article 41(2)(b) of the Charter, and immediately and irreversibly affects the applicant’s legal position as regards any right of access she might have to the EDPB file.

33The fact that, in parallel, the EDPB examined the request for access on the basis of Regulation No 1049/2001 does not call into question the foregoing conclusions. The right of access to the file, enshrined in Article 41(2)(b) of the Charter, and the right of public access to documents of the institutions, laid down in Regulation No 1049/2001, fall within two different legal regimes.

34Accordingly, first of all, those two rights do not have the same beneficiaries: while the right of access to documents is granted to any EU citizen and to any natural or legal person residing or having its registered office in a Member State, the right of access to the file is enjoyed by the person in relation to ‘his or her file’, that is to say the file of the person who holds the right himself or herself.

35Next, those two rights do not necessarily relate to the same documents: the right of access enshrined in Article 41(2)(b) of the Charter applies to the file of the person concerned by it, whereas the right of access laid down in Regulation No 1049/2001 applies to any document of an institution, irrespective of whether there is a file on a person concerned.

36Furthermore, while Articles 7 and 8 of Regulation No 1049/2001 lay down a two-stage administrative procedure which occurs before any action before the EU Courts, no such requirement exists in relation to a request for access to the file under Article 41(2)(b) of the Charter.

37Finally, the right of access to documents is subject to certain limitations based on grounds of public or private interest. More specifically, Article 4 of Regulation No 1049/2001 lays down a system of exceptions permitting the institutions to refuse access to a document where disclosure would undermine the protection of one of the interests protected by that article. As to the right of access to the file, that is limited only by ‘respecting the legitimate interests of confidentiality and of professional and business secrecy’. It should be added that the latter difference between the two regimes means that it is not guaranteed that a request for access based on Regulation No 1049/2001 will, in all circumstances, lead to the same result, as regards the documents disclosed, as if that request had been made on the basis of Article 41(2)(b) of the Charter. In that regard, it should be noted that, at the hearing, in response to a question from the Court, and contrary to its assertions in its written pleadings, the EDPB acknowledged that, in the present case, the applicant had had wider access to documents under the latter provision than the access which she had enjoyed under Regulation No 1049/2001.

38It follows that the plea of inadmissibility raised by the EDPB must be rejected.

39In the second place, as regards the argument that the contested decision is purely confirmatory, it is sufficient to state that that argument is based on a misinterpretation of the EDPB’s letter dated 21 November 2022. By that letter, which was sent at a time when the procedure laid down in Article 65(1)(a) of Regulation 2016/679 was ongoing, the EDPB was replying to NOYB’s letter dated 10 August 2022 (see paragraph 7 above), which invited the EDPB to allow NOYB to exercise its right to be heard after having given it full access to the case file. In its response, the EDPB gave a ruling exclusively on the applicant’s right to be heard prior to the adoption of the binding decision, denying her such a right and referring in that regard only to Article 41(2)(a) of the Charter and Article 11 of its Rules of Procedure, which provides, in particular, that, before taking such a decision, the EDPB is to ensure that all persons ‘that would be adversely affected … have been heard’. In its letter dated 21 November 2022, the EDPB did not take a position on the possibility of access to the file under Article 41(2)(b) of the Charter. It follows that the contested decision cannot be regarded as merely confirming that letter.

40That is all the more so since, as stated in paragraph 30 above, that decision is in fact a response from the EDPB to the request for access to the file contained in NOYB’s email dated 25 January 2023. As it confirmed at the hearing, the EDPB treated the request for access to the file of 25 January 2023 as a new request as compared with the request submitted by NOYB on 10 August 2022. Indeed, that request was submitted after the adoption of both Binding Decision 3/2022 and the Irish supervisory authority’s final decision intended to implement that binding decision. It therefore related to a file which was more complete than the file initially referred to. As it is dynamic by nature, an administrative file is likely to evolve over time in line with the material or documents added to it.

41Consequently, the action must be regarded as admissible.

Substance

42In support of the action, the applicant relies on a single plea in law, alleging infringement of Article 41(2)(b) of the Charter, and which is divided into four parts. In the first part of the plea, she submits that access to the file under that provision is not subject to the condition that the access applicant be adversely affected by a measure adopted on the basis of that file, the only applicable criterion being that the file concerns that applicant. In the second part of the plea, she maintains that the EDPB file to which she requested access concerns her. In the third part of the plea, she asserts that the right of access to the file laid down in that provision is independent of the right to be heard laid down in Article 41(2)(a) of the Charter. In the fourth part of the plea, which is raised in the alternative, she argues that, in any event, she is adversely affected by Binding Decision 3/2022.

43The first, second and third parts of the plea will be examined together, since they are based on complementary arguments.

44In the first part, the applicant states that the EDPB’s refusal to grant her access to the file in the contested decision takes as its basis the observation that she is not likely to be adversely affected by Binding Decision 3/2022. Article 41(2)(b) of the Charter, unlike Article 41(2)(a) of the Charter, does not lay down such a requirement, but makes the right of access to the file subject only to the condition that the file concerns the access applicant.

45In the second part of the plea, the applicant maintains that there appears to be no doubt that the EDPB file to which she requested access concerns her, in accordance with Article 41(2)(b) of the Charter, since Binding Decision 3/2022 relates to a case opened following the complaint against Meta lodged by her, pursuant to Article 77 of Regulation 2016/679, as set out in paragraph 3 of that decision. In that decision, the complaint and the complainant are referred to more than 160 times.

46In the third part of the plea, the applicant submits that the right of access to the file under Article 41(2)(b) of the Charter is autonomous compared with the right to be heard which is referred to in Article 41(2)(a) of the Charter and that its scope is wider than the scope of the right to be heard. The right to be heard primarily forms part of the rights of the defence, whereas the right to have access to the file forms part of the principle of equality of arms and the right to an effective remedy. The Court addresses the two rights separately and does not make the right of access to the file conditional on the right to be heard in the proceedings.

47In the reply, the applicant sets out the arguments alleging that the right of access to the file is autonomous in nature. In that context, she states, inter alia, that, in accordance with Article 52(1) of the Charter, any limitation on the exercise of the rights and freedoms recognised by the Charter must be provided for by law and she puts forward a number of arguments addressing the literal, teleological and systematic interpretation, in particular, of Article 41(2)(b) of the Charter. As regards the latter aspect, she submits, inter alia, that her complaint was ‘handled’, within the meaning of Article 41(1) of the Charter, in the context of the procedure at issue, that, as for the right of every person to have access to personal data collected concerning him or her, enshrined in Article 8(2) of the Charter, a person’s right of access to his or her file must be capable of being exercised independently of the exercise of another right or of the fact that he or she is adversely affected, and that the use which the person concerned makes of the file concerning him or her is irrelevant.

48In the defence, the EDPB provides an overall response dealing with the first three parts of the single plea, maintaining, in essence, that Article 41(2)(b) of the Charter applies only in situations where the person requesting access to the file is likely to be adversely affected by the decision to which that file relates.

49In that regard, in the first place, the EDPB submits that it follows from the wording of Article 41(2) of the Charter that the right of access to the file is a ‘sub-component’ of the right to good administration and that that right, the general scope of which is defined in Article 41(1) of the Charter, does not constitute an autonomous right. The right of access to the file is therefore ‘individualistic’, its scope being limited to persons whose ‘affairs’ are handled by the institutions, bodies, offices and agencies of the European Union.

50In the second place, the EDPB maintains that the non-autonomous character of the right to good administration, of which the right of access to the file is a sub-component, implies that a person will have a right of access to the file only if a refusal to provide such access might have a bearing on the outcome of the proceeding, thereby actually affecting the applicant’s rights of defence. The right of access to the file is, like the right to be heard, a component of the rights of the defence. Therefore, persons who cannot rely on actual rights of defence, that is to say, persons who are not subject to proceedings opened against them and liable to culminate in a measure adversely affecting them, do not enjoy a right of access to the file under Article 41(2)(b) of the Charter.

51In the rejoinder, the EDPB also disputes the applicant’s arguments based on a literal, teleological and systematic interpretation of Article 41(2)(b) of the Charter. First, the EDPB is of the view that the applicant’s reference to Regulation 2016/679 in support of a literal interpretation of the Charter is incorrect from a methodological point of view and ignores the hierarchy between an act of secondary EU law and primary EU law. In any event, Article 41 of the Charter refers to the handling of a person’s ‘affairs’ or ‘file’, whereas Regulation 2016/679 refers to the handling of complaints, which is a different operation, apart from the fact that it cannot be concluded, in the present case, that the EDPB handled the applicant’s affairs or file. Second, the EDPB maintains that the right of access to the file under Article 41(2)(b) of the Charter is not unconditional and it disputes the relevance of the analogy with a person’s right of access to his or her own personal data which have been collected. The EDPB states that the purpose of the right of access to the file is to observe the rights of the defence and the principle of equality of arms, by allowing persons subject to measures which may adversely affect them to examine the documents relevant for their defence, and cannot therefore be understood in isolation. In the present case, the applicant has not demonstrated that the EDPB’s refusal to grant her access to the file infringed her rights of defence. Since Binding Decision 3/2022 is not addressed to, and does not affect, the applicant, that refusal cannot adversely affect her. The applicant has available to her national remedies to challenge the final decisions of competent supervisory authorities with which she is not satisfied and, where such a decision implements a binding decision adopted by the EDPB and the validity of that decision is called into question, the national court must refer a question to the Court of Justice for a preliminary ruling as to validity pursuant to Article 267 TFEU.

52Meta, in the first place, maintains that, in the context of the procedure laid down in Article 65(1)(a) of Regulation 2016/679, which is administrative in nature, that regulation does not provide the complainant with a right to be heard or to have access to the EDPB file. In that regard, it draws a parallel with the procedures for applying the EU competition rules, stating that, in those proceedings, the undertakings under investigation and complainants are not in the same procedural situation. The procedural rights of complainant undertakings are not as far-reaching as the rights of defence of the undertaking under investigation. They have only restricted access to the file in specific circumstances, in particular, if the intention is to reject their complaint. There is nothing in Regulation 2016/679 justifying putting the complainant in the same procedural situation as the party under investigation. Neither Regulation 2016/679 nor the EDPB’s Rules of Procedure grant the complainant a right to access to the file. In addition, the principle of equality of arms does not apply between the complainant and the party under investigation in the procedure laid down in Article 60 or Article 65(1)(a) of Regulation 2016/679.

53In the second place, Meta submits that the applicant also has no right of access to the EDPB file on the basis of Article 41(2)(b) of the Charter. It maintains that that right forms part of all the rights of the defence provided for in Article 41(2) of the Charter and that the access applicant must therefore establish that he or she is adversely affected by the procedure in order to have such a right. It is not sufficient for the access applicant to be concerned by the file in that procedure. In the present case, the applicant’s request for access to the file does not relate, in particular, to the right to be heard. Moreover, the applicant did not bring an action against Binding Decision 3/2022 on the basis of an alleged breach of its rights of defence. In reality, her request for access to the file is motivated by her intention to participate in other proceedings before national courts involving, inter alia, Meta.

54In her observations on the statement in intervention, the applicant refers to the judgment of 7 December 2023, SCHUFA Holding (Discharge from remaining debts) (C‑26/22 and C‑64/22, EU:C:2023:958), in which the Court of Justice held that complainants are entitled to have a decision adopted in respect of that complaint and that that decision is subject to full judicial review, as provided for in Article 78 of Regulation 2016/679. That implies both a right to be heard and a right of access to the file. Those principles ought also to apply where the examination of the complaint leads to the use of the consistency mechanism in which the EDPB acts by adopting a binding decision. In addition, the Proposal for a regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation 2016/679 (COM(2023) 348 final), both in the version which followed from the amendments proposed by the European Parliament and in the version found in the mandate of the Council of the European Union, provides for a right of access to the file for complainants and controllers. Furthermore, the applicant disputes the relevance of the parallel which Meta draws with the procedures applying the EU competition rules.

55In that regard, Article 41 of the Charter, entitled ‘Right to good administration’, states, in paragraph 1 thereof, that ‘every person has the right to have his or her affairs handled impartially, fairly and within a reasonable time by the institutions, bodies, offices and agencies of the Union’.

56Article 41(2) states that that right ‘includes’:(a) the right of every person to be heard, before any individual measure which would affect him or her adversely is taken;(b) the right of every person to have access to his or her file, while respecting the legitimate interests of confidentiality and of professional and business secrecy;(c) the obligation of the administration to give reasons for its decisions’.

Whether the right of access to the file is autonomous from the right to be heard

57It should be noted at the outset that, as is common ground between the parties, there is no legal text specifically regulating or, a fortiori, limiting the right of the person lodging a complaint under Article 77 of Regulation 2016/679 to have access to the EDPB file prepared for the purposes of the adoption of a binding decision under Article 65(1)(a) of that regulation. In particular, limitations on the exercise of that right cannot be found either in Regulation 2016/679 or in the EDPB’s Rules of Procedure, as the EDPB confirmed in response to a question put by the Court at the hearing.

58In those circumstances, it is necessary to determine whether Article 41(2)(b) of the Charter grants the person making such a complaint a right of access to such a file or whether the exercise of that right is subject to the right to be heard enshrined in Article 41(2)(a) of the Charter.

59The parties disagree as to whether the right of access to the file referred to in that provision is autonomous. According to the argument put forward by the EDPB and Meta, that right is not autonomous, but is a corollary of the principle of respect for the rights of the defence, which has the consequence that it can benefit only persons against whom proceedings have been initiated and which are liable to culminate in a measure adversely affecting them. The applicant, by contrast, is of the view that that right is independent of the principle of respect for the rights of the defence and is subject solely to the condition that the file ‘concerns’ the person requesting access to it.

60It should be noted at the outset that, in the present case, the request for access to the EDPB file was submitted by the applicant at a time when the administrative procedure which resulted in the adoption of Binding Decision 3/2022 had already been closed and the Irish supervisory authority had already implemented that decision by its final decision of 31 December 2022 (see paragraphs 30 and 40 above). The purpose of that request was to enable the applicant not to pursue a possible right to be heard during the procedure before the EDPB, as Meta moreover points out, but to obtain information on the conditions under which those decisions were drafted and, in particular, to verify whether, and to what extent, the constituent elements of her complaint had been taken into consideration and a decision made on them, in order to be able, as the case may be, effectively to defend her position in the national judicial proceedings connected with Binding Decision 3/2022. At the hearing, the applicant accordingly stated that the question of a possible breach of her right to be heard during the procedure before the EDPB was not the subject of the present proceedings.

61As the applicant correctly submits, the wording of Article 41(2)(b) of the Charter does not limit a person’s right of access to his or her file to the fact that that file relates to a measure liable to affect him or her adversely. It is true that such a requirement is contained in Article 41(2)(a) of the Charter, which enshrines the right to be heard, but nothing in the wording of those provisions, or in the wording of Article 41 of the Charter considered as a whole, makes the exercise of the right to access to the file subject, as a matter of principle, to the exercise of the right to be heard.

62While it is true that the right of access to the file is a necessary prerequisite for the effective exercise of the rights of the defence, its scope may nevertheless be more extensive. That is, moreover, the situation for the applicant, who, as stated in paragraph 60 above, requested access to the EDPB file not in order to be heard and to ensure her defence in an ongoing administrative procedure, but in order to ascertain its content in order to assess whether to bring a legal action. The right of access to the file referred to in Article 41(2)(b) of the Charter cannot therefore be reduced to being a corollary of the principle of respect for the rights of the defence.

63Article 41(2)(b) of the Charter must be read in conjunction with Article 41(1) thereof, as meaning that the right of access to the file is associated with the right of every person to have his or her affairs handled impartially, fairly and within a reasonable time by the administration of the European Union. The administration of the European Union does not limit itself, when handling the affairs of natural or legal persons, to taking measures which are, or are likely to be, unfavourable to such persons. The fact of being required to handle a person’s affairs fairly may, in particular, be interpreted as implying an obligation to communicate to that person the administrative file concerning him or her.

64Account must also be taken of the fact that the right of access to the file referred to in Article 41(2)(b) of the Charter is a component of the ‘right to good administration’, which is the subject of Article 41 of the Charter as a whole. Article 41 does not relate solely to the exercise of the right to be heard by the administration of the European Union, which is specifically covered by Article 41(2(a) of the Charter, but has a broader scope, also encompassing other rights or principles which that administration must observe in its relations with natural and legal persons. Thus, more specifically, the principle that affairs must be handled within a reasonable time (Article 41(1) of the Charter), the obligation on the EU administration to give reasons for its decisions (Article 41(2)(c) of the Charter), the principle that the European Union is required to make good any damage caused by its administration (Article 41(3) of the Charter) and the principle that the EU administration is required to communicate with citizens in the language of the European Union used by them (Article 41(4) of the Charter) are not limited to situations in which the rights of the defence are to be applied.

65Consequently, it must be concluded that a person has a right of access to his or her file, even if that person is not in a situation in which he or she could assert his or her right to be heard, subject, however, as will be further clarified below, to there being no specific rules in the field at issue limiting the exercise of that right of access to the file in accordance with the requirements of Article 52(1) of the Charter.

66The conclusion in paragraph 65 above is not invalidated by the case-law relied on by the EDPB and Meta in their written pleadings and at the hearing.

67Accordingly, as regards the judgment of 26 February 2013, Spain v Commission (T‑65/10, T‑113/10 and T‑138/10, not published, EU:T:2013:93), apart from the fact that it was set aside on appeal by the judgment of 24 June 2015, Spain v Commission (C‑263/13 P, EU:C:2015:415), paragraph 38 thereof, which the EDPB reproduced, merely recalls, in essence, that the right to good administration laid down in Article 41 of the Charter does not constitute an autonomous right, but is expressed through various specific rights, such as the right of every person to have access to his or her file. The judgment of 20 May 2015, Yuanping Changyuan Chemicals v Council (T‑310/12, not published, EU:T:2015:295, paragraph 225), does not concern the right of access to the file, but the failure by the institution to comply with a minimum period granted to the undertakings in question by the applicable legislation to submit observations, in the context of Article 41(2)(a) of the Charter. The judgments of 13 September 2018, UBS Europe and Others (C‑358/16, EU:C:2018:715, paragraph 66); of 6 December 1994, Lisrestal and Others v Commission (T‑450/93, EU:T:1994:290, paragraph 42); of 29 June 1995, ICI v Commission (T‑36/91, EU:T:1995:118, paragraph 69); of 9 July 1999, New Europe Consulting and Brown v Commission (T‑231/97, EU:T:1999:146, paragraph 42); and of 14 July 2021, AI v ECDC (T‑65/19, EU:T:2021:454, paragraph 155) concern situations in which the principle of respect for the rights of the defence of the person concerned had to be safeguarded and in which that person’s right of access to the documents in the file was provided for only as a component of that principle.

68As regards the judgment of 13 December 2018, Ryanair and Airport Marketing Services v Commission (T‑165/15, EU:T:2018:953), it should be recalled that, in the field of State aid review, limitations on the right of access to the administrative file of the European Commission are ‘provided for by law’ within the meaning of Article 52(1) of the Charter, namely they result both from a provision of the Treaty and from an act of secondary legislation adopted to implement it. In that regard, it must be noted that, in that field, the basic principles governing the procedure are defined directly in the Treaty, namely in Article 108 TFEU. That article, the successor provision to Article 93 of the EC Treaty (later Article 88 EC), has been consistently interpreted by the Court of Justice as requiring the Commission to conduct an exchange of views and arguments and to observe the rights of the defence only for the benefit of the Member State responsible for granting the aid, and not for the benefit of the other parties concerned in the procedure, including the complainant (see, to that effect, judgments of 2 April 1998, Commission v Sytraval and Brink’s France, C‑367/95 P, EU:C:1998:154, paragraph 59; of 24 September 2002, Falck and Acciaierie di Bolzano v Commission, C‑74/00 P and C‑75/00 P, EU:C:2002:524, paragraphs 81 to 84; and of 13 December 2018, Ryanair and Airport Marketing Services v Commission, T‑165/15, EU:T:2018:953, paragraph 56).

69That judicial interpretation of a Treaty article which is at the same level in the hierarchy of legal rules as Article 41 of the Charter, but which may be regarded as constituting a lex specialis in relation to the latter article, was reproduced in Council Regulation (EC) No 659/1999 of 22 March 1999 laying down detailed rules for the application of Article [108 TFEU] (OJ 1999 L 83, p. 1), which was replaced by Council Regulation (EU) 2015/1589 of 13 July 2015 laying down detailed rules for the application of Article 108 [TFEU] (OJ 2015 L 248, p. 9). In particular, both regulations reserve the right of access to the Commission’s administrative file to the Member State responsible for granting the aid (see, to that effect, as regards Regulation No 659/1999, judgment of 29 June 2010, Commission v Technische Glaswerke Ilmenau, C‑139/07 P, EU:C:2010:376, paragraphs 56 to 58).

70The solution adopted in the judgment of 13 December 2018, Ryanair and Airport Marketing Services v Commission (T‑165/15, EU:T:2018:953), cannot be transposed to a situation such as that in the present case. In the field at issue in the present case, there is no limitation ‘provided for by law’, within the meaning of Article 52(1) of the Charter, on the right of the person lodging a complaint under Article 77 of Regulation 2016/679 to have access to the EDPB file, as has already been stated in paragraph 57 above. In addition, in the case which gave rise to that judgment, the applicants, relying on Article 41 of the Charter together with the principle of respect for the rights of the defence, challenged the Commission’s refusal to grant them access to the State aid file during the administrative procedure, whereas, in the present case, both the request for access to the file and the decision of the EDPB rejecting it were made after the administrative procedure closed, that is to say, at a time when any breach of the rights of the defence was no longer actionable (see paragraphs 30, 40 and 60 above).

71Similarly, the analogy which Meta draws with the restricted procedural rights conferred on a complainant in merger control procedures and procedures applying Article 101 TFEU, referring to the judgments of 28 June 2012, Commission v Éditions Odile Jacob (C‑404/10 P, EU:C:2012:393), and of 27 February 2014, Commission v EnBW (C‑365/12 P, EU:C:2014:112), relating to requests for access to the Commission’s administrative file based on Regulation No 1049/2001, is not relevant for the purpose of resolving the issue examined at the present stage of the analysis. In those fields, there are also specific rules limiting the right of access to the Commission’s file in merger control procedures (see, to that effect, judgment of 28 June 2012, Commission v Éditions Odile Jacob, C‑404/10 P, EU:C:2012:393, paragraphs 118 and 119) and in procedures applying Article 101 TFEU (see, to that effect, judgment of 27 February 2014, Commission v EnBW, C‑365/12 P, EU:C:2014:112, paragraph 86).

72In the case which gave rise to the judgment of 1 June 2022, Del Valle Ruíz and Others v Commission and SRB (T‑510/17, EU:T:2022:312), the applicants were shareholders of or held bonds in a credit institution before a resolution scheme was adopted in respect of that institution on the basis of Regulation (EU) No 806/2014 of the European Parliament and of the Council of 15 July 2014 establishing uniform rules and a uniform procedure for the resolution of credit institutions and certain investment firms in the framework of a Single Resolution Mechanism and a Single Resolution Fund and amending Regulation (EU) No 1093/2010 (OJ 2014 L 225, p. 1). They alleged, inter alia, infringement of Article 41(2)(b) of the Charter on the ground that the Single Resolution Board (SRB) and the Commission had not given them access, prior to the adoption of the contested decisions, to the documents on which they had relied in order to adopt those decisions.

73In the case which gave rise to the judgment of 1 June 2022, Del Valle Ruíz and Others v Commission and SRB (T‑510/17, EU:T:2022:312), as in the present case, the applicants had requested access to the file, in order to be able to exercise their right to effective judicial protection, at a time when the administrative procedure had already been closed. In that case, the General Court concluded that the applicants could not rely on the right of access to the file enshrined in Article 41(2)(b) of the Charter, after having noted that that right concerned persons or undertakings subject to proceedings opened or decisions taken in respect of them (see, to that effect, judgment of 1 June 2022, Del Valle Ruíz and Others v Commission and SRB, T‑510/17, EU:T:2022:312, paragraph 463), which was not so in that case. In reaching that conclusion, the General Court nevertheless took into account, inter alia, the existence, in Regulation No 806/2014, of a provision reserving the right of access to the file to the entity which was the subject of the procedure which led to the adoption of the resolution scheme (see, to that effect, judgment of 1 June 2022, Del Valle Ruíz and Others v Commission and SRB, T‑510/17, EU:T:2022:312, paragraphs 458 and 464). Therefore, even though the situation examined in the judgment of 1 June 2022, Del Valle Ruíz and Others v Commission and SRB (T‑510/17, EU:T:2022:312) has certain similarities with the situation in the present case, it differs therefrom by reason of the fact that such a regulatory provision existed.

74The judgment of 20 December 2023, OCU v SRB (T‑496/18, not published, EU:T:2023:857), which Meta relied on the hearing, is clearly in line with the judgment of 1 June 2022, Del Valle Ruíz and Others v Commission and SRB (T‑510/17, EU:T:2022:312), in so far as it also relates to a request for access to the file made after an administrative procedure has closed. In that case, the General Court stated that the right of access to the file enshrined in Article 41(2)(b) of the Charter concerned persons or undertakings subject to proceedings opened or decisions taken in respect of them (see judgment of 20 December 2023, OCU v SRB, T‑496/18, not published, EU:T:2023:857, paragraph 36 and the case-law cited). However, it once again took into account the fact that there was a provision in Regulation No 806/2014 reserving the right of access to the file to the entity which was the subject of the procedure which led to the adoption of the resolution scheme, and concluded that the applicant, as an association representing former shareholders, did not have such a right (see, to that effect, judgement of 20 December 2023, OCU v SRB, T‑496/18, EU:T:2023:857, paragraph 37).

75It follows from all the foregoing considerations that everyone has the right of access to his or her file based on Article 41(2)(b) of the Charter, including where that file is not linked to a procedure liable to culminate in a measure adversely affecting him or her, subject, however, to there being no specific rules in the field in question establishing limitations on the exercise of that right of access to the file in accordance with the requirements of Article 52(1) of the Charter.

The fact that the file to which the applicant requested access is a file concerning the applicant

76It is now necessary to examine whether the request for access to the file made in the present case by the applicant under Article 41(2)(b) of the Charter related to a file concerning her.

77Binding Decision 3/2022, adopted by the EDPB on the basis of Article 65(1)(a) of Regulation 2016/679, arose from a complaint lodged by the applicant under Article 77 of that regulation with the Austrian Data Protection Authority concerning the processing of her personal data by Meta (then still known as Facebook Ireland).

78Article 77(1) of Regulation 2016/679 grants every data subject the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data relating to him or her infringes that regulation. Article 77(2) of that regulation gives every data subject the right to be informed, by that supervisory authority, on the progress and outcome of the complaint.

79Where, as in the present case, the data processing at issue is cross-border in nature, as provided for in point 23 of Article 4 of Regulation 2016/679, Article 56(1) of that regulation provides, without prejudice to the competence rule set out in Article 55(1) thereof, for the implementation of a ‘one-stop shop’ mechanism based on a sharing of competences between a lead supervisory authority and the other supervisory authorities concerned. Under that mechanism, the supervisory authority of the main establishment or of the single establishment of the controller or processor is competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the cooperation procedure between that authority and the other supervisory authorities concerned laid down in Article 60 of that regulation.

80In the context of that cooperation procedure, the lead supervisory authority is, in particular, required to endeavour to reach consensus. To that end, in accordance with Article 60(3) of Regulation 2016/679, the lead supervisory authority is without delay to submit a draft decision to the other supervisory authorities concerned for their opinion and is to take due account of their views.

81It follows more specifically from Articles 56 and 60 of Regulation 2016/679 that, with respect to cross-border processing, and subject to Article 56(2) of that regulation, the various national supervisory authorities concerned must cooperate, in accordance with the procedure laid down in those provisions, in order to reach consensus and a single decision, which is binding on all those authorities and the controller must ensure compliance with that decision as regards processing activities in the context of all its establishments within the European Union.

82In accordance with Article 60(4) of Regulation 2016/679, where one of the other supervisory authorities concerned within a period of four weeks after having been consulted, expresses a relevant and reasoned objection to the draft decision, the lead supervisory authority, if it does not follow the relevant and reasoned objection or is of the opinion that that objection is not relevant or reasoned, is to submit the matter to the consistency mechanism referred to in Article 63 of that regulation, in order to obtain a binding decision from the EDPB, adopted on the basis of Article 65(1)(a) of that regulation.

83As the EDPB sets out in its written pleadings, that mechanism is intended to resolve, through the EDPB, conflicts of views between the lead authority and the other supervisory authorities concerned on all matters which are the subject of the relevant and reasoned objection. The competence of the EDPB under Article 65(1)(a) of Regulation 2016/679 is limited to those matters alone. It is to adopt a binding decision on all matters which have been the subject of a relevant and reasoned objection, but on them only.

84That limited scope is explained by the very nature of the binding decision, which is a decision addressed to the lead supervisory authority and to all the supervisory authorities concerned and which is binding on them, as provided for in Article 65(2) of Regulation 2016/679 (see, to that effect, order of 7 December 2022, WhatsApp Ireland v European Data Protection Board, T‑709/21, under appeal, EU:T:2022:783, paragraph 42).

85Even if the complainant under Article 77 of Regulation 2016/679 is not a formal party to the procedure before the EDPB leading to the adoption of a binding decision under Article 65(1)(a) of Regulation 2016/679, that complaint plays an essential role in that procedure. First of all, that complaint constitutes the starting point for the entire decision-making process. Next, if the EDPB makes a decision only on the relevant and reasoned objections which gave rise to a disagreement between the lead authority and at least one supervisory authority concerned, those objections form part of a procedure initiated following the complaint. They often take into account the facts and arguments put forward by the data subject, so that the file examined by the EDPB is based, at least in part, on the facts and arguments which the data subject has brought to the attention of the national supervisory authority. That data subject may therefore legitimately wish to ascertain whether the elements of his or her complaint, which are reproduced or highlighted in the relevant and reasoned objections of the supervisory authorities concerned, have been taken into consideration by the EDPB, or the extent to which they influenced the content of the binding decision. In that regard, it must be stated that, in the present case, Binding Decision 3/2022 refers, on numerous occasions, not only to the complaint lodged by the applicant, but also to the applicant as such (see paragraph 45 above). Lastly, the applicant, as the complainant, has a direct interest in the outcome of the procedure, in so far as that procedure seeks to ensure Regulation 2016/679 is applied specifically to a situation involving the processing of the complainant’s personal data, as set out in that complaint.

86It follows that, in the present case, it must be held that the EDPB file prepared for the purposes of the adoption of Binding Decision 3/2022 concerns the applicant as provided for in Article 41(2)(b) of the Charter.

87It follows that the first three parts of the single plea must be upheld, there being no need to rule on the fourth part of the plea, raised in the alternative, or on the admissibility of the decision of the Integritetsskydsmyndigheten (Authority for Privacy Protection, Sweden) of 2 November 2021, which the applicant adduced for the first time at the hearing before the Court. Consequently, the contested decision must be annulled in so far as it rejects the applicant’s request, under Article 41(2)(b), for access to the EDPB file prepared for the purposes of Binding Decision 3/2022.

Costs

88Under Article 134(1) of the Rules of Procedure of the General Court, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings. Since the EDPB has been unsuccessful, it must be ordered to pay the costs, in accordance with the form of order sought by the applicant.

89Under Article 138(3) of the Rules of Procedure, the Court may order an intervener other than those referred to in paragraphs 1 and 2 of that article to bear its own costs. In the present case, it is appropriate to order Meta to bear its own costs.

Operative part

On those grounds,THE GENERAL COURT (Tenth Chamber, Extended Composition)hereby:

1.Sets aside the decision of the European Data Protection Board dated 7 February 2023 in so far as it rejects the request submitted by Ms Lisa Ballmann, under Article 41(2)(b) of the Charter of Fundamental Rights of the European Union, for access to the file of the European Data Protection Board prepared for the purposes of its Binding Decision 3/2022 relating to the dispute, submitted by the Data Protection Commission (Ireland), concerning Meta Platforms Ireland Ltd;

2.Orders the European Data Protection Board to bear its own costs and to pay those incurred by Ms Ballmann;

3.Orders Meta Platforms Ireland to bear its own costs.

Delivered in open court in Luxembourg on 16 July 2025.