CJEU Case T-183/23 / Judgment
-
CJEU Case T-183/23 / Judgment
Key facts of the case:
Protection of personal data – Complaint against the controller of personal data of users of an online social network in the European Union – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision of the European Data Protection Board – Complainant’s request for access to the file prepared for the purposes of the binding decision – Refusal to grant access – Action for annulment – Actionable measure – Admissibility – Article 41(2)(b) of the Charter of Fundamental Rights.
Outcome of the case:
On those grounds,
THE GENERAL COURT (Tenth Chamber, Extended Composition)
hereby:
- Sets aside the decision of the European Data Protection Board dated 7 February 2023 in so far as it rejects the request submitted by Ms Lisa Ballmann, under Article 41(2)(b) of the Charter of Fundamental Rights of the European Union, for access to the file of the European Data Protection Board prepared for the purposes of its Binding Decision 3/2022 relating to the dispute, submitted by the Data Protection Commission (Ireland), concerning Meta Platforms Ireland Ltd;
- Orders the European Data Protection Board to bear its own costs and to pay those incurred by Ms Ballmann;
- Orders Meta Platforms Ireland to bear its own costs.
-
Paragraphs referring to EU Charter
58. In those circumstances, it is necessary to determine whether Article 41(2)(b) of the Charter grants the person making such a complaint a right of access to such a file or whether the exercise of that right is subject to the right to be heard enshrined in Article 41(2)(a) of the Charter.
...
61. As the applicant correctly submits, the wording of Article 41(2)(b) of the Charter does not limit a person’s right of access to his or her file to the fact that that file relates to a measure liable to affect him or her adversely. It is true that such a requirement is contained in Article 41(2)(a) of the Charter, which enshrines the right to be heard, but nothing in the wording of those provisions, or in the wording of Article 41 of the Charter considered as a whole, makes the exercise of the right to access to the file subject, as a matter of principle, to the exercise of the right to be heard.
62. While it is true that the right of access to the file is a necessary prerequisite for the effective exercise of the rights of the defence, its scope may nevertheless be more extensive. That is, moreover, the situation for the applicant, who, as stated in paragraph 60 above, requested access to the EDPB file not in order to be heard and to ensure her defence in an ongoing administrative procedure, but in order to ascertain its content in order to assess whether to bring a legal action. The right of access to the file referred to in Article 41(2)(b) of the Charter cannot therefore be reduced to being a corollary of the principle of respect for the rights of the defence.
63. Article 41(2)(b) of the Charter must be read in conjunction with Article 41(1) thereof, as meaning that the right of access to the file is associated with the right of every person to have his or her affairs handled impartially, fairly and within a reasonable time by the administration of the European Union. The administration of the European Union does not limit itself, when handling the affairs of natural or legal persons, to taking measures which are, or are likely to be, unfavourable to such persons. The fact of being required to handle a person’s affairs fairly may, in particular, be interpreted as implying an obligation to communicate to that person the administrative file concerning him or her.
64. Account must also be taken of the fact that the right of access to the file referred to in Article 41(2)(b) of the Charter is a component of the ‘right to good administration’, which is the subject of Article 41 of the Charter as a whole. Article 41 does not relate solely to the exercise of the right to be heard by the administration of the European Union, which is specifically covered by Article 41(2(a) of the Charter, but has a broader scope, also encompassing other rights or principles which that administration must observe in its relations with natural and legal persons. Thus, more specifically, the principle that affairs must be handled within a reasonable time (Article 41(1) of the Charter), the obligation on the EU administration to give reasons for its decisions (Article 41(2)(c) of the Charter), the principle that the European Union is required to make good any damage caused by its administration (Article 41(3) of the Charter) and the principle that the EU administration is required to communicate with citizens in the language of the European Union used by them (Article 41(4) of the Charter) are not limited to situations in which the rights of the defence are to be applied.
65. Consequently, it must be concluded that a person has a right of access to his or her file, even if that person is not in a situation in which he or she could assert his or her right to be heard, subject, however, as will be further clarified below, to there being no specific rules in the field at issue limiting the exercise of that right of access to the file in accordance with the requirements of Article 52(1) of the Charter.
...
67. Accordingly, as regards the judgment of 26 February 2013, Spain v Commission (T‑65/10, T‑113/10 and T‑138/10, not published, EU:T:2013:93), apart from the fact that it was set aside on appeal by the judgment of 24 June 2015, Spain v Commission (C‑263/13 P, EU:C:2015:415), paragraph 38 thereof, which the EDPB reproduced, merely recalls, in essence, that the right to good administration laid down in Article 41 of the Charter does not constitute an autonomous right, but is expressed through various specific rights, such as the right of every person to have access to his or her file. The judgment of 20 May 2015, Yuanping Changyuan Chemicals v Council (T‑310/12, not published, EU:T:2015:295, paragraph 225), does not concern the right of access to the file, but the failure by the institution to comply with a minimum period granted to the undertakings in question by the applicable legislation to submit observations, in the context of Article 41(2)(a) of the Charter. The judgments of 13 September 2018, UBS Europe and Others (C‑358/16, EU:C:2018:715, paragraph 66); of 6 December 1994, Lisrestal and Others v Commission (T‑450/93, EU:T:1994:290, paragraph 42); of 29 June 1995, ICI v Commission (T‑36/91, EU:T:1995:118, paragraph 69); of 9 July 1999, New Europe Consulting and Brown v Commission (T‑231/97, EU:T:1999:146, paragraph 42); and of 14 July 2021, AI v ECDC (T‑65/19, EU:T:2021:454, paragraph 155) concern situations in which the principle of respect for the rights of the defence of the person concerned had to be safeguarded and in which that person’s right of access to the documents in the file was provided for only as a component of that principle.
68. As regards the judgment of 13 December 2018, Ryanair and Airport Marketing Services v Commission (T‑165/15, EU:T:2018:953), it should be recalled that, in the field of State aid review, limitations on the right of access to the administrative file of the European Commission are ‘provided for by law’ within the meaning of Article 52(1) of the Charter, namely they result both from a provision of the Treaty and from an act of secondary legislation adopted to implement it. In that regard, it must be noted that, in that field, the basic principles governing the procedure are defined directly in the Treaty, namely in Article 108 TFEU. That article, the successor provision to Article 93 of the EC Treaty (later Article 88 EC), has been consistently interpreted by the Court of Justice as requiring the Commission to conduct an exchange of views and arguments and to observe the rights of the defence only for the benefit of the Member State responsible for granting the aid, and not for the benefit of the other parties concerned in the procedure, including the complainant (see, to that effect, judgments of 2 April 1998, Commission v Sytraval and Brink’s France, C‑367/95 P, EU:C:1998:154, paragraph 59; of 24 September 2002, Falck and Acciaierie di Bolzano v Commission, C‑74/00 P and C‑75/00 P, EU:C:2002:524, paragraphs 81 to 84; and of 13 December 2018, Ryanair and Airport Marketing Services v Commission, T‑165/15, EU:T:2018:953, paragraph 56).
69. That judicial interpretation of a Treaty article which is at the same level in the hierarchy of legal rules as Article 41 of the Charter, but which may be regarded as constituting a lex specialis in relation to the latter article, was reproduced in Council Regulation (EC) No 659/1999 of 22 March 1999 laying down detailed rules for the application of Article [108 TFEU] (OJ 1999 L 83, p. 1), which was replaced by Council Regulation (EU) 2015/1589 of 13 July 2015 laying down detailed rules for the application of Article 108 [TFEU] (OJ 2015 L 248, p. 9). In particular, both regulations reserve the right of access to the Commission’s administrative file to the Member State responsible for granting the aid (see, to that effect, as regards Regulation No 659/1999, judgment of 29 June 2010, Commission v Technische Glaswerke Ilmenau, C‑139/07 P, EU:C:2010:376, paragraphs 56 to 58).
70. The solution adopted in the judgment of 13 December 2018, Ryanair and Airport Marketing Services v Commission (T‑165/15, EU:T:2018:953), cannot be transposed to a situation such as that in the present case. In the field at issue in the present case, there is no limitation ‘provided for by law’, within the meaning of Article 52(1) of the Charter, on the right of the person lodging a complaint under Article 77 of Regulation 2016/679 to have access to the EDPB file, as has already been stated in paragraph 57 above. In addition, in the case which gave rise to that judgment, the applicants, relying on Article 41 of the Charter together with the principle of respect for the rights of the defence, challenged the Commission’s refusal to grant them access to the State aid file during the administrative procedure, whereas, in the present case, both the request for access to the file and the decision of the EDPB rejecting it were made after the administrative procedure closed, that is to say, at a time when any breach of the rights of the defence was no longer actionable (see paragraphs 30, 40 and 60 above).
...
72. In the case which gave rise to the judgment of 1 June 2022, Del Valle Ruíz and Others v Commission and SRB (T‑510/17, EU:T:2022:312), the applicants were shareholders of or held bonds in a credit institution before a resolution scheme was adopted in respect of that institution on the basis of Regulation (EU) No 806/2014 of the European Parliament and of the Council of 15 July 2014 establishing uniform rules and a uniform procedure for the resolution of credit institutions and certain investment firms in the framework of a Single Resolution Mechanism and a Single Resolution Fund and amending Regulation (EU) No 1093/2010 (OJ 2014 L 225, p. 1). They alleged, inter alia, infringement of Article 41(2)(b) of the Charter on the ground that the Single Resolution Board (SRB) and the Commission had not given them access, prior to the adoption of the contested decisions, to the documents on which they had relied in order to adopt those decisions.
73. In the case which gave rise to the judgment of 1 June 2022, Del Valle Ruíz and Others v Commission and SRB (T‑510/17, EU:T:2022:312), as in the present case, the applicants had requested access to the file, in order to be able to exercise their right to effective judicial protection, at a time when the administrative procedure had already been closed. In that case, the General Court concluded that the applicants could not rely on the right of access to the file enshrined in Article 41(2)(b) of the Charter, after having noted that that right concerned persons or undertakings subject to proceedings opened or decisions taken in respect of them (see, to that effect, judgment of 1 June 2022, Del Valle Ruíz and Others v Commission and SRB, T‑510/17, EU:T:2022:312, paragraph 463), which was not so in that case. In reaching that conclusion, the General Court nevertheless took into account, inter alia, the existence, in Regulation No 806/2014, of a provision reserving the right of access to the file to the entity which was the subject of the procedure which led to the adoption of the resolution scheme (see, to that effect, judgment of 1 June 2022, Del Valle Ruíz and Others v Commission and SRB, T‑510/17,EU:T:2022:312, paragraphs 458 and 464). Therefore, even though the situation examined in the judgment of 1 June 2022, Del Valle Ruíz and Others v Commission and SRB (T‑510/17, EU:T:2022:312) has certain similarities with the situation in the present case, it differs therefrom by reason of the fact that such a regulatory provision existed.
74. The judgment of 20 December 2023, OCU v SRB (T‑496/18, not published, EU:T:2023:857), which Meta relied on the hearing, is clearly in line with the judgment of 1 June 2022, Del Valle Ruíz and Others v Commission and SRB (T‑510/17, EU:T:2022:312), in so far as it also relates to a request for access to the file made after an administrative procedure has closed. In that case, the General Court stated that the right of access to the file enshrined in Article 41(2)(b) of the Charter concerned persons or undertakings subject to proceedings opened or decisions taken in respect of them (see judgment of 20 December 2023, OCU v SRB, T‑496/18, not published, EU:T:2023:857, paragraph 36 and the case-law cited). However, it once again took into account the fact that there was a provision in Regulation No 806/2014 reserving the right of access to the file to the entity which was the subject of the procedure which led to the adoption of the resolution scheme, and concluded that the applicant, as an association representing former shareholders, did not have such a right (see, to that effect, judgement of 20 December 2023, OCU v SRB, T‑496/18, EU:T:2023:857, paragraph 37).
75. It follows from all the foregoing considerations that everyone has the right of access to his or her file based on Article 41(2)(b) of the Charter, including where that file is not linked to a procedure liable to culminate in a measure adversely affecting him or her, subject, however, to there being no specific rules in the field in question establishing limitations on the exercise of that right of access to the file in accordance with the requirements of Article 52(1) of the Charter.
76. It is now necessary to examine whether the request for access to the file made in the present case by the applicant under Article 41(2)(b) of the Charter related to a file concerning her.
...
86. It follows that, in the present case, it must be held that the EDPB file prepared for the purposes of the adoption of Binding Decision 3/2022 concerns the applicant as provided for in Article 41(2)(b) of the Charter.
-
Paragraphs referring to EU Charter (original language)