1

By its appeal, the appellant, WhatsApp Ireland Ltd., seeks to have set aside the order of the General Court of the European Union of 7 December 2022, WhatsApp Ireland v European Data Protection Board (T‑709/21, EU:T:2022:783), by way of which the General Court dismissed its action seeking annulment of Decision 1/2021 of the European Data Protection Board of 28 July 2021, adopted pursuant to Article 5 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’), further to an investigation conducted by the Data Protection Commission (Ireland), pursuant to Article 56 of that regulation in view of WhatsApp Ireland’s cross-border processing in the context of the provision of its services in the European Union.

2

By document lodged at the Registry of the Court of Justice on 15 May 2023, the Computer & Communications Industry Association (‘the CCIA’), an international association of undertakings active in the information technology and communications sector, applied, pursuant to the second paragraph of Article 40 of the Statute of the Court of Justice of the European Union and Article 130 of the Rules of Procedure of the Court of Justice, applicable to appeal proceedings under Article 190(1) of those rules, for leave to intervene in the present proceedings in support of the form of order sought by WhatsApp Ireland.

3

In support of its application, the CCIA refers to the conditions laid down by the case-law of the Court of Justice and of the General Court, in particular by the order of the President of the Court of 10 March 2023, Illumina v Commission (C‑611/22 P, EU:C:2023:205, paragraph 10), and by the order of 23 September 2019, Google and Alphabet v Commission (T‑604/18, EU:T:2019:743, paragraph 51), concerning the right to intervene of trade associations, according to which an association may be granted leave to intervene in a case if, first, it represents an appreciable number of undertakings operating in the sector concerned; if, second, its objectives include protection of its members’ interests; if, third, the case may raise questions of principle affecting the functioning of the sector concerned; and if, therefore, fourth, the interests of its members may be affected to an appreciable extent by the forthcoming judgment.

4

In that connection, the CCIA observes, with regard to the first and second conditions laid down by that case-law, that the decisions of the European Data Protection Board, adopted under of Article 65(1)(a) of the GDPR, may arise only in cases concerning cross-border processing of personal data, since such processing is typically carried out by leading technology companies, a large number of which are members of the CCIA. Furthermore, the Courts of the European Union have already recognised that the objectives of that association includes the protection of the interests of its members.

5

As regards the third condition laid down by the case-law, the CCIA recalls that the present case raises the question whether a company referred to in a decision of the European Data Protection Board, adopted pursuant to Article 65(1)(a) of the GDPR, has the right to challenge such a decision directly before the Courts of the European Union. It is argued that the decisions of the European Data Protection Board are binding on the lead supervisory authority, within the meaning of that provision, with the result that the latter may be forced to conclude that a given conduct constitutes an infringement of the GDPR and upwardly revise the amount of the fine to be imposed, since such a fine is criminal in nature within the meaning of Article 6 of the European Convention on the Protection of Human Rights and Fundamental Freedoms, signed at Rome on 4 November 1950.

6

It is argued that to deny the company concerned the right to bring an action before the Courts of the European Union, as the General Court did in the order of 7 December 2022, WhatsApp Ireland v European Data Protection Board (T‑709/21, EU:T:2022:783), would have the effect of depriving that company of its right to effective judicial protection, as guaranteed by that Article 6 and by Article 47 of the Charter of Fundamental Rights of the European Union. That decision would compel such a company to bring an action before the national courts, which do not have the power to annul an EU act but have, at best, the possibility of making a preliminary reference to the Court, in the event of doubt as to the interpretation of rules of EU law. The preliminary ruling procedure cannot be a substitute for an action for annulment, inasmuch as, in the context of that procedure, the Court does not have full jurisdiction with regard to all questions of fact and law, whereas the decisions of the European Data Protection Board raise complex factual questions. In those circumstances, the present case raises issues of considerable importance for the CCIA and its members.

7

As to the fourth condition laid down in the case-law cited in paragraph 3 of the present order, the CCIA claims that the outcome of the present case is bound to affect appreciably the functioning of the information and communications technology sector, and in particular CCIA members, in so far as the services and products that they offer involve, by their nature, cross-border processing of personal data. Thus that sector is, in the CCIA’s submission, particularly exposed to the procedure under Article 65(1)(a) of the GDPR and, therefore, to the decisions of the European Data Protection Board.

8

Following service on the parties by the Registrar of the Court of Justice, in accordance with Article 131(1) of the Rules of Procedure, applicable to appeal proceedings by virtue of Article 190(1) of those rules, of the application to intervene lodged by the CCIA, the European Data Protection Board submitted observations on that application within the prescribed period, while contending that that application should be dismissed.

9

Furthermore, by letters lodged with the Court Registry on 30 May and 1 June 2023, WhatsApp Ireland and the European Data Protection Board requested, respectively, pursuant to Article 131 of the Rules of Procedure, that certain passages of the annexes to the appeal and to the response be given confidential treatment vis-à-vis the CCIA.

10

Under the second and third paragraphs of Article 40 of the Statute of the Court of Justice of the European Union, any person establishing an interest in the result of a case submitted to the Court, other than a case between Member States, between EU institutions or between those States and those institutions, may intervene in that case.

11

According to the Court’s settled case-law, the concept of an ‘interest in the result of a case’, within the meaning of that provision, must be defined in the light of the precise subject matter of the case and be understood as meaning a direct, existing interest in the ruling on the form of order sought, and not as an interest in relation to the pleas in law raised or the arguments put forward. The words ‘result of a case’ refer to the final decision sought, as set out in the operative part of the forthcoming judgment or order (order of the President of the Court of 1 September 2022, Google and Alphabet v Commission, C‑48/22 P, EU:C:2022:667, paragraph 6 and the case-law cited).

12

In that regard, it must, in particular, be ascertained whether the applicant for leave to intervene is directly affected by the contested measure and whether its interest in the result of the case is established. In principle, an interest in the result of the case can be considered to be sufficiently direct only to the extent to which that result is likely to alter the legal position of the person seeking leave to intervene (order of the President of the Court of 1 September 2022, Google and Alphabet v Commission, C‑48/22 P, EU:C:2022:667, paragraph 7 and the case-law cited).

13

However, it is also settled case-law that a representative professional association, whose objective is to protect the interests of its members may be granted leave to intervene where the case raises questions of principle which are liable to affect those interests Therefore, the requirement that such an association has a direct, existing interest in the result of a case must be found to be fulfilled where that association establishes that it is in such a situation, irrespective of whether the result of the case is likely to alter the legal position of the association as such (order of the President of the Court of 10 March 2023, Illumina v Commission, C‑611/22 P, EU:C:2023:205, paragraph 8 and the case-law cited).

14

Indeed, such a broad interpretation of the right to intervene in favour of representative professional associations is intended to facilitate assessment of the context of such cases submitted to the EU Courts while avoiding multiple individual interventions which would compromise the efficiency and the proper course of the procedure. However, unlike natural and legal persons acting on their own behalf, representative professional associations are likely to apply for leave to intervene in a case before the Court not in order to defend individual interests but rather to defend the collective interests of their members. Intervention by such an association offers an overall perspective of those collective interests, which are affected by a question of principle on which the result of the case depends, and is, accordingly, of such a nature as to enable the Court better to assess the context in which a case is submitted to it (order of the President of the Court of 10 March 2023, Illumina v Commission, C‑611/22 P, EU:C:2023:205, paragraph 9 and the case-law cited).

15

Thus, in accordance with the case-law referred to in paragraph 13 of the present order and, more specifically, as is apparent from the case-law of the General Court, an association may be granted leave to intervene in a case if, first, it represents an appreciable number of undertakings operating in the sector concerned; if, second, its objectives include protection of its members’ interests; if, third, the case may raise questions of principle affecting the functioning of the sector concerned; and if, therefore, fourth, the interests of its members may be affected significantly by the forthcoming judgment (order of the President of the Court of 10 March 2023, Illumina v Commission, C‑611/22 P, EU:C:2023:205, paragraph 10).

16

It should be pointed out, however, that the application to intervene which was the subject of the order of the President of the Court of 10 March 2023, Illumina v Commission (C‑611/22 P, EU:C:2023:205) was granted having regard to the fact that the case was liable to have a ‘particular impact’ on three sectors to which the Commission had explicitly referred in its guidance on the application of the provision the interpretation and scope of which were at the heart of the case, including the specific sector in which members of the association that was applying for leave to intervene were active (order of the President of the Court of 10 March 2023, Illumina v Commission, C‑611/22 P, EU:C:2023:205, paragraphs 15 to 17). It must be stated that an association which seeks leave to intervene in a case cannot establish that the first and third conditions referred to in paragraph 15 of the present order are satisfied where it confines itself to relying on the fact that the case raises questions of principle which concern the sector in which its members operate in circumstances where those questions also affect a considerable number of other sectors of activity. Were it otherwise, the objective referred to in paragraph 14 of the present order – which consists, in particular, in avoiding multiple interventions – would be undermined. Such an association must therefore demonstrate, in addition, on the basis of objective and credible evidence, that the sector in which its members operate is impacted in a qualitatively different way compared to those other sectors.

17

In the present case, the CCIA has failed to establish that the information technology and communications sector is the ‘sector concerned’ by the question of principle raised by the present case, in so far as the result of the case would affect the functioning of that sector in a qualitatively different way compared to those other sectors.

18

It is, admittedly, true that the information technology and communications sector is concerned by the procedure referred to in Article 65(1)(a) of the GDPR, inasmuch as the products and services offered by the undertakings in that sector involve cross-border processing of personal data.

19

However, as the European Data Protection Board rightly points out in its observations on the application to intervene, those procedures concern all sectors of activity in which companies process large amounts of personal data in various Member States. The CCIA has confined itself to relying on the consequences for the exercise of the right to effective judicial protection which the result of the present case will have, in particular in so far as it is liable, in essence, to resolve the question of principle as to whether a decision taken by the European Data Protection Board under Article 65(1)(a) of the GDPR alters the legal situation of the company whose data are at issue, meaning that such a decision constitutes an act that can be challenged by that company.

20

It must be held that those consequences will affect undertakings in any sector capable of being the subject of a procedure under Article 65(1)(a) of the GDPR. The CCIA has failed to set out the reasons for which the answer that may be given to that question of principle, concerning the challengeable nature of decisions taken pursuant to that provision, objectively affects the interests of undertakings active in the information technology and communications sector in a qualitatively different way compared to those active in other sectors, which themselves also process large amounts of personal data.

21

It follows from all the foregoing considerations that the CCIA has failed to demonstrate that it has an interest in the result of the case within the meaning of the second paragraph of Article 40 of the Statute of the Court of Justice of the European Union and that, consequently, its application to intervene must be rejected.

22

In so far as the CCIA’s application to intervene is rejected, the request for confidential treatment jointly submitted by WhatsApp Ireland and the European Data Protection Board, vis-à-vis that association, has become devoid of purpose, with the result that there is no need to adjudicate on that request.

23

Under Article 138(1) of the Rules of Procedure of the Court of Justice, which applies to appeal proceedings by virtue of Article 184(1) thereof, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings. Since the CCIA has been unsuccessful in its application to intervene and the European Data Protection Board has not applied for costs, the CCIA and that Board must be ordered to bear their own respective costs relating to the CCIA’s application to intervene.

On those grounds, the President of the Court hereby orders: