1

By actions brought pursuant to Article 263 TFEU, the applicants, who are all Members of the European Parliament elected for the 2019-2024 session, seek annulment of the decision of the Bureau of the Parliament of 27 October 2021 on Exceptional Health and Safety Rules Governing Access to its Buildings in its Three Places of Work (‘the contested decision’).

2

In the context of the health crisis caused by the COVID-19 pandemic, the European legislature, acting on a proposal from the European Commission, adopted Regulation (EU) 2021/953 of the European Parliament and of the Council of 14 June 2021 on a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) to facilitate free movement during the COVID-19 pandemic (OJ 2021 L 211, p. 1), as well as Regulation (EU) 2021/954 of the European Parliament and of the Council of 14 June 2021 on a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) with regard to third-country nationals legally staying or residing in the territories of Member States during the COVID-19 pandemic (OJ 2021 L 211, p. 24).

3

On the basis of those regulations, certain Member States decided to introduce national implementations of the EU Digital COVID Certificate (‘the COVID certificate’) and to extend their use, in particular to access to certain events, buildings or modes of transport, with a view to limiting the spread of the SARS-CoV-2 virus and protecting public health. Those Member States include the three in which the seats of the Parliament are located, namely Belgium, France and Luxembourg.

4

Since the beginning of the pandemic in March 2020, the President of the Parliament has adopted various measures with a view to protecting the health of Members, staff and other persons present in its buildings, while ensuring that the Parliament remains able to perform its essential functions as defined in the Treaties.

5

These temporary measures have regularly been extended or amended. Having regard, in particular, to the evolving epidemiological situation, certain measures could be relaxed or reinforced. Those measures include, in particular, since spring 2020, mask wearing and temperature checks. Until autumn 2021 they also prohibited numerous categories of events and individual or group visits. Plenary sessions continued to be held in Brussels (Belgium) between March 2020 and May 2021.

6

Furthermore, from 16 March 2020, an exceptional comprehensive teleworking regime was introduced by the Secretary-General of the Parliament in response to the COVID-19 pandemic. The regime was adapted as the pandemic developed and was replaced, with effect from 1 September 2021, by the decision of the Secretary-General of 16 July 2021 on teleworking, which put teleworking on a voluntary basis while providing that physical attendance was to be the default mode of work, in conformity with Article 20 of the Staff Regulations of Officials of the European Union (‘the Staff Regulations’).

7

On 25 March 2021, in close cooperation with the Brussels authorities, the Parliament opened a COVID-19 vaccination centre at its Brussels site, in order to facilitate the vaccination of, amongst others, Members of the Parliament and staff, who might otherwise have needed to return to their country of origin. Furthermore, since the pandemic began in March 2020, the Parliament has put exceptional temporary procedures in place to enable Members to participate remotely in debating and voting.

8

On 2 September 2021, the President of the Parliament adopted a decision on security measures to limit the spread of COVID-19. Under that decision, visitors, local assistants, external speakers and interest representatives were required to present a COVID certificate or equivalent in order to enter Parliament buildings. That decision also imposes obligations to wear a mask and observe social distancing in Parliament, as well as prohibiting entry to Parliament to any person whose temperature is above 37.7 °C, who is sneezing or coughing, who has tested positive for COVID-19 or who has been in contact with someone who has tested positive for COVID-19.

9

The same day, the President of the Parliament adopted a decision on extraordinary measures enabling the Parliament to continue to carry out its duties and exercise its prerogatives under the Treaties. That decision provides, in particular, for the resumption of certain Parliamentary activities, such as missions and delegations, as well as requiring social distancing and mask wearing during Parliamentary debates.

10

On 30 September 2021, the President of the Parliament adopted two decisions extending the application of the measures introduced by the decisions of 2 September 2021 until 17 October 2021.

11

On 14 October 2021, the President of the Parliament adopted a fresh decision on security measures to limit the spread of the virus, which, for the period from 18 October to 2 November 2021, placed restrictions on the organisation of numerous events and visits within Parliament’s buildings, required temperature checks on entry to the buildings, required social distancing and mask wearing during Parliamentary debates, and, in respect of visitors, local assistants, external speakers and interest representatives, made entry to the buildings conditional on presentation of a COVID certificate.

12

On the same day, the President of the Parliament adopted a fresh decision on extraordinary measures enabling the Parliament to carry out its duties and exercise its prerogatives under the Treaties, which provides, for the period from 18 October to 2 November 2021, for a remote participation regime for sessions, committees and interparliamentary delegations, for meetings of certain bodies, for the exercise of voting rights, etc.

13

Despite the distancing measures and precautions put in place, and despite vaccination coverage estimated at over 80% of staff, in the period from September 2021 and increasing number of transmissions were detected within the Parliament.

14

Thus, on 27 October 2021, the Bureau of the Parliament (‘the Bureau’) adopted the contested decision. That decision imposes a requirement, for the period from 3 November 2021 to 31 January 2022, for any person wishing to enter Parliament buildings, in the Parliament’s three places of work, to present a valid COVID certificate.

15

It is stated in recital 11 of the contested decision that those measures pursue a double objective, aiming, on one hand to ensure compliance by the institution with its legal obligation, stemming from the Treaties, to return to normal procedures, and, on the other hand, to provide sufficient safeguards to protect the life and health of all persons present on the Parliament’s premises.

16

Pursuant to Article 3(1) of Regulation 2021/953, the COVID certificate framework allows for the issuance, cross-border verification and acceptance of any of the following certificates:

17

The applicants claim that the Court should

18

The Parliament contends that the Court should:

19

By a measure of organisation of procedure and at the hearing, the parties were invited to state whether the applicants continued to have an interest in bringing proceedings against the contested decision, having regard to the fact that it was only applicable until 31 January 2022.

20

In that regard, it must be recalled that, in accordance with settled case-law, an applicant’s interest in bringing proceedings must, in the light of the purpose of the action, exist at the stage of lodging the action, failing which the action will be inadmissible. That purpose must continue to exist, like the interest in bringing proceedings, until the final decision, failing which there will be no need to adjudicate, which presupposes that the action must be liable, if successful, to procure an advantage for the party bringing it (see judgment of 21 January 2021, Leino-Sandberg v Parliament, C‑761/18 P, EU:C:2021:52, paragraph 32 and the case-law cited).

21

Moreover, it follows from the case‑law that the applicant may retain an interest in claiming the annulment of an act of an EU institution to prevent its alleged unlawfulness recurring in the future (judgment of 7 June 2007, Wunenburger v Commission, C‑362/05 P, EU:C:2007:322, paragraph 50).

22

According to the case-law, that interest in bringing proceedings can only exist if the alleged unlawfulness is liable to recur in the future independently of the circumstances of the case which gave rise to the action brought by the applicant (judgment of 7 June 2007, Wunenburger v Commission, C‑362/05 P, EU:C:2007:322, paragraph 52).

23

In the present case, as the applicants submitted at the hearing, it is not inconceivable that the unlawfulness they allege might recur in the future, independently of the circumstances which gave rise to the actions they have brought.

24

By their actions, the applicants allege that the contested decision was unlawful in numerous respects, relying in particular on the absence of any appropriate legal basis for that decision, on infringement of their privileges and immunities and their freedom and independence, and on infringement of their right to respect for their private lives, all of which would be liable to recur in relation to analogous decisions, independently of the circumstances which gave rise to the present actions.

25

Furthermore, as the Parliament indicated at the hearing, the contested decision was extended, initially until 13 March 2022, by decision of the Bureau of 26 January 2022, and subsequently until 10 April 2022, by decision of the Bureau of 7 March 2022. It is thus conceivable that the contested decision might be further extended, or that an analogous fresh decision might be adopted.

26

Accordingly, the applicants retain an interest in seeking annulment of the contested decision.

27

The Parliament disputes the admissibility of the action, submitting that the applicants do not have standing as defined by the fourth paragraph of Article 263 TFEU.

28

It observes that the fourth paragraph of Article 263 TFEU provides that a person has standing in three situations: (i) where the act in question is addressed to that person; (ii) where it is of direct and individual concern to them; and, (iii) where it is a regulatory act which is of direct concern to them and does not entail implementing measures. The Parliament submits that none of those situations correspond to the present case.

29

The applicants do not accept that argument.

30

It must be observed that, under the fourth paragraph of Article 263 TFEU, ‘any natural or legal person may, under the conditions laid down in the first and second paragraphs, institute proceedings against an act addressed to that person or which is of direct and individual concern to them, and against a regulatory act which is of direct concern to them and does not entail implementing measures’.

31

In the first place, it must be observed that, as the Parliament submits, the applicants cannot be regarded as being the addressees of the contested act, within the meaning of that provision. That decision is not addressed to them personally and applies, pursuant to Article 2 thereof, to ‘all persons requesting access to Parliament’s buildings in its three places of work, including Members, officials, accredited parliamentary assistants and other servants of Parliament’.

32

It must be observed that the concept of ‘the addressee of the act’ is to be understood for the purposes of that provision in a formal sense, as referring to the person designated in the act as its addressee. The fact that the substantive content of an act may apply to persons other than the formal addressee may, it is true, confer standing on those persons if they demonstrate, amongst other things, that having regard to that content, the act is of direct concern to them – but not on the basis that they are addressees of the act. Furthermore, the fact that the applicants were sent a copy of the contested decision is not a sufficient basis for regarding them as its addressees (see, to that effect, judgment of 21 January 2016, SACBO v Commission and INEA, C‑281/14 P, not published, EU:C:2016:46, paragraph 34).

33

In the second place, it is important to bear in mind that the admissibility of an action brought by natural or legal persons against an act which is not addressed to them, in accordance with the fourth paragraph of Article 263 TFEU, is subject to the condition that they be accorded standing to bring proceedings, which arises in two situations. First, such proceedings may be instituted if the act is of direct and individual concern to those persons. Second, such persons may bring proceedings against a regulatory act not entailing implementing measures if that act is of direct concern to them (see judgment of 15 July 2021, Deutsche Lufthansa v Commission, C‑453/19 P, EU:C:2021:608, paragraph 31 and the case-law cited).

34

The Court considers it appropriate to begin by examining whether the applicants have standing on the basis of the second situation referred to in paragraph 33 above.

35

In that regard, first, it must be observed that the concept of ‘regulatory act’ within the meaning of the final limb of the fourth paragraph of Article 263 TFEU extends to all non-legislative acts of general application (judgment of 6 November 2018, Scuola Elementare Maria Montessori v Commission, Commission v Scuola Elementare Maria Montessori and Commission v Ferracci, C‑622/16 P to C‑624/16 P, EU:C:2018:873, paragraph 28). It is apparent from the case-law that an act has general application if it applies to objectively determined situations and entails legal effects for categories of persons regarded generally and in the abstract (see judgment of 31 May 2001, Sadam Zuccherifici and Others v Council, C‑41/99 P, EU:C:2001:302, paragraph 24 and the case-law cited).

36

In the present case, it must be observed that the contested decision, although adopted in the form of a decision, was in reality a regulatory act of general application, inasmuch as it applies to objectively determined situations and entails legal effects for categories of persons regarded generally and in the abstract, which the Parliament does not dispute.

37

Second, it must be recalled that, according to settled case-law, the condition that a natural or legal person must be directly concerned by the decision against which the action is brought, laid down in the fourth paragraph of Article 263 TFEU, requires two cumulative criteria to be met, first, that the contested measure must directly affect the legal situation of the individual and, second, it must leave no discretion to its addressees who are entrusted with the task of implementing it, such implementation being purely automatic and resulting from the EU rules alone without the application of other intermediate rules (see judgment of 6 November 2018, Scuola Elementare Maria Montessori v Commission, Commission v Scuola Elementare Maria Montessori and Commission v Ferracci, C‑622/16 P to C‑624/16 P, EU:C:2018:873, paragraph 42 and the case-law cited).

38

In the present case, as the applicants submit, the contested decision produces direct and binding legal effects on them, given that, since its entry into force on 3 November 2021, they cannot enter Parliament buildings in order to carry out their duties as Members of the European Parliament and participate in the work of that institution unless they are in a position to present a valid COVID certificate.

39

In that regard, although, with effect from 22 November 2021, the Parliament decided to reintroduce a compulsory teleworking regime, under which all members of staff were, so far as it was compatible with the carrying out of their duties, required to work remotely for up to three days per week, calculated on an average monthly basis, and to permit Members of the Parliament to participate remotely in debates and voting in plenary sessions and committee meetings, as the Parliament confirmed at the hearing, the contested decision and the obligation to present a valid COVID certificate in order to enter Parliament buildings remained in force throughout that period.

40

Moreover, it is common ground that there is no discretion on the part of the addressees of the contested decision who are responsible for implementing it, in particular the security staff of the Parliament who are responsible for checking that a valid COVID certificate has been presented. That is entirely automatic and does not require intermediate measures.

41

Accordingly, the applicants must be held to be directly concerned by the contested decision.

42

Third, it must be observed that, according to settled case-law, the expression ‘does not entail implementing measures’ within the meaning of the third limb of the fourth paragraph of Article 263 TFEU must be interpreted in the light of the objective of that provision, which, as is apparent from its drafting history, is to ensure that individuals do not have to break the law in order to have access to a court. Where a regulatory act directly affects the legal situation of a natural or legal person without requiring implementing measures, that person could be denied effective judicial protection if he or she did not have a legal remedy before the EU judicature for the purpose of challenging the legality of the regulatory act. In the absence of implementing measures, a natural or legal person, although directly concerned by the act in question, would be able to obtain judicial review of the act only after having infringed its provisions, by pleading that those provisions are unlawful in proceedings initiated against them before the national court (see judgment of 6 November 2018, Scuola Elementare Maria Montessori v Commission, Commission v Scuola Elementare Maria Montessori and Commission v Ferracci, C‑622/16 P to C‑624/16 P, EU:C:2018:873, paragraph 58 and the case-law cited).

43

By contrast, where a regulatory act entails implementing measures, judicial review of compliance with the EU legal order is ensured irrespective of whether those measures were adopted by the European Union or the Member States. Natural or legal persons who are unable, because of the conditions of admissibility in the fourth paragraph of Article 263 TFEU, to challenge an EU regulatory act directly before the EU judicature are protected against the application to them of such an act by the ability to challenge the implementing measures which the act entails (see judgment of 6 November 2018, Scuola Elementare Maria Montessori v Commission, Commission v Scuola Elementare Maria Montessori and Commission v Ferracci, C‑622/16 P to C‑624/16 P, EU:C:2018:873, paragraph 59 and the case-law cited).

44

Where responsibility for the implementation of such acts lies with the institutions, bodies, offices or agencies of the European Union, natural or legal persons are entitled to bring a direct action before the EU judicature against the implementing acts under the conditions stated in the fourth paragraph of Article 263 TFEU, and to plead in support of that action, pursuant to Article 277 TFEU, the unlawfulness of the basic act concerned (see judgment of 6 November 2018, Scuola Elementare Maria Montessori v Commission, Commission v Scuola Elementare Maria Montessori and Commission v Ferracci, C‑622/16 P to C‑624/16 P, EU:C:2018:873, paragraph 60 and the case-law cited).

45

The Court of Justice has, moreover, repeatedly held that the question whether a regulatory act entails implementing measures should be assessed by reference to the position of the person pleading the right to bring proceedings under the third limb of the fourth paragraph of Article 263 TFEU. It is therefore irrelevant whether the act in question entails implementing measures with regard to other persons (see judgment of 6 November 2018, Scuola Elementare Maria Montessori v Commission, Commission v Scuola Elementare Maria Montessori and Commission v Ferracci, C‑622/16 P to C‑624/16 P, EU:C:2018:873, paragraph 61 and the case-law cited).

46

It is thus apparent from the case-law that the concept of ‘implementing measures’ entails, first, the adoption of an act, either by the institutions, bodies, offices or agencies of the European Union or by the Member States, which is open to judicial review (see, to that effect, judgment of 28 October 2020, Associazione GranoSalus v Commission, C‑313/19 P, not published, EU:C:2020:869, paragraph 37) and, second, that the legal effects of the contested act only materialise, in relation to the applicants, by virtue of those implementing measures (see, to that effect, judgments of 13 March 2018, European Union Copper Task Force v Commission, C‑384/16 P, EU:C:2018:176, paragraph 50; of 13 March 2018, Industrias Químicas del Vallés v Commission, C‑244/16 P, EU:C:2018:177, paragraph 57; and of 6 November 2018, Scuola Elementare Maria Montessori v Commission, Commission v Scuola Elementare Maria Montessori and Commission v Ferracci, C‑622/16 P to C‑624/16 P, EU:C:2018:873, paragraph 64).

47

According to the Parliament, it is apparent from Article 3 of the contested decision that entry to Parliament premises is granted or refused following a check carried out by the security staff of the Parliament. What is checked is not simply that the person in question holds a valid COVID certificate, but also, where applicable, whether he or she has the benefit of a derogation granted by the Secretary-General pursuant to Article 5(2) of the contested decision. Accordingly, the Parliament submits, the effects of the contested decision would only manifest themselves, in relation to the applicants, after the check had been carried out by its security staff.

48

It must be held, however, that, contrary to the Parliament’s submissions, the legal effects of the contested decision materialised in relation to the applicants as from the entry into force of that decision, without the need for any further implementing measure, in that the applicants were required, from that date, to possess a valid COVID certificate in order to gain entry to Parliament buildings.

49

In addition, it must be observed that the security staff of the Parliament, who are responsible for carrying out the checks involved in implementing the contested decision, do not adopt any act that is open to judicial review, but simply determine, using the CovidScanBE or CovidCheck.lu application, whether a person wishing to enter Parliament buildings does or does not hold a valid COVID certificate.

50

At the hearing, the Parliament nevertheless submitted that persons refused entry to its buildings, on the basis that they did not hold a valid COVID certificate, could, on request, obtain a document confirming the refusal of entry to Parliament buildings, which would constitute a measure implementing the contested decision.

51

It must be observed, however, that it would be artificial to require the applicants to ask to be permitted entry to the Parliament’s buildings, when they do not hold valid COVID certificates, in order to obtain such a document stating that they do not meet the requirements of the contested decision, and thus to be able to challenge that act before the General Court and plead, in support of their action and pursuant to Article 277 TFEU, that the contested decision is unlawful (see, to that effect and by analogy, judgments of 6 November 2018, Scuola Elementare Maria Montessori v Commission, Commission v Scuola Elementare Maria Montessori and Commission v Ferracci, C‑622/16 P to C‑624/16 P, EU:C:2018:873, paragraph 66; of 14 January 2016, Doux v Commission, T‑434/13, not published, EU:T:2016:7, paragraphs 59 to 64; and of 13 September 2018, Gazprom Neft v Council, T‑735/14 and T‑799/14, EU:T:2018:548, paragraph 102).

52

Similarly, it is impossible to accept the Parliament’s argument that the applicants could make a request for a derogation to the Secretary-General of the Parliament, in accordance with Article 5(2) of the contested decision, and then challenge any refusal to grant such a derogation. As the Parliament confirmed at the hearing, such derogations are only granted on very specific legitimate grounds, such as vaccination in a third country, and never on a discretionary basis to persons who, for no good reason, do not possess a valid COVID certificate.

53

Therefore, in addition to the fact that it would be artificial to require the applicants to request such derogations, it must be observed that they did not in fact ever make any such requests, and therefore that such potential implementing measures are in any case irrelevant to the present case, in the light of the case-law referred to in paragraph 45 above.

54

Lastly, the Parliament cannot legitimately rely on the judgment of 20 November 2017, Petrov and Others v Parliament (T‑452/15, EU:T:2017:822), as a basis for arguing that a refusal of entry to Parliament premises would, in the present case, constitute an act capable of being challenged by the person concerned before the EU Courts. In that case, the applicants, who were nationals of a third country, challenged a decision refusing to grant them the accreditation necessary to enter Parliament buildings. Thus, unlike the applicants in the present case, those applicants did not, in the absence of that decision, have a permanent right of access to Parliament buildings. Furthermore, the decision at issue in that case was an explicit decision refusing access, of individual scope, and not, as in the present case, a step taken in the course of a check carried out by the security staff of the Parliament, responsible for implementing a prior decision of general scope, imposing conditions on entry to Parliament buildings.

55

Hence, in the light of all of the foregoing considerations, the contested decision cannot be regarded as entailing implementing measures with regard to the applicants, within the meaning of the fourth paragraph of Article 263 TFEU.

56

Consequently, in so far as the contested decision constitutes a regulatory act which is of direct concern to the applicants and does not entail implementing measures with regard to them, they must be held to have standing under the third limb of the fourth paragraph of Article 263 TFEU.

57

At the hearing, the Parliament indicated that the contested decision had been extended, initially until 13 March 2022, by decision of the Bureau of 26 January 2022, and subsequently until 10 April 2022, by decision of the Bureau of 7 March 2022. It also stated that those new decisions were based on an updated assessment of the health situation and the available scientific data.

58

When asked about the impact of the new decisions on the present action, the applicants indicated, at the hearing, that they wished to modify the form of order sought in their applications to take account of those new factors.

59

It must be observed, however, that under Article 86(1) and (2) of the Rules of Procedure of the General Court, the modification of the application must be made by a separate document before the oral part of the procedure is closed, or before the decision of the General Court to rule without an oral part of the procedure.

60

That requirement is intended inter alia to ensure compliance with the adversarial principle and the rights of the defence, by enabling the defendant to respond to the pleas or arguments of the applicant as modified, in so far as they relate to new factors (see, to that effect, judgments of 24 January 2019, Haswani v Council, C‑313/17 P, EU:C:2019:57, paragraphs 36 to 40; of 9 November 2017, HX v Council, C‑423/16 P, EU:C:2017:848, paragraph 23; and of 30 November 2016, Rotenberg v Council, T‑720/14, EU:T:2016:689, paragraph 139).

61

It must also be observed that the applicants and their representatives must have been aware of the new decisions adopted by the Bureau prior to the hearing, and with that in mind, that if they also wished to challenge the lawfulness of those decisions, they ought to have shown the requisite care and introduced either new actions, on the basis of Article 263 TFEU, or modifications of the applications, in compliance with the requirements of Article 86 of the Rules of Procedure.

62

Accordingly, given that the applicants did not make their requests to modify their applications by separate document lodged before the oral part of the procedure was closed, those requests, made orally at the hearing, must be rejected as inadmissible.

63

By their actions, the applicants raise four distinct pleas in law, based, first, on the lack of any valid legal basis on which the contested decision could produce effects in relation to Members of the Parliament; second, on the contested decision being contrary to the principles of freedom and independence of Members of the Parliament and to the immunities conferred on them by the Treaty; third, on breach of the general principles relating to the processing of personal data; and fourth, on unjustified interference with the right to respect for private life and protection of personal data, the right to physical integrity, the right to liberty and safety and the right to equality in law and non-discrimination.

64

The applicants submit that Rule 25 of the Rules of Procedure of the Parliament does not constitute a valid legal basis on which the contested decision could produce effects in relation to them. They emphasise that paragraph 2 of that article, which, they submit, is the only paragraph that is potentially relevant, only grants the Bureau general powers relating to the internal organisation of the Parliament, which do not extend to the adoption of measures as strict as those contained in the contested decision.

65

The applicants also submit that Article 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’) requires a ‘law’ to lay down the essential elements of processing of personal data. According to the applicants, it is beyond doubt that a decision of the Bureau does not constitute a law within the meaning of that provision. Any other interpretation would have the effect of granting a lower level of protection at the level of EU institutions than at the level of Member States, which lay down, as a prerequisite for the processing of personal data, a requirement for legislation to be enacted following a parliamentary debate.

66

In any event, the applicants submit that Rule 25(2) of the Rules of Procedure of the Parliament cannot serve as a basis for the adoption of measures which are contrary to Decision 2005/684/EC, Euratom of the European Parliament, of 28 September 2005 adopting the statute for Members of the European Parliament (OJ 2005 L 262, p. 1; ‘the statute for Members of the Parliament’), or to Protocol (No 7) on the privileges and immunities of the European Union (OJ 2010 C 83, p. 266; ‘Protocol No 7’).

67

The Parliament disputes the applicants’ arguments.

68

First, it must be observed that Article 232 TFEU provides for the Parliament to adopt its Rules of Procedure by a majority of its Members.

69

In the present case, it is common ground that the contested decision was adopted, inter alia, on the basis of Rule 25(2) of the Rules of Procedure of the Parliament. That provision empowers the Bureau to deal with financial, organisational and administrative matters concerning the internal organisation of the Parliament, its secretariat and its bodies.

70

It must be observed, as the Parliament submits, that the contested decision, which seeks to limit access to Parliament buildings to persons holding a valid COVID certificate, relates to matters concerning the internal organisation of the Parliament, within the meaning of Rule 25(2) of its Rules of Procedure.

71

The Parliament is authorised by virtue of the power to determine its own internal organisation to take appropriate measures to ensure the proper functioning and conduct of its proceedings (judgments of 10 February 1983, Luxembourg v Parliament, 230/81, EU:C:1983:32, paragraph 38; of 10 July 1986, Wybot, 149/85, EU:C:1986:310, paragraph 16; and of 2 October 2001, Martinez and Others v Parliament, T‑222/99, T‑327/99 and T‑329/99, EU:T:2001:242, paragraph 144).

72

As the Parliament submits, the contested decision constitutes such a measure in that its objective, as set out in recital 2, is to return to physical attendance at work in order to ensure business continuity under normal procedures stemming from the Treaties, to guarantee the full application of all regular procedures available under its Rules of Procedure and to restore its full and unlimited role as the democratically elected institution of the European Union which represents citizens directly at EU level.

73

The Parliament’s power to determine its own internal organisation, referred to in paragraph 71 above, is also acknowledged by the headquarters agreements entered into between the EU institutions and the Member States in which their buildings are located. Thus, the security arrangement entered into on 31 December 2004 between the Parliament, the Council of the European Union, the Commission, the Economic and Social Committee, the Committee of the Regions and the European Investment Bank, on the one hand, and the Belgian Government, on the other, provides that the institutions are responsible for security and for maintaining order in all respects within the buildings that they occupy, and for authorising entry and carrying out checks on entry to those buildings. Similarly, the agreement between the Parliament and the Grand Duchy of Luxembourg, of 2 December 1983, provides that the Parliament is responsible for security on its premises and within its buildings and must adopt internal regulations accordingly. Lastly, as regards the Parliament’s buildings in Strasbourg (France), the administrative arrangement between Parliament and the French authorities concerning the security of the Parliament’s buildings in Strasbourg, of 25 June 1998, again acknowledges that the Parliament has sole responsibility for authorising entry and carrying out checks on entry to its buildings.

74

It must be observed, moreover, that the contested decision amounts to a limitation on the permanent right of access of Members of the European Parliament to Parliament buildings, contained in Article 1(1) of the Bureau Decision of 3 May 2004 laying down rules on the laissez-passer. The latter decision was adopted by the Bureau on the basis, inter alia, of Rule 22 of the former Rules of Procedure of the Parliament, which corresponds to Rule 25 of the current Rules of Procedure, and it is consistent with that for the same body to have adopted the contested decision, on the same legal basis, in conformity with the rule of equivalence of form (see judgment of 18 October 2018, ArcelorMittal Tubular Products Ostrava and Others v Commission, T‑364/16, EU:T:2018:696, paragraph 69 and the case-law cited).

75

In the second place, and without determining whether it is effective – it being unnecessary to do so – the applicant’s argument that the contested decision is not a ‘law’ within the meaning of Article 8 of the Charter, laying down the essential elements of processing of personal data, must be examined.

76

It must be observed that, pursuant to Article 8 of the Charter, ‘everyone has the right to the protection of personal data concerning him or her’, and ‘such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law’.

77

Article 52(1) of the Charter also provides that ‘any limitation on the exercise of the rights and freedoms recognised by this Charter must be provided for by law and respect the essence of those rights and freedoms’.

78

Article 52(3) of the Charter states, furthermore, that ‘in so far as this Charter contains rights which correspond to rights guaranteed by the Convention for the Protection of Human Rights and Fundamental Freedoms, the meaning and scope of those rights shall be the same as those laid down by the said Convention. This provision shall not prevent Union law providing more extensive protection’.

79

Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950 (‘the ECHR’), provides that ‘everyone has the right to respect for his private … life’ and that ‘there shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others’. Accordingly, in interpreting Article 8 of the Charter, it is necessary to have regard to Article 8 ECHR, as a minimum level of protection, as those two provisions contain equivalent rights (see, to that effect, judgment of 8 April 2014, Digital Rights Ireland and Others, C‑293/12 and C‑594/12, EU:C:2014:238, paragraph 54).

80

According to the case-law of the Court and of the European Court of Human Rights (‘the ECtHR’), the requirement that any interference with the exercise of fundamental rights must be ‘provided for by law’, as it is put in Article 52(1) of the Charter, or ‘in accordance with the law’, as it is put in Article 8(2) ECHR, demands not only that the interference has a legal basis in national law, but also that that legal basis has certain characteristics of accessibility, and foreseeability, in order to avoid all risk of arbitrariness (see, to that effect, judgment of 15 March 2017, Al Chodor, C‑528/15, EU:C:2017:213, paragraph 38, and ECtHR, 26 April 1979, Sunday Times v. the United Kingdom, CE:ECHR:1979:0426JUD000653874, § 49, and 4 December 2015, Roman Zakharov v. Russia, CE:ECHR:2015:1204JUD004714306, § 228).

81

Furthermore, it is apparent from the case-law of the ECtHR that the term ‘law’ in the phrase ‘in accordance with the law’, which appears, inter alia, in Article 8(2) of the ECHR, is to be understood in its substantive sense, not its formal one. It thus covers not only statute but also unwritten law and is not limited to primary legislation but also includes legal acts and instruments of lesser rank. In sum, the ‘law’ is the provision in force as the competent courts have interpreted it (see, to that effect, ECtHR, 26 April 1979, Sunday Times v. the United Kingdom, CE:ECHR:1979:0426JUD000653874, § 47, and 8 April 2021, Vavřička and Others v. the Czech Republic, CE:ECHR:2021:0408JUD004762113, § 269).

82

Accordingly, the fact that the contested decision does not have the status of a legislative act, adopted following a Parliamentary debate, is not a sufficient ground for holding that it is not a ‘law’ for the purposes of Article 8 of the Charter, interpreted in the light of Article 8 ECHR.

83

Admittedly, it is also apparent from the case-law of the ECtHR that, in order to meet the requirements as to quality of law, the national law must offer certain protection against arbitrary interference by the public authorities with the rights guaranteed by the ECHR and that, on issues concerning fundamental rights, the law would breach the principle of the rule of law, a fundamental principle of democratic society enshrined by the ECHR, if the discretion given to the executive was unlimited. Consequently, it must define the scope of any such discretion, and the way in which it is to be exercised, in a sufficiently precise manner (see ECtHR, 15 March 2022, Communauté genevoise d’action syndicale (CGAS) v. Switzerland, CE:ECHR:2022:0315JUD002188120, § 78 and the case-law cited).

84

In the present case, however, in so far as the contested decision is itself a ‘law’ within the meaning of Article 8 of the Charter, interpreted in the light of Article 8 ECHR, it cannot be held that the Parliament needed express authorisation from the EU legislature in order to adopt such measures, which are based on Article 232 TFEU and Rule 25(2) of the Parliament’s Rules of Procedure.

85

Furthermore, in the present case, as the Parliament has observed, the contested decision has the characteristics of accessibility and foreseeability required to avoid arbitrariness.

86

In that context, it should be emphasised that the contested decision lays down clear and precise rules governing the scope and application of the measure in question and provides the persons concerned, inter alia, with sufficient guarantees to effectively protect their personal data against the risk of abuse and against any unlawful access and use of those data (see, to that effect and by analogy, judgment of 8 April 2014, Digital Rights Ireland and Others, C‑293/12 and C‑594/12, EU:C:2014:238, paragraph 54 and the case-law cited).

87

Thus, it is apparent from recitals 22 to 25 and from Article 4 of the contested decision that the persons whose personal data are processed by the Parliament on the basis of that decision are protected under Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the EU institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ 2018 L 295, p. 39).

88

Lastly, it must be observed that – as the Parliament has pointed out – the applicants’ argument that Rule 25(2) of the Rules of Procedure of the Parliament cannot serve as a basis for the adoption of measures which are contrary to the statute for Members of the Parliament or to Protocol No 7 does not relate to the issue of whether there is an appropriate legal basis for the contested decision, but to that of whether the decision is lawful having regard to those provisions; an issue which will be examined in addressing the second plea below.

89

In the light of the foregoing considerations, it must be held that Rule 25(2) of the Rules of Procedure of the Parliament constituted a valid legal basis for the adoption of the contested decision.

90

Accordingly, the first plea must be dismissed as unfounded.

91

The applicants’ second plea is subdivided into two parts, the first based on infringement of Article 2 of the statute for Members of the Parliament, which enshrines the principles of freedom and independence of Members of the European Parliament, and the second on infringement of the immunities conferred on Members of the Parliament, in particular by Protocol No 7.

92

The applicants submit that the contested decision is very restrictive and seriously undermines the principle that the mandate of a Member of the Parliament is exercised freely and independently, as enshrined in Article 2 of the statute for Members of the Parliament, in so far as they might, as a result of that decision, find themselves unable to sit and to exercise their representative function, which could negatively affect the balance of powers and the free exercise of democracy.

93

In that regard, the applicants observe that the refusal of access to Parliament buildings provided for by the contested decision, in the event that a valid COVID certificate is not presented, is applicable regardless of the reason why no such certificate is presented. Thus, the reason why a Member of the Parliament is unable to present a valid COVID certificate might be that he or she does not possess or wish to possess one, but it might equally be that he or she has forgotten or lost it, or because his or her smartphone is not working at the time of the check. They also observe that Members of the Parliament who do not hold a certificate of vaccination or a certificate of recovery have to be tested at least every other day, because the test results are only valid for a limited time. Furthermore, they say, allowance must be made for a considerable waiting time between the test and the generation of the quick response code (‘QR code’). Thus, if they wish to attend Parliament on Monday morning, they have no choice but to carry out the tests during their rest days, and in practice it would be impossible to test during the ‘red’ weeks of plenary sessions or the ‘pink’ weeks of trilogues, as debates end late in those weeks and restart early in the morning.

94

The Parliament does not accept those arguments.

95

As a preliminary observation, it must be observed that Article 2(1) of the statute for Members of the Parliament provides that ‘Members shall be free and independent’. Similarly, Rule 2 of the Rules of Procedure of the Parliament provides, inter alia, that Members are to exercise their mandate freely and independently. The principle that members of parliament exercise their mandate freely and independently is common to parliamentary democratic systems, and is an essential element of the representative democracy on which the functioning of the European Union is based, in accordance with Article 10(1) TFEU. That principle includes the right for Members of the European Parliament to enter Parliament buildings freely, so that they can participate actively in the work of the Parliament’s committees and delegations, in accordance with Rule 5(4) of the Rules of Procedure of the Parliament.

96

The contested decision thus constitutes an interference with the exercise of the mandate of Members of the European Parliament, as it requires them to meet an additional condition in order to enter Parliament buildings, namely that they can present a valid COVID certificate.

97

However, it must be observed, that the principle that the mandate of a Member of the Parliament is to be exercised freely and independently is not an absolute principle, and that certain restrictions can be imposed on it, in particular by the Parliament, in the exercise of the power to determine its own internal organisation conferred on it by Article 232 TFEU, where it is seeking to achieve a legitimate objective.

98

However, any interference with the principle that the mandate of a Member of the Parliament is to be exercised freely and independently, or any restriction on that principle, must comply with the principle of proportionality, as a general principle of EU law. That principle requires measures adopted by the EU institutions to be appropriate and necessary for meeting the objectives legitimately pursued by the legislation in question, and where there is a choice between several appropriate measures, the least onerous measure must be used (see, to that effect, judgment of 2 October 2001, Martinez and Others v Parliament, T‑222/99, T‑327/99 and T‑329/99, EU:T:2001:242, paragraph 215 and the case-law cited).

99

In the first place, as is apparent inter alia from recitals 1 to 11 of the contested decision, that decision pursues a legitimate objective, seeking to balance two competing interests in the context of a pandemic, namely, continuity of the Parliament’s activities and the health of those present on its premises.

100

On the one hand, the Parliament is obliged to ensure the continuity of the activities it conducts pursuant to the Treaties. Thus, during the COVID-19 pandemic, the operational capacity of the Parliament, and in particular its legislative and budgetary activities, had to be maintained. To that end, the Parliament adopted extraordinary measures based on Title XIIIa of its Rules of Procedure which involved, inter alia, the introduction of methods of remote participation. However, as is apparent from Rule 237a of the Rules of Procedure of the Parliament, such extraordinary measures must, by definition, be limited in time. Consequently, the Parliament was required to return as soon as possible to its normal mode of work, with Members physically attending, in order to ensure the normal functioning of the Parliament as an EU institution whose members are democratically elected.

101

On the other hand, the Parliament is required, pursuant to its duty to have regard for the welfare of officials and to its obligation, deriving inter alia from Article 1e(2) of the Staff Regulations – which also apply, by virtue of Article 10 of the Conditions of Employment of Other Servants of the EU (‘the CEOS’), to temporary staff of the European Union – to ensure the health and safety of officials and other servants of the European Union. While it does not go so far as to impose an obligation to achieve a particular outcome, the duty of the EU institutions to ensure the safety of their staff is particularly rigorous, and the discretion afforded to the administration in relation to it is reduced, though not completely extinguished (see, to that effect, judgments of 27 March 1990, Grifoni v Commission, C‑308/87, EU:C:1990:134, paragraph 14, and of 12 May 2011, Missir Mamachi di Lusignano v Commission, F‑50/09, EU:F:2011:55, paragraph 126). The same applies to the obligation to protect the health of staff in the service of the European Union. Accordingly, and given that the presence of Members of the Parliament on Parliament premises meant that they would come into contact with the staff of that institution, the Parliament was required, in order to comply with its obligation to ensure the health of those staff, to see to it that the return to normal business could take place without extensive adverse effects on the health of persons attending its premises, including its staff.

102

In that regard, as is apparent from recital 13 of the contested decision, the medical service of the Parliament took the view that:

‘The higher presence of persons in Parliament’s buildings, the increase in travelling due to the resumption of missions, the greater frequency of close contacts in physical meetings, and the increase of COVID-19 incidence in society entail a higher risk of introducing the virus into the European Parliament and a higher risk of in-house COVID-19 transmission and quarantines. Moreover, as an international organisation and a publicly accessible institution, the European Parliament needs to take into account frequent international travel as an extra risk factor which could turn it into a transmission hub. Therefore, the Union-wide health situation should be taken into account and not only the situation at the level of the Member States in which Parliament has its seat or its working places.’

103

Furthermore, as is apparent from recital 14 of the contested decision, data provided by the medical service of the Parliament showed that, in the first two and a half weeks of September 2021, there had been more cases registered of close contacts with persons who had received a positive COVID-19 PCR test than in any previous month since November 2020, and that this trend had continued throughout the month of September 2021 and the first week of October 2021.

104

Accordingly, in the light of the foregoing, it must be held that the contested decision pursues a legitimate objective and does not constitute an instrument which is manifestly inappropriate for achieving that objective, in the light of the information which was available to the Parliament at the time when that decision was adopted.

105

In the second place, it is necessary to consider whether the contested decision constitutes a disproportionate or unreasonable interference with the free exercise of the mandate of Members of the Parliament, and whether it impairs the very essence of that right (see, to that effect, judgment of 28 March 2017, Rosneft, C‑72/15, EU:C:2017:236, paragraph 148 and the case-law cited).

106

In that regard, as the Parliament observes, access to vaccinations and testing is universal, rapid and affordable throughout the European Union, and this is the foundation for the issuance of COVID certificates. The requirement for Members of Parliament to present a COVID certificate in order to enter Parliament buildings cannot therefore be regarded as a disproportionate and unreasonable interference with the free exercise of their mandate, having regard to the contested decision’s legitimate objective of protecting the lives and health of those attending Parliament premises, while also ensuring that the Parliament returned to normal business.

107

It must also be observed that the Parliament put measures in place to provide its Members with the support necessary for them to comply with the new entry requirements, in the event that they did not hold a COVID certificate, such as the possibility of being tested on site, free of charge, in the Parliament’s three places of work.

108

Furthermore, the contested decision does not go beyond what is strictly necessary to ensure a return to normal parliamentary business. According to the Parliament’s medical officer’s opinion of 10 October 2021, the return to normal parliamentary business would inevitably lead to more cases of COVID-19 and more quarantines. Also according to that opinion, those risks could be reduced by measures such as that introduced by the contested decision. As regards the protection of personal data, a minimum of personal data is shown when COVID certificates are checked upon entry to Parliament premises, as is apparent from the evidence produced by the Parliament (see paragraph 177 below).

109

In addition, it must be observed that the contested decision is not permanent in nature. Article 6 of the contested decision provides for it to lapse on 31 January 2022, unless renewed, amended or repealed, and for it to be subject to regular reassessment in view of the evolution of the health situation.

110

Furthermore, as the Parliament submits, the contested decision made it possible for the extraordinary measures to be terminated and for Members of Parliament to exercise their rights once again through a return to on-site activities, with far fewer restrictions on the free and independent exercise of their mandates than there had been under the remote participation regime.

111

Lastly, it must be observed that – as the Parliament has pointed out – the applicants have not identified any alternative measure which would have been less intrusive and still achieved the objective pursued in a similar manner. In that regard, the applicants have not shown that a return to conducting Parliamentary business through physical attendance, without any obligation to present a COVID certificate in order to enter Parliament buildings, would have contributed, in the same manner, to the objective of ensuring the health of staff.

112

The applicants rely, however, on numerous negative consequences of the contested decision on their situation (see paragraph 93 above).

113

First, in so far as the applicants rely on harm suffered as a result of refusal to present a valid COVID certificate or forgetting to bring the certificate, it must be observed that the harm on which they rely does not result from the contested decision alone, but from their choice not to present such a certificate, there being no assertion by the applicants that it would have been impossible for them to have done so (order of 8 December 2021, D’Amato and Others v Parliament, T‑722/21 R, not published, EU:T:2021:874, paragraph 23).

114

Second, it should be noted that Article 5(2) of the contested decision enables the Secretary-General of the Parliament to grant derogations from the obligation to present such a certificate in order to enter Parliament buildings, so as to address certain specific situations.

115

Third, in so far as the applicants submit that they might find themselves unable to present a valid COVID certificate because of technical problems relating, for example, to the use of a smartphone, it must be observed that the COVID certificate is accepted in both paper and digital form, and that such technical problems should therefore, in principle, be avoidable.

116

Fourth, the applicants submit that they would be required to take very regular tests, including on rest days, and that it would be impossible for them to be tested on very busy working days.

117

Without making a ruling as to the admissibility of that argument – it being unnecessary to do so – it must be observed, as regards the situation of those applicants who have neither been vaccinated nor recovered, that the Parliament offers its Members, in its three places of work, the support necessary for them to comply with the new entry requirements, in the event that they do not possess a valid COVID certificate. Thus, the Parliament has put arrangements in place for free on-site testing at its three places of work. Furthermore, all Parliament staff were made aware of those arrangements on 28 October 2021, which was before the contested decision entered into force. In addition, it is possible to present a negative result from a PCR test carried out in Belgium, Luxembourg or France in order to gain entry to Parliament buildings. Lastly, while the validity period of PCR tests was originally two calendar days from the day of the test, the validity period of a PCR test was extended to 72 hours from the time it was carried out, with effect from 22 November 2021 until 27 January 2022, by virtue of the decision of the Secretary-General of the Parliament of 19 November 2021.

118

Fifth, in relation to the applicants’ argument that the contested decision also directly undermines their power of representation as elected Members of the Parliament and their ability to work productively and efficiently, in that it also applies to their assistants and to Parliamentary staff, it should be observed that – as the Parliament has pointed out – the applicants have not advanced any specific argument capable of establishing that those persons are not able to comply, in a timely manner, with the entry conditions imposed by the contested decision.

119

Sixth – and lastly – the applicants observe that, in France, the amendments under which Members of the National Assembly and Senators would have been required to present a COVID certificate in order to enter National Assembly and Senate buildings were all rejected, by reason in particular of a decision of the Conseil constitutionnel (Constitutional Council, France) of 11 May 2020, in which it was noted that numerous provisions of the French constitution prevented interference with the freedom enjoyed by Members of the Parliament in the exercise of their mandate, and that a parliamentarian could never be refused access to the chamber.

120

It is sufficient to recall, in that regard, that the Parliament, which has buildings not only in France, but also in Belgium and Luxembourg, has an autonomous legal basis available to it for adopting measures of internal organisation such as those introduced by the contested decision, pursuant to Article 232 TFEU and Rule 25(2) of its Rules of Procedure, and thus cannot be bound by assessments made at the level of a particular Member State.

121

In the light of the foregoing, it must be held that none of the arguments advanced by the applicants is capable of establishing that the contested decision constitutes a disproportionate or unreasonable interference with the free and independent exercise of the mandate of a Member of the Parliament, or that the very essence of the exercise of that mandate is impaired.

122

Accordingly, the first part of the second plea must be dismissed as unfounded.

123

The applicants contend that the contested decision also infringes the first paragraph of Article 7 of Protocol No 7, which prevents Member States from imposing administrative restrictions on the free movement of Members of the European Parliament. They submit that that provision should be interpreted, in the light of the final subparagraph of Article 4(3) TEU, as prohibiting any measure which could jeopardise the attainment of the European Union’s objectives, including measures which could hamper the functioning of the EU institutions.

124

Furthermore, according to the applicants, although it is formally addressed to the Member States, there is no doubt that the first paragraph of Article 7 of Protocol No 7 also applies to the EU institutions when they adopt restrictive measures, such as the contested decision. That provision should be read in the light of the provisions of the Charter, and particularly the articles concerning the protection of private life and the right to physical integrity. It is also apparent, the applicants submit, from Article 18 of Protocol No 7 and Rule 5 of the Rules of Procedure of the Parliament, that the Parliament must cooperate with the Member States with regard to the implementation of Protocol No 7. In particular, the Parliament must ensure that Members can exercise their functions independently and protect their right to participate actively in the work of the Parliament’s committees and delegations.

125

The Parliament does not accept those arguments.

126

Article 7 of Protocol No 7 provides that ‘no administrative or other restriction shall be imposed on the free movement of Members of the European Parliament travelling to or from the place of meeting of the European Parliament’.

127

It is necessary to examine whether, as the applicants submit, that provision prevents the Parliament from adopting measures seeking to restrict or impose conditions on entry to its buildings, such as that contained in the contested decision.

128

In that regard, first of all, it must be observed that, as the applicants acknowledge, Protocol No 7 is addressed in the first instance to Member States, and not EU institutions.

129

Furthermore, as the applicants point out, Article 18 of Protocol No 7 provides that ‘the institutions of the Union shall, for the purpose of applying this Protocol, cooperate with the … Member States’. Rule 5 of the Rules of Procedure of the Parliament provides, inter alia, that Members enjoy the privileges and immunities laid down in the Protocol No 7 and that ‘for the purpose of performing their parliamentary duties, all Members shall have the right to participate actively in the work of Parliament’s committees and delegations in accordance with the provisions of these Rules of Procedure’.

130

However, it does not follow in any way from those provisions, even when interpreted in the light of the provisions of the Charter relating, in particular, to the rights to respect for private life to physical integrity, that the Parliament has no power to adopt measures of internal organisation, such as those contained in the contested decision, on the basis of Rule 25(2) of its Rules of Procedure. On the contrary, Rule 5 of those Rules of Procedure expressly provides that the Members’ right to participate actively in the work of Parliament’s committees and delegations is to be exercised ‘in accordance with the provisions of these Rules of Procedure’.

131

Furthermore, as is apparent from the last subparagraph of Rule 176(1) of the Rules of Procedure of the Parliament, ‘the President may impose a penalty upon a Member in cases in which provision is made, by these Rules of Procedure or by a decision adopted by the Bureau under Rule 25, for the application of this Rule’. Such a provision would itself be unlawful under the applicants’ proposed interpretation of Protocol No 7. It should be observed however that the applicants have not made any claim, on the basis of Article 277 TFEU, that the Rules of Procedure are unlawful.

132

Lastly, it must be observed that, according to the case-law, the privileges and immunities of the European Union recognised by Protocol No 7 have a purely functional character, inasmuch as they are intended to avoid any interference with the functioning and independence of the European Union. Consequently, those privileges and immunities are granted solely in the interests of the European Union. The same necessarily applies to the immunity of Members of the Parliament: the purpose of that immunity is to avoid any obstacle to the proper functioning of the institution to which they belong, and therefore to the exercise of the powers of that institution (see order of 30 September 2011, Gollnisch v Parliament, T‑346/11 R, not published, EU:T:2011:553, paragraph 23 and the case-law cited). To the same effect, the second sentence of Rule 5(2) of the Rules of Procedure of the Parliament provides that ‘parliamentary immunity is not a Member’s personal privilege but a guarantee of the independence of Parliament as a whole, and of its Members’.

133

Accordingly, having regard to the foregoing considerations, it must be held that the contested decision does not constitute an infringement of Protocol No 7 or, in particular, of Article 7 of that protocol.

134

It follows that the second part of the second plea must also be dismissed as unfounded, and with it the second plea as a whole.

135

The applicants’ third plea is subdivided into two parts, the first based on breach of the purpose limitation principle which applies to data processing and of the principle of legality, and the second on breach of the principles of fairness, transparency and minimal processing.

136

The applicants observe that, under the purpose limitation principle, personal data must be collected for specified, explicit and legitimate purposes and cannot be further processed in a different manner. Thus, it is only in the exceptional cases exhaustively listed in Article 6 of Regulation 2018/1725 that the data controller can extend the purposes beyond those for which the data were originally collected.

137

Therefore, the applicants submit that in order for the personal data contained in their COVID certificates to be used for the purpose of granting them access to the Parliament’s buildings, it is a legal requirement that those data have been collected for that purpose.

138

The applicants argue, however, first, that Regulation 2021/953 provides for the data to be processed only in order to facilitate the exercise of the right to move and reside freely within the territory of the Member States during the COVID-19 pandemic. Second, it is clear from recital 48 of Regulation 2021/953 that if Member States wish to use the personal data processed in the context of implementing the COVID certificate for purposes other than those provided for by Regulation 2021/953, they must ensure that there is a specific legal basis for doing so in national law. That principle has also been acknowledged, the applicants submit, in the recent Joint Opinion (No 04/2021) of the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) on the Proposal for a Regulation of the European Parliament and of the Council on a framework for the issuance, verification and acceptance of interoperable certificates on vaccination, testing and recovery to facilitate free movement during the COVID-19 pandemic (Digital Green Certificate) (‘Joint Opinion No 04/2021’), and by the EDPS in its guidance ‘on Return to the Workplace and [EU Institutions’] screening of COVID immunity or infection status’.

139

Furthermore, in Belgium, where Members of the Parliament would usually need to be tested, Belgian legislation does not mention access to the workplace or to the national parliaments as being among the purposes for which personal data linked to the COVID certificate can be processed. The applicants submit that such use of the data would be expressly forbidden in that it would result in a disguised vaccination obligation. Similarly, in France, the use of a COVID certificate for access to the parliamentary assemblies has been expressly rejected.

140

Lastly, the applicants submit that none of the exceptions contained in Article 6 of Regulation 2018/1725 applies to the present case and accordingly that the Parliament cannot rely on any of those exceptions as a justification for ‘processing for another compatible purpose’.

141

Thus, according to the applicants, in the absence of any basis in national law expressly permitting medical data relating to vaccination, tests or recovery to be processed for the purposes of implementing conditional access to the workplace and to parliamentary assemblies, the processing of personal data carried out by the Parliament breaches the purpose limitation principle and is therefore unlawful.

142

The Parliament does not accept those arguments.

143

First of all, it must be observed that, according to Article 4(1) of the contested decision, ‘personal data retrieved from the certificate or equivalent certificate during the scanning process shall be processed in accordance with Regulation (EU) 2018/1725’. Article 4(1)(b) of Regulation 2018/1725, which lays down the purpose limitation principle, requires personal data to be ‘collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes’.

144

The purposes for which the personal data contained in COVID certificates are to be processed are set out in Article 10(2) of Regulation 2021/953, which provides as follows:

‘For the purpose of this Regulation, the personal data contained in the certificates issued pursuant to this Regulation shall be processed only for the purpose of accessing and verifying the information included in the certificate in order to facilitate the exercise of the right of free movement within the Union during the COVID-19 pandemic. After the end of period of the application of this Regulation, no further processing shall occur.’

145

It must be observed in that regard that – as the Parliament has pointed out – Article 10(2) of Regulation 2021/953 has to be understood as meaning that it is ‘for the purpose of this Regulation’, or in other words, when they are implementing the regulation, that the Member States may process the personal data contained in the COVID certificates only in order to facilitate the exercise of the right of free movement.

146

By contrast, as is apparent from the express terms of recital 48 of Regulation 2021/953 ‘Member States may process personal data for other purposes, if the legal basis for the processing of such data for other purposes, including the related retention periods, is provided for in national law, which must comply with Union data protection law and the principles of effectiveness, necessity and proportionality, and should contain provisions clearly identifying the scope and extent of the processing, the specific purpose involved, the categories of entity that can verify the certificate as well as the relevant safeguards to prevent discrimination and abuse, taking into account the risks to the rights and freedoms of data subjects’.

147

Contrary to the applicants’ submissions, it does not follow from that recital that the EU institutions – in this case the Parliament – are permitted to process the personal data contained in COVID certificates for purposes other than those provided for by Regulation 2021/953 only if there is a legal basis, laid down by national law, on which they are expressly authorised to do so.

148

As the Parliament has observed, the fact that the fourth sentence of recital 48 refers only to Member States and national law, and not to the EU institutions, can be explained by the fact that the regulation is addressed to the Member States and not the institutions.

149

Next, it must be observed that, pursuant to Article 5(2) of Regulation 2018/1725, the basis for the processing of personal data required for the administration and functioning of the institutions must be laid down in EU law.

150

Thus, in adopting the contested decision, the Parliament created a legal basis in EU law, based in turn on the power to determine its own internal organisation it enjoys pursuant to Article 232 TFEU, on which it can process the personal data contained in COVID certificates for the purposes of access to its buildings in its three workplaces, in conformity with Regulation 2018/1725.

151

Accordingly, the arguments advanced by applicants on the basis of Belgian or French legislation must be rejected as ineffective, inasmuch as the Parliament does not require a basis in national law in order to process the personal data contained in the COVID certificates for purposes other than those provided for by Regulation 2021/953.

152

Contrary to the applicants’ submissions, those conclusions are not undermined either by Joint Opinion No 04/2021 or by the EDPS ‘Guidance on Return to the Workplace and [EU Institutions’] screening of COVID immunity or infection status’.

153

First, in paragraph 23 of Joint Opinion No 04/2021, the EDPB and EDPS stated that ‘any possible further use of the framework and the Digital Green Certificate on the basis of Member State law, other than the one of facilitating the right to free movement between EU Member States, falls outside of the Proposal [for a Regulation of the European Parliament and of the Council on a framework for the issuance, verification and acceptance of interoperable certificates on vaccination, testing and recovery to facilitate free movement during the COVID-19 pandemic (Digital Green Certificate)], and consequently of the EDPB EDPS Joint Opinion’.

154

Second, in relation to the EDPS ‘Guidance on Return to the Workplace and [EU Institutions’] screening of COVID immunity or infection status’, paragraph 6.1 confirms that in the case of EU institutions, the term ‘national law’, in recital 48 of Regulation 2021/953, is to be interpreted as referring to Article 1e(2) of the Staff Regulations, supplemented by an executive decision of an institution providing for adequate measures to safeguard the fundamental rights and interests of the data subject.

155

Lastly, in so far as the applicants rely on infringement of Article 6 of Regulation 2018/1725, it should be observed that that article provides for a derogation from the purpose limitation principle. Under that article, ‘where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject’s consent or on Union law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 25(1)’, the data controller must have regard to certain criteria in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data were initially collected.

156

In the present case, as is apparent from recital 24 of the contested decision, the processing of personal data is carried out, inter alia, for the purpose of protecting public health. It therefore pursues an objective of general public interest of the European Union, as referred to in Article 25(1)(c) of Regulation 2018/1725, and the processing of personal data envisaged by the contested decision, carried out for a purpose other than that provided for by Regulation 2021/953, is consequently authorised by that provision, provided that it respects the essence of the fundamental rights and freedoms provided for by that regulation, and that it is a necessary and proportionate measure in a democratic society; an issue that will be considered in connection with the fourth plea.

157

In the light of the foregoing considerations, and subject to consideration of the proportionality of the processing of the applicants’ personal data envisaged by the contested decision, the first part of the third plea must be dismissed as unfounded.

158

In the first place, the applicants observe, first, that the principle of fair and transparent processing requires the data subject to be informed of the existence of the processing operation and its purposes. They submit, on that basis, that the use of the personal data by the Parliament for a purpose other than that for which those data were collected under national legislation breaches the principle of transparency laid down in Article 4(1)(a) and Article 14 of Regulation 2018/1725, in so far as they were not informed, at the time of collection of the personal data, that those data would be used to implement conditional access to their workplace.

159

In the second place, the applicants consider that the processing of personal data carried out by the Parliament in implementing the contested decision does not comply with the principle of data minimisation laid down in Article 4(1)(c) of Regulation 2018/1725, in so far as Article 4(3) of the contested decision provides for personal data relating to the validity of the COVID certificate to be processed and displayed when the QR code shown on the certificate is scanned.

160

The security personnel responsible for checking COVID certificates at the entrance to Parliament buildings could easily work out what kind of certificate was held by each person, given that test certificates are valid for no more than 2 days, recovery certificates are valid for 180 days, and vaccination certificates are valid indefinitely. Such data concerning the validity of the certificates are not necessary for the purposes of the data processing.

161

In that regard, the applicants observe that the Parliament had itself identified this risk in a document entitled ‘Security measures to combat COVID 19 – data protection impact study’ (‘the impact study’), but came to the conclusion that the associated risks were low, taking account of the technical and organisational measures it had put in place with regard to the processing of those data. The applicants submit, however, that there is nothing either in the contested decision or in any other notification given to them to indicate that any specific measures were taken to minimise those risks.

162

According to the applicants, it would also be entirely possible for the security personnel to take screenshots of this confidential information. The disclosure of highly sensitive data of that type might have very serious consequences for the data subjects, potentially leading to stigmatisation or discrimination in the workplace. Accordingly, the processing of the applicants’ personal data cannot be regarded as fair.

163

In the third place, the applicants express concern that vulnerabilities in the CovidScanBE application used at the entrance to Parliament buildings to scan the COVID certificate QR codes could lead to unlawful and unfair processing of their personal data. That risk had been identified as a potential risk in the impact study. The applicants claim, furthermore, that a very significant security breach has recently been detected in relation to the use of the CovidScanBE application to validate and read the COVID certificate QR codes. In that regard, the applicants state that interim proceedings seeking an order suspending the use of the CovidScanBE application, on the grounds of multiple infringements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1), have been brought before the President of the tribunal de première instance francophone de Bruxelles (Brussels Court of First Instance (French-speaking), Belgium) who, by order of 29 October 2021, held that the risk of a breach was sufficiently clear for an independent expert to be appointed to examine the vulnerabilities and determine any damage caused. Lastly, the applicants state that a second vulnerability in the CovidScanBE application makes it possible to access sensitive personal data, such as name, date of vaccination, type of vaccine, country of vaccination and number of doses received, when the COVID certificate QR code is read using the travel module of the application.

164

According to the applicants, these matters demonstrate that the contested decision breaches the principle of fair and transparent processing of personal data.

165

The Parliament does not accept those arguments.

166

In the first place, it should be observed that, under Article 4(1)(a) of Regulation 2018/1725, personal data must be ‘processed lawfully, fairly and in a transparent manner in relation to the data subject’.

167

Furthermore, Article 15(1) of Regulation 2018/1725 provides as follows:

‘Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:

…

168

Article 16(1)(c) of Regulation 2018/1725 provides that that information must also be given where the personal data have not been collected from the data subject.

169

Furthermore, Article 16(4) of Regulation 2018/1725 provides that ‘where the controller intends to further process the personal data for a purpose other than that for which the personal data were obtained, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2’.

170

Thus, contrary to the applicants’ submissions, it is apparent from those provisions that, in the event of personal data being processed for a purpose other than that for which they were initially collected, it is solely for the subsequent data controller to provide the data subjects, prior to the further processing, with information on that other purpose and with any relevant further information.

171

Accordingly, in so far as, in the present case, the processing of personal data provided for by the contested decision is – as the Parliament accepts – further processing for a purpose other than that for which those personal data were collected, it was incumbent on the Parliament, under the provisions referred to above, to provide the data subjects, prior to that further processing, with information on that other purpose.

172

It is apparent from the evidence produced by the Parliament that it discharged that obligation.

173

As that evidence shows, first, prior to processing the data in question, the Parliament made published an entry (No 464) in its public record of processing activities which related to that operation, and was accompanied by a confidentiality statement. Second, on 27 October 2021 it sent an email to the Members of the Parliament and all staff, informing them of the purposes of the processing. Third, as stipulated in Article 6(1) of the contested decision, the decision was ‘visibly displayed at all entrance points of Parliament’s buildings in which the verification is carried out’; that is not disputed by the applicants.

174

Accordingly, it must be held that the Parliament fulfilled the obligations imposed on it by the principle of transparency and that the applicants’ argument that they should have been informed, when their personal data were first collected, of the fact that those data would be used for purposes connected with entry to Parliament buildings, must be dismissed as unfounded.

175

In the second place, it must be observed that Article 4(1) of Regulation 2018/1725 provides that ‘personal data shall be … adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”)’.

176

In that regard, it must be observed first of all that, under Article 4(2) and (4) of the contested decision, the purpose of the data processing operation carried out when the QR code is scanned is strictly limited to granting access to Parliament buildings, and that the data displayed when COVID certificates are checked are not stored, recorded or retained locally or externally or transferred to any other EU body or third party, and are not used for any other purpose.

177

Furthermore, as the Parliament confirmed at the hearing – without being contradicted by the applicants – its security personnel were instructed, as regards scanning of the QR codes on the COVID certificates of persons wishing to enter Parliament buildings, to use the CovidScanBE application in ‘event’ mode only. As is apparent from the evidence produced by the Parliament, when the CovidScanBE application is used in ‘event’ mode, it is only the validity of the certificate and the person’s surname and first name that are displayed. The same is true of the Luxembourg application CovidCheck.lu. Thus, contrary to the applicants’ submissions, the validity period of the certificate is not displayed, and the security personnel are therefore unable to determine whether the data subject is vaccinated, has tested negative or has recovered from COVID-19.

178

In any event, even if the validity period of the certificates were visible to the Parliament’s security personnel, who could deduce from it that the data subject was vaccinated or had recovered or had tested negative, that would not necessarily have the serious consequences alleged by the applicants.

179

As the Parliament has stated, its personnel are trained to treat data processing operations as confidential and have been instructed not to share any personal data to which they may have access with persons other than those involved in controlling entry to the buildings. A breach of those instructions would lead to disciplinary or contractual penalties. Furthermore, the officials and other servants of the Parliament who are responsible for checking COVID certificates are subject to strict obligations of professional secrecy under Article 339 TFEU and are required under Article 17 of the Staff Regulations – which, by virtue of Article 11 of the CEOS, is also applicable to members of the temporary staff – to ‘refrain from any unauthorised disclosure of information received in the line of duty, unless that information has already been made public or is accessible to the public’, even after they have left the service.

180

Furthermore, according to the information provided by the Parliament at the hearing, which was not contradicted by the applicants, it is not technically possible to take a screenshot when a COVID certificate is checked using one of the applications used by the Parliament’s security personnel. Thus, even in the unlikely event that information concerning the validity period of the certificates was revealed during the process of scanning the QR code shown on the COVID certificate, the risk of the security personnel being able to record information displayed by the application they use and disclose that information to unauthorised persons must be regarded as very small, or even non-existent.

181

While it is true that the impact study identified a risk associated with a potential vulnerability in the application used, it must be observed that that risk was regarded as small, having regard to the technical and organisational measures taken by the Parliament in relation to its processing of personal data, including in particular the fact that the applications used are not designed to store the personal data after each individual check, that those applications do not enable personal data to be exported, and the fact that they were only to be connected to the Parliament’s internal secure internet.

182

Next, as regards the order of 29 October 2021 of the President of the tribunal de première instance francophone de Bruxelles (Brussels Court of First Instance (French-speaking)), it must be observed that, contrary to the applicants’ submissions, the President of that court did not make any finding as regards a security vulnerability in the CovidScanBE application, but simply appointed a legal expert to determine whether the level of security involved in using that application could be considered to be sufficient. In that regard, as the Parliament submits, it is apparent from that order that the alleged security vulnerabilities in the CovidScanBE application arise from the fact that the Suspension list database, which is managed by the Belgian authorities and queried by the application, is accessible to the public. However, as the Parliament states, those vulnerabilities do not relate to the personal data contained in the certificates presented to its security personnel during the verification process carried out prior to entry to Parliament buildings, given that, under Article 4(4) of the contested decision, the checking of COVID certificates by the Parliament’s security personnel is not to result in personal data being transferred from the CovidScanBE application to the database in question.

183

Lastly, turning to the applicants’ claims regarding the ‘travel’ mode of the CovidScanBE application, these must also be dismissed given that, as has been observed above, in principle, the Parliament’s security personnel use the application in ‘event’ mode only. In any event, as the Parliament confirmed at the hearing – without being contradicted by the applicants – when that application is used in ‘travel’ mode, all that appears on the screen when a certificate is checked is the first name, surname and date of birth of the COVID certificate holder, together with the validity of the certificate.

184

Therefore, in the light of the foregoing considerations, the processing of personal data carried out by the Parliament pursuant to the contested decision cannot be regarded as unlawful or unfair.

185

The second part of the third plea must consequently be dismissed, and with it the third plea in its entirety.

186

By their fourth plea, the applicants allege, first, infringement of their right to respect for private life and to protection of their personal data, of their right to physical integrity, liberty and safety, and of their right to equality in law and non-discrimination. Second, they submit that the infringement of those rights and principles is contrary to the proportionality principle laid down by Article 52(1) of the Charter.

187

In that regard, the applicants emphasise the importance of the fundamental rights which are protected by the Charter. They also observe that, while those rights are not absolute, any limitation on them must be provided for by law, respect the essence of the rights and comply with the proportionality principle.

188

In the first place, the applicants submit that the contested decision infringes the right to physical integrity enshrined in Article 3(1) of the Charter, in that it requires those of them who do not hold a vaccination or recovery certificate to submit, every two days, to a nasopharyngeal swab for the purposes of testing for infection with SARS-CoV-2. The applicants contend that those swabs are particularly invasive, but also risky, relying in this regard on a communiqué from the Académie nationale de médecine (French National Academy of Medicine) of 8 April 2021, which reports that serious complications have arisen, such as ‘breaches of the anterior skull base associated with a risk of meningitis’.

189

In the second place, the applicants submit that the contested decision breaches the principles of equality and non-discrimination enshrined in Articles 20 and 21 of the Charter, in that it treats persons attending the Parliament on an occasional basis – in other words visitors, local assistants, external speakers and interest representatives – in the same way as Members and staff of the Parliament, who have to enter Parliament buildings on a regular basis.

190

Furthermore, the applicants contend that those of them who do not hold a vaccination or recovery certificate are discriminated against, by comparison to persons who do hold such certificates, in that they are required to submit to testing, at least every two days, in order to work and exercise their mandates.

191

In the third place, the applicants submit that, in that way, the contested decision also infringes the right by virtue of which free and informed consent is required for any medical intervention, enshrined in Article 3(2) of the Charter, as well as the right to liberty enshrined in Article 6 of the Charter. Many people may find repeated nasopharyngeal swabs intolerable and feel obliged to get vaccinated in order to avoid them. The applicants submit that vaccination against COVID-19 is not mandatory in any EU Member State, and consequently that a disguised vaccination mandate of that kind infringes the right to liberty.

192

In the fourth place, the applicants contend that, by making access to the workplace conditional on the presentation of highly sensitive medical data, such as vaccination status, test results or proof of recovery from the disease, the contested decision infringes the right to respect for private life and to protection of personal data. Under Article 10(1) of Regulation 2018/1725, processing of data concerning health is prohibited except in exceptional cases.

193

The Parliament does not accept those arguments.

194

In the first place, as is apparent from the examination of the first plea, the contested decision constitutes the legal basis in EU law for the adoption of measures limiting the rights relied on by the applicants in connection with the first part of the fourth plea, and such measures must therefore be regarded as being ‘provided for by law’ within the meaning of Article 52(1) of the Charter.

195

In the second place, it is clear that the contested decision does not impinge on the essential content or very substance of the rights relied on by the applicants.

196

First, as regards the claimed interference with the physical integrity of those applicants who do not hold a vaccination or recovery certificate, said to arise from the fact that those applicants are required to submit, on a regular basis, to nasopharyngeal swabs which they consider to be particularly invasive, it must be observed that the contested decision goes no further than to make entry to Parliament buildings conditional on the presentation of a COVID certificate, and does not require specific tests involving nasopharyngeal swabs. It is also open to those applicants to have a PCR test conducted by way of a throat swab or, alternatively, to have a RAT test carried out by a health professional, in accordance with Article 3(1) of Regulation 2021/953.

197

With regard, more specifically, to the French National Academy of Medicine’s communiqué of 8 April 2021, which is relied on by the applicants, it is apparent from that document, first, that nasopharyngeal swabs should be carried out only by health professionals trained to perform the procedure under rigorous technical conditions; second, that salivary samples should be preferred in children, which is not applicable to the applicants; and third, that users of self-tests should be warned about the dangers of self-sampling. As the Parliament observes, the fact that self-tests have inherent complications of that kind is one reason why the Parliament does not accept them for the purposes of entry to its buildings, RAT tests only being accepted if carried out by health professionals.

198

Lastly, it must be observed that – as the Parliament has pointed out – it is open to the applicants, under Article 5(2) of the contested decision, to submit a request to the Secretary-General of the Parliament for a derogation from the obligation to present a valid COVID certificate, in duly justified cases.

199

Second, as regards the alleged breach of the principles of equal treatment and non-discrimination, enshrined in Articles 20 and 21 of the Charter, it must be observed that, under the case-law, that principle requires that comparable situations must not be treated differently, and different situations must not be treated in the same way, unless such treatment is objectively justified (see judgment of 5 July 2017, Fries, C‑190/16, EU:C:2017:513, paragraphs 29 and 30 and the case-law cited).

200

As regards the requirement for the situations to be comparable, their comparability must be assessed with regard to all the elements which characterise them. Those elements must, in particular, be determined and assessed in the light of the subject matter and purpose of the EU act which makes the distinction in question. The principles and objectives of the field to which the act relates must also be taken into account (see judgment of 19 December 2019, HK v Commission, C‑460/18 P, EU:C:2019:1119, paragraph 67 and the case-law cited).

201

In the present case, as the Parliament has observed, the question whether external visitors are comparable with Members and staff of the Parliament must be assessed with regard to the objective pursued by the contested decision, and not on the basis of how frequently they enter Parliament buildings. Thus, in the light of the objective of the contested decision, which, as stated in recital 11 thereto, consists in ‘providing sufficient safeguards in order to protect the life and health of all persons present on Parliament’s premises’, the applicants cannot be regarded as being in a situation different to that of any other person wishing to enter the Parliament buildings, even if, in the case of the applicants, the contested decision involves a greater limitation on their rights, in so far as it imposes conditions on access to their workplace. Once inside Parliament buildings, the risk of transmission of COVID-19 is the same with respect to Members and staff of the Parliament as it is with respect to any other person entering those buildings.

202

Similarly, it cannot be held that those among the applicants who do not hold a vaccination or recovery certificate are discriminated against in comparison with persons holding such certificates. The contested decision does not give preference to any of the three certificates referred to in Article 3(1) of Regulation 2021/953, but merely provides for verification of the validity of the COVID certificate confirming that one or other of those three certificates is held, as provided for by Article 1 of that decision.

203

Therefore, with regard to the objective pursued by the contested decision, the applicants cannot be regarded as being subject to unequal treatment or as being discriminated against in comparison with any other person wishing to enter Parliament buildings, or in comparison with persons holding a vaccination or recovery certificate.

204

Third, in so far as the applicants rely on the right by virtue of which their free and informed consent is required for any medical intervention on their person, and on their right to liberty, it must be observed that the contested decision does not give preference to any of the three certificates entitling the holder to a valid COVID certificate, pursuant to Article 3(1) of Regulation 2021/953, but merely makes entry to Parliament buildings conditional on the presentation of one of those certificates.

205

Given that the Parliament has introduced measures making it easier to obtain a test certificate based on a PCR test, which can be performed free of charge in any of the testing centres set up in Brussels, Strasbourg or Luxembourg (Luxembourg), and that it also acknowledges the validity of a PCR test performed in Belgium, France or Luxembourg but not converted into a COVID certificate, the contested decision cannot be regarded as constituting, in reality, a disguised vaccination obligation imposed on persons not holding a vaccination or recovery certificate.

206

Fourth, the Parliament does not dispute that the contested decision may constitute an interference with the applicants’ rights to respect for their private life and protection of their personal data, enshrined in Articles 7 and 8 of the Charter, in that it makes access to their workplace conditional on the presentation of a valid COVID certificate, which contains personal data relating to the state of health of the data subjects.

207

In that regard, as the applicants observe, the processing of such data is prohibited, in principle, under Article 10(1) of Regulation 2018/1725, subject to the exceptions set out in Article 10(2) thereof. In the present case, as the Parliament notes, recital 24 of the contested decision states that Article 10(2)(g) and (i) of Regulation 2018/1725, read together with Article 5(1)(a) of that regulation, constitute a legal ground for the processing of the personal data contained in the COVID certificates, as the processing of the data in question is necessary to protect public health and limit the spread of COVID-19.

208

Furthermore, none of the facts and matters advanced by the applicants indicate that the contested decision impinges on the very essence of the rights on which they rely, or more specifically, their right to protection of their personal data. As is apparent from paragraphs 175 to 184 above, the Parliament complied with the data minimisation principle, and the processing of personal data carried out pursuant to the contested decision cannot be regarded as unlawful or unfair.

209

Third, in accordance with Article 52(1) of the Charter, it remains necessary to consider whether the limitations, minimal as they may be, on the rights relied on by the applicants – supposing that such limitations do in fact exist – are necessary and genuinely meet objectives of general interest recognised by the European Union, or the need to protect the rights and freedoms of others, in a manner compliant with the principle of proportionality.

210

The applicants request the Court to make an assessment of proportionality, as provided for in the three limbs of Article 52(1) of the Charter.

211

As a preliminary point, it must be observed that the legality of the individual contested measure must be assessed purely on the basis of the elements of fact and of law existing at the time when it was adopted (judgments of 9 July 2007, Sun Chemical Group and Others v Commission, T‑282/06, EU:T:2007:203, paragraph 59, and of 26 October 2012, Oil Turbo CompressorCouncil, T‑63/12, EU:T:2012:579, paragraph 29).

212

Thus, in the present case, it is necessary to consider whether the contested decision is appropriate, necessary and proportionate having regard to the objectives it pursues, and in the light of the epidemiological situation and state of scientific knowledge as they stood at the time it was adopted.

213

First, the applicants submit that the contested decision is not necessary to attain the objectives it pursues, in particular that of preventing the spread of COVID-19 within the Parliament and thus protecting the health of the Members and staff of the Parliament.

214

The applicants contend that other, less onerous, measures, which were already in force, were sufficient to attain those objectives, in particular temperature checks, mask wearing and social distancing, regular airing and ventilation of offices and meeting rooms, and hand sanitisation. Furthermore, they submit, it has not been demonstrated that Parliament buildings are a particularly high-risk location as regards the transmission of COVID-19. In that regard, the applicants observe that, under World Health Organisation (WHO) guidance, a risk assessment must be carried out in respect of every specific workplace and every post or work group.

215

It follows, they submit, that it was unnecessary to introduce further measures in Parliament buildings. The mere fact that the Parliament is a place where larger numbers of persons gather, that travelling has increased due to the resumption of missions, and that physical meetings are regularly held, as stated in recital 13 of the contested decision, is not sufficient to demonstrate the need to impose measures as inimical to liberty as those contained in the contested decision.

216

The Parliament does not accept those arguments.

217

It must be observed, as a preliminary point, that the precautionary principle is a general principle of EU law, deriving from Article 11, Article 168(1), Article 169(1) and (2) and Article 191(1) and (2) TFEU. According to that principle, where there is uncertainty as to the existence or extent of risks to human health, protective measures may be taken without having to wait until the reality and seriousness of those risks become fully apparent, provided that they are non-discriminatory and objective (see, to that effect, judgments of 10 April 2014, Acino v Commission, C‑269/13 P, EU:C:2014:255, paragraph 57, and of 17 March 2016, Zoofachhandel Züpke and Others v Commission, T‑817/14, EU:T:2016:157, paragraph 51).

218

Furthermore, it must be observed that the Parliament is required, pursuant to its duty to have regard for the welfare of officials and its obligation, deriving inter alia from Article 1e(2) of the Staff Regulations, which also applies, by virtue of Article 10 of the CEOS, to temporary staff of the European Union, and which constitutes one of the legal bases for the contested decision, to ensure the health of its staff (see paragraph 101 above).

219

In the present case, when it adopted the contested decision, the Parliament was proceeding on the following basis.

220

First, as stated, in essence, in recital 5 of the contested decision, the public health situation in Europe had been characterised, since September 2021, by an upward trend in COVID-19 infections and, on 1 November 2021, the number of new infections had reached the same level as in November 2020.

221

Accordingly, contrary to the applicants’ submissions, the epidemiological situation cannot be considered to have been ‘stable’ at the time of adoption of the contested decision.

222

Second, after teleworking had been brought to an end, with effect from 1 September 2021, the Parliament’s medical officer had expressed the opinion that the return to physical attendance at work carried an increased risk of transmission of the virus. As stated, essentially, in recital 13 of the contested decision, the Parliament took account of the fact that the higher presence of persons in Parliament buildings and the increase of COVID-19 prevalence in society entailed a higher risk of introducing the virus into the Parliament and a higher risk of in-house COVID-19 transmission and quarantines. Furthermore, the Parliament took account of the fact that Members of the Parliament had frequent contact with their electorates in the 27 Member States, in which the epidemiological situation varied widely, and that it therefore needed to take frequent international travel into account as an extra risk factor which could turn it into a transmission hub.

223

Accordingly, having regard to those considerations, it must be held that the Parliament could reasonably consider that the adoption of more stringent preventative health measures was necessary in order to protect the health of all persons present in its buildings. As the Parliament states, in the light of the epidemiological situation as it stood at the time of adoption of the contested decision, checking of COVID certificates on entrance to its buildings could reasonably be regarded as a measure which was necessary in order to limit the risk of transmission of COVID-19 within the Parliament, and thus to protect health of its staff, in conjunction with the other preventative measures which had already been put in place.

224

It is true, as the applicants point out, that it was decided, with effect from 22 November 2021, to introduce mandatory teleworking on three days per week for all members of staff, in so far as that was compatible with the performance of their duties.

225

However, as has been stated in paragraph 211 above, the legality of the contested decision must be assessed purely on the basis of the elements of fact and of law existing at the time when it was adopted. Accordingly, this element, which post-dates the adoption of the contested decision, cannot be taken into account in assessing the legality of that decision.

226

Second, the applicants submit that the contested decision is not apt to protect against the spread of the virus and prevent Members of the Parliament and staff entering Parliament buildings from becoming infected. They contend that there is no scientific consensus as to the transmission of the virus by vaccinated persons and that there are a great many studies indicating that it can be passed on by both vaccinated and unvaccinated persons. According to the applicants, the WHO itself stated, in a publication of 5 February 2021, that a good deal remained unknown about the effectiveness of vaccination in terms of reducing transmission. They submit, on that basis, that a vaccination or recovery certificate does not provide any guarantee that the holder is not contagious. Similarly, they submit that the presentation of a negative PCR test is an inappropriate and disproportionate measure, given the number of ‘false positive’ results. Accordingly, it cannot validly be argued that requiring a valid COVID certificate to be presented on entry to Parliament buildings is a means of reducing the risk of transmission of the virus and thus protecting the persons entering those buildings.

227

The Parliament does not accept that argument.

228

First, it must be observed that, according to recital 11 of the contested decision, that decision is intended, inter alia, to ‘provide sufficient safeguards in order to protect the life and health of all persons present on Parliament’s premises’. It is therefore necessary to consider whether the contested decision is an appropriate measure having regard to that objective.

229

In that regard, it should be noted that, in spite of certain studies relied on by the applicants, which demonstrate that vaccinated persons can also pass on the virus, and that the protection offered by the vaccine diminishes appreciably over time, it is apparent, in particular, from the opinion of the medical adviser of the Parliament, of 10 October 2021, which was relied on by the Bureau when it adopted the contested decision, that ‘according to recent data, the risk of transmission is lowest between two vaccinated individuals, and highest between two unvaccinated individuals; the risk of a (vaccinated) individual becoming infected is much higher when he or she comes into contact with an unvaccinated individual than with a fully vaccinated individual’.

230

Furthermore, according to a study produced by the Parliament (Singanayagam, A., Hakki, S., Dunning, J., et al., ‘Community transmission and viral load kinetics of the SARS-CoV-2 delta (B.1.617.2) variant in vaccinated and unvaccinated individuals in the UK: a prospective, longitudinal, cohort study’, Lancet Infc. Dis. 2022, 29 October 2021, pp. 183 to 195), vaccination reduces the risk of infection by the Delta variant of the virus, which was the dominant variant in Europe at the time of adoption of the contested decision, both by reducing the probability of a vaccinated individual being infected on exposure, and by reducing the infectiousness of an infected vaccinated person, not only in terms of the level of infectiousness but also in terms of its duration.

231

Next, is relation to the applicants’ argument that the effectiveness of vaccines in preventing transmission of the virus diminishes appreciably over time, it must be observed that – as the Parliament has pointed out – it is apparent from the first study cited by the applicants (Riemersma, K.K., et al., ‘Shedding of Infectious SARS-CoV-2 Despite Vaccination’, MedRxiv, 15 October 2021, p. 4) that an additional dose of vaccine administered after the initial series of vaccinations considerably reduces the risk of infection by the Delta variant.

232

In that regard, it must also be observed that, according to recital 7 of Regulation 2021/953, the available scientific evidence demonstrates that persons who are vaccinated or who have had a recent negative COVID-19 test result and persons who have recovered from COVID-19 in the previous six months have a reduced risk of infecting people with SARS-CoV-2. That being so, the applicants would need more specific and compelling grounds in order to challenge the validity of Regulation 2021/953, which enjoys a presumption of legality, particularly as they have not made any formal claim, pursuant to Article 277 TFEU, that that regulation is illegal.

233

Lastly, as regards the applicants’ argument concerning ‘false positive’ test results, it must be observed that the applicants have not produced any evidence to support a finding that such a large number of tests are concerned that it could undermine their credibility as the basis for one of the three certificates accepted as showing that the holder is not infected with COVID-19, pursuant to Regulation 2021/953.

234

In any event, as the Parliament observes, according to the Belgian public institution Sciensano, ‘positive’ and ‘weakly positive’ test results could, in some cases, be regarded as indicating a previous infection if certain conditions are met, and in such a case there is no need for isolation.

235

Thus, while it is true – as the applicants point out – that neither vaccination, nor testing, nor recovery can completely eliminate transmission of the virus, the fact remains that, as is apparent from the medical opinions on which the Parliament based its adoption of the contested decision, and which are themselves based on the state of scientific knowledge as it then stood, the obligation to present a valid COVID certificate reduces the risk of transmission, and thus enhances the existing health measures through objective and non-discriminatory verification in those three respects.

236

Accordingly, it must be held that in taking account of the information available to the Parliament and, in particular, of the epidemiological situation and the scientific knowledge that existed at the time of adoption of the contested decision, the Parliament could legitimately take the view that the requirement to hold a valid COVID certificate in order to enter its buildings was an appropriate measure in the light of the objective of protecting the health of its staff and that of all persons in its buildings.

237

In the third place, the applicants submit that the contested decision is manifestly disproportionate in that, according to recital 7 of the contested decision, vaccination coverage within the Parliament stood, on the basis of estimates provided by the medical service of the Parliament, at between 80 and 85%. The applicants submit that, given such a high rate of coverage, and unless vaccination against COVID-19 is to be regarded as ineffective, it is manifestly disproportionate to impose an additional measure restricting access to Parliament to persons holding a valid COVID certificate.

238

The applicants submit a fortiori that the Parliament cannot establish that the contested decision is proportionate by relying on the need to protect unvaccinated Members of the Parliament and staff. Those individuals are free to choose not to be vaccinated and the Parliament cannot discriminate against them on the basis that it wishes to protect them against the supposed effects of their choice on their health.

239

The Parliament does not accept those arguments.

240

It must be observed that, according to settled case-law, the principle of proportionality, which is one of the general principles of EU law, requires that acts adopted by EU institutions do not exceed the limits of what is appropriate and necessary in order to attain the legitimate objectives pursued by the legislation in question; where there is a choice between several appropriate measures, recourse must be had to the least onerous, and the disadvantages caused must not be disproportionate to the aims pursued (judgments of 8 July 2010, Afton Chemical, C‑343/09, EU:C:2010:419, paragraph 45, and of 4 June 2020, Hungary v Commission, C‑456/18 P, EU:C:2020:421, paragraph 41).

241

It must therefore be determined whether the obligation to hold a valid COVID certificate, pursuant to the contested decision, constitutes a proportionate measure having regard to the objective pursued, in the sense that that objective could not be attained through less restrictive but equally effective measures (see, to that effect judgment of 11 February 2021, Katoen Natie Bulk Terminals and General Services Antwerp, C‑407/19 and C‑471/19, EU:C:2021:107, paragraph 61 and the case-law cited).

242

In that regard, the applicants cannot legitimately argue that, by reason of the high rate of vaccination in the Parliament, estimated at between 80 and 85%, it would be manifestly disproportionate to impose an additional measure restricting access to Parliament to persons holding a valid COVID certificate.

243

That argument rests on the premiss that such a measure would not effectively contribute to protecting the health of the staff, and that of all persons entering Parliament buildings.

244

As the Parliament has pointed out, and as is apparent, in essence, from recital 14 of the contested decision, having regard to the cases of infection identified within the Parliament, to the considerable increase in the number of persons entering the building that occurred in and after September 2021, vaccination coverage within that group being unknown, to the predominance of the Delta variant of the virus and to the general trend of the pandemic, it was proportionate to the objective pursued by the contested decision, which was to protect the health of Members and staff and limit the spread of COVID-19, to apply the existing health measures in conjunction with mandatory COVID certificate checks.

245

Furthermore, as is apparent from the scientific studies produced both by the applicants and by the Parliament, which reflect the state of scientific knowledge at it stood when the contested decision was adopted, while vaccination does not completely eliminate the risk of transmission of COVID-19, it nevertheless reduces that risk to a significant extent. Therefore, the Parliament could legitimately take the view that the obligation to present a valid COVID certificate, in so far as it requires a person wishing to enter Parliament buildings to hold a vaccination, recovery or test certificate, would help to reduce that risk.

246

It should be emphasised, in that regard, that the applicants have by no means established that there were other, less restrictive, measures that the Parliament could have adopted which would have been equally effective in terms of attaining the objective pursued.

247

As regards, in particular, the continuation of the other health measures which were in place, without any additional restrictions, when the contested decision was adopted, the applicants have not demonstrated how that measure would have been capable of attaining, with equal effectiveness, the objective of reducing the number of transmissions of the virus within the Parliament, so as to protect the health of its staff. As the Parliament stated at the hearing, the number of recorded infections within the Parliament fell significantly after the contested decision was adopted, which tends to demonstrate that the measure at issue was effective.

248

In the absence of the additional measures contained in the contested decision, a person who was not vaccinated against and had not recovered from COVID-19, for example, and was a potential carrier of the virus, would have been free to enter Parliament buildings, thus putting the many people who work in or enter those buildings on a daily basis at risk of infection, with no arrangements in place for that person to be screened.

249

If, as the applicants contended at the hearing, the contested decision gave rise to a ‘false sense of security’ on the part of vaccinated persons, encouraging them to believe that the fact that they had presented a valid COVID certificate, based on a vaccination certificate, meant that they were not at risk of a COVID-19 infection, that would not provide any basis for challenging the proportionality of the contested decision. That argument cannot demonstrate that less restrictive but equally effective measures were available, but only, potentially, that even more restrictive measures could have been adopted by the Parliament, such as a requirement for vaccinated persons also to be regularly tested.

250

Furthermore, the fact that other EU institutions did not impose similar restrictions does not provide any basis for challenging the proportionality of the contested decision. As is clear, in particular, from recital 13 of the contested decision, the Parliament did not have regard only to the general epidemiological situation in Europe, but also to the particular features of the Parliament, as an international organisation that needed to take account of frequent international travel as an extra risk factor which could have turned it into a transmission hub.

251

Lastly, particular importance must be attached to the fact that the measures instituted by the contested decision are limited in time and regularly reassessed in the light of the evolving epidemiological situation (see recital 27 of the contested decision).

252

It should also be observed that the contested decision is limited to requiring a person wishing to enter Parliament buildings in its three places of work to present one of the certificates provided for by Article 3(1)(a) to (c) of Regulation 2021/953, or an equivalent certificate as referred to in Article 8 thereof. While the practicalities of having to present such a certificate may, undoubtedly, involve some inconvenience, such inconvenience cannot outweigh the protection of other people’s health or be regarded as a disproportionate interference with the applicants’ fundamental rights.

253

Therefore, it must be held that, having regard to its obligation to ensure the health of its staff and its duty of care (see paragraphs 217 and 218 above), the contested decision is proportionate to the objective pursued.

254

It must be observed, however, that given the fluctuating epidemiological situation and the evolving scientific knowledge relating, in particular, to the emergence of new variants, and as stated in recital 27 of the contested decision, ‘the obligation to present [a valid COVID certificate] upon entering Parliament’s buildings … should apply only as long as the exceptional circumstances which justify it persist and shall be subject to a periodic assessment carried out in light of the health situation in the Union and in the European Parliament’s three places of work in order to ensure at any moment an appropriate balance between the rights of the persons concerned and legally protected interests at stake’.

255

Therefore, the second part of the fourth plea must be dismissed, and with it the fourth plea in its entirety.

256

In view of all the foregoing considerations, the actions must be dismissed as unfounded.

257

Under Article 134(1) of the Rules of Procedure, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings.

258

Since the applicants have been unsuccessful, they must be ordered to pay the costs, including those relating to the interim proceedings, in accordance with the form of order sought by the Parliament.

On those grounds,

THE GENERAL COURT (Eighth Chamber, Extended Composition)

hereby:

I. Background to the dispute

II. Forms of order sought

III. Law

A. Admissibility of the actions

1. The applicants’ legal interest in bringing proceedings

2. The applicants’ standing to bring the action

B. The admissibility of the requests to modify the applications

C. Substance

1. The first plea, based on the lack of any valid legal basis on which the contested decision could produce effects in relation to Members of the Parliament

2. The second plea, based on breach of the principles of freedom and independence of Members of the Parliament and infringement of the immunities conferred on them by the Treaty

(a) First part, based on the contested decision being contrary to the principles of freedom and independence of Members of the Parliament

(b) Second part, based, in essence, on infringement of the immunities conferred on Members of the Parliament by Protocol No 7

3. The third plea, based on breach of the general principles relating to the processing of personal data

(a) First part, based on breach of the purpose limitation principle which applies to data processing and of the principle of legality

(b) Second part, based on breach of the principles of fairness, transparency and minimisation

4. The fourth plea, based, in essence, on unjustified and disproportionate interference with the right to respect for private life and to protection of personal data, the right to physical integrity, the right to liberty and safety and the right to equality in law and non-discrimination

(a) The alleged infringement of the right to respect for private life, the right to protection of personal data, the right to physical integrity, the right to liberty and safety and the right to equality in law and non-discrimination

(b) The alleged breach of the principle of proportionality

(1) Necessity of the measures at issue

(2) Appropriateness of the measures at issue

(3) Proportionality of the measures at issue

Costs