-CJEU Rules on Status of EDPB Opinion on Consent or Pay-
On 29th April, the CJEU ruled in the case of Meta Platforms Ireland Ltd v. European Data Protection Board. In essence, the case concerned the EDPB’s Opinion 8/2024, issued ‘under Article 64(2)’ of the GDPR at the request of three supervisory authorities – those of Norway, the Netherlands, and Hamburg. These authorities ‘sought an opinion on the circumstances and conditions under which practices implemented by ‘large online platforms’, whereby users are offered a choice between consenting to the processing of personal data for behavioural advertising purposes and paying a fee to access the service without their personal data being processed for those purposes (‘consent or pay’ models), could be considered to satisfy the requirement for valid consent, within the meaning of Regulation 2016/679’. In its Opinion, the EDPB highlighted a range of issues found problematic by Meta, including that ‘in most cases, it will not be possible for a ‘large online platform’, as referred to in the contested opinion, to comply with the requirements for valid consent if it gives users only a ‘binary choice’ between consenting to the processing of personal data for behavioural advertising purposes and paying a fee in order to be able to access the service concerned without receiving behavioural advertising’. In this regard, Meta requested the Court ‘annul the contested opinion in its entirety or, in the alternative, annul the relevant parts’ and ‘on the basis of the non contractual liability of the European Union:…order the EDPB to take all measures to cease the infringement committed by the adoption of the contested opinion, including by withdrawing the contested opinion;…order the EDPB to pay it compensation for the damage suffered by it as a result of the contested opinion;…declare that the contested opinion provides no basis to impose an additional free alternative requirement;…order any other form of reparation that accords with the general principles of non-contractual liability common to the laws of the Member States, including compensation in kind and declaratory relief, which the Court deems appropriate’. The Court declared inadmissible the claim for annulment. In its argumentation, the Court brought forward the following significant points: ‘the EDPB makes clear in the contested opinion that that assessment depends on a number of factors, including whether or not the service in question is an important part of the user’s social or professional life and the cost of the paid alternative. It also sets out various possibilities for free alternatives’; it ‘cannot…be inferred from the wording of the contested opinion that it is intended in itself to produce binding legal effects’; owing to its legal status under the GDPR, ‘the contested opinion does not produce binding legal effects vis-à-vis third parties’; the finding that Meta cannot challenge the Opinion does not ‘does not undermine Meta’s right to effective judicial protection’; and the inability to challenge the Opinion does not ‘undermine the unity of EU law’ – in relation to the possibility that ‘the content of that opinion could be assessed differently by the courts of States party to the EEA Agreement that are not members of the European Union and by the courts of Member States of the European Union, which, unlike the former, may refer questions to the Court of Justice for a preliminary ruling’. Following from this conclusion, the Court went on to dismiss the ‘claims submitted on the basis of the non-contractual liability…as manifestly lacking any foundation in law’. The Court highlighted, in this regard, that ‘the condition relating to the existence of actual and certain damage is not satisfied’ and that ‘the contested opinion does not produce mandatory legal effects…it is not binding’ and accordingly ‘it cannot be the sufficiently direct cause of the potential reduction in revenue that Meta claims to expect’. This is a fascinating case, but the argumentation is complex. Accordingly, we advise all interested in the procedural aspects of EU data protection law to read the case in detail.
-ECtHR: Distributing Footage of Alleged DUI and the Following Checks Violates Article 8 ECHR-
On 6th May, the ECtHR ruled that the distribution across nationwide accessible media outlets of footage of alleged drunk-driving and the ensuing police and medical checks violates the positive obligations of the State under Article 8 ECHR in Bayramov v. Azerbaijan. As to the facts of the case, the applicant is a lawyer. Footage of him showing how he was stopped by the police on suspicion of drunk-driving and the ensuing (medical) checks in the public hospital were distributed widely in national media outlets. The applicant and the police disagree as to whether he had actually been driving drunk. The applicant complained that it was the police who shot the videos and distributed them to the media. The police denied these allegations, claiming, inter alia, that passers-by could have shot the videos. As the applicant did not succeed in challenging the claimed illegal distribution of the videos in national courts, he submitted a complaint with the ECtHR under Articles 6 and 8 ECHR, which was examined solely under Article 8. The Court first recalled that ‘the recording of videos in a law-enforcement context or the release of applicants’ photographs by the police to the media constitutes an interference with the right to respect for private life’. Then, it decided that in casu it is not essential to establish whether the shooting and distribution of the contested videos was an act of the police or of private individuals, as the State bears positive obligations to protect the private life of individuals also from interferences by private parties. Thus, the Court framed the issue as a matter of the positive obligations of the State under Article 8 ECHR. It observed that: ‘The Government argued that the video footage of the applicant could have been captured by passers-by and independent journalists…. The Court firstly observes that the domestic courts never made such a finding in their judgments, nor did the Government adduce any evidence in support of that argument. Furthermore, they failed to explain how third parties could have filmed the applicant during the medical examination to determine his state of intoxication, given that it took place in a doctor’s room at the Narcology Centre of the Ministry of Health.… The Court considers that, in the circumstances of the present case, it was not unreasonable for the applicant to bring proceedings against the STP rather than against the television channels and websites’. Thus, the Court established that there had been a failure to fulfil the positive obligations of the State under Article 8 ECHR.
-AG Sanchez-Bordona: EDPS Should Have Ad Hoc Locus Standi to Challenge Legal Acts-
On 8th May, AG Sanchez-Bordona advised the CJEU to rule that the EDPS should be granted locus standi in casu in order to challenge specific provisions of a legal act which concern his legal situation in European Data Protection Supervisor (EDPS) v European Parliament and Council of the European Union. The case at hand constitutes an appeal which the EDPS brought against a previous General Court (GC) ruling, which declared the EDPS application as inadmissible, because the GC found that the EDPS lacked locus standi to bring an action before the GC for annulling certain provisions of the amended Europol Regulation (which is now in force). In its challenge to the contested GC judgment, the EDPS contests only the finding that it lacks locus standi under Article 263 TFEU and asks the CJEU to render a final judgment on the substantive issues brought to it by the EDPS. As to the background to the dispute in substance, it concerns a final decision adopted by the EDPS in January 2022 against Europol, in which it admonished Europol for having stored particular personal data longer than legally allowed under the Europol Regulation in force at the time. The EDPS also set out particular actions and deadlines for rectifying the situation. At the material time, the EU legislature was negotiating amendments to the Europol Regulation. From the documents on the trialogue as disclosed to the EDPS and the CJEU, it appears that following the EDPS decision, the legislators added provisions which would allow Europol to set aside the EDPS decision and thus retroactively nullify it. The EDPS was of the opinion that such legislative actions interfere with its supervisory independence as anchored in Article 8(3) CFREU. Thus, it brought an action for annulment of the contested provisions in the new Europol Regulation. Its application was dismissed by the General Court, because it argued that the EDPS did not fulfill any of the locus standi conditions of Article 263 TFEU and that the judgment Parliament v Council, which granted the Parliament locus standi, could not be applied to the EDPS. The EDPS now appeals the finding that it lacks locus standi. The EDPS brought two arguments forward: (1) that the EDPS should be interpreted to have the status of an EU institution, body or entity, as mentioned in Articles 263(2) and(3) TFEU (‘privileged standing’) and alternatively (2) that it fulfils the standing provisions in Article 263(4) TFEU (‘ordinary standing’). In the analysis AG Sanchez-Bordona argued that whereas there seem no reasons to find that the EDPS has privileged standing from reading the provisions of Articles 263(2) and (3) TFEU, the AG is of the opinion that the EDPS has ordinary standing in casu. He reasoned that the arguments of the GC should be set aside, as they deal with the substantive part of the dispute between the EDPS and the Commission/Parliament. Furthermore, in the AG’s words: ‘It is difficult to dispute that the contested transitional provisions constitute a ‘tailored’ response to the decision of the EDPS of 3 January 2022 and are, therefore, addressed to the EDPS on an individual basis. Those are rules which, in the light the ‘stakes’ represented by the decision of the EDPS, which it was no longer possible to challenge because it had become final, are intended to override the content and consequences of that decision. (…) I fail to see how, in those circumstances, it can be accepted that the EDPS is not directly and individually concerned by the contested transitional provisions, since those provisions are aimed, specifically, at counteracting an individual, and now final, decision adopted by him’. Thus, the AG advised the CJEU that ‘the case should be referred back to the General Court for it to give judgment following the proper exchange of views’.