{"id":85012,"date":"2026-02-26T11:03:11","date_gmt":"2026-02-26T10:03:11","guid":{"rendered":"https:\/\/www.lexxion.eu\/?post_type=dpi&p=85012"},"modified":"2026-02-26T11:03:11","modified_gmt":"2026-02-26T10:03:11","slug":"data-protection-insider-issue-149","status":"publish","type":"dpi","link":"https:\/\/www.lexxion.eu\/en\/dpi\/data-protection-insider-issue-149\/","title":{"rendered":"Data Protection Insider, Issue 149"},"content":{"rendered":"

-CJEU Rules on the Possibility to Challenge EDPB Decisions-<\/strong><\/a><\/h3>\n

On 10th<\/sup> February, the CJEU ruled in the case of WhatsApp Ireland Ltd v. European Data Protection Board.<\/em> <\/a>In terms of the facts, the case essentially concerns an investigation into Whatsapp by the Irish Data Protection Board (DPB) into its transparency obligations and into its provision of information to data subjects. The DPB produced a decision, which was submitted to other national supervisory authorities. This process did not result in consensus, and, accordingly, the decision was submitted to the EDPB for resolution. The EDPB issued a binding decision, according to which the DPB was required to amend aspects of its original decision and the amount of the fine. The DPB accordingly issued a new decision to Whatsapp. Whatsapp then brought an action for annulment of the EDPB\u2019s decision to the General Court. This action was dismissed on the basis that it was not \u2018an act open to challenge and that that decision was not of direct concern to WhatsApp\u2019. \u2018According to the General Court, the EDPB\u2019s decision was merely an intermediate act and WhatsApp could challenge only the final decision of the Irish supervisory authority before a national court\u2019. \u2018WhatsApp then challenged the order of the General Court by bringing an appeal before the Court of Justice\u2019 \u2013 the case at hand. In this regard, the Court of Justice ruled \u2018the action for annulment\u2026admissible. However, given that the General Court did not consider the merits of the action before it, the determination of which requires a detailed assessment in fact and in law, the state of proceedings does not permit a ruling on the merits of the appellant\u2019s action. Accordingly, the case must be referred back to the General Court\u2019. In reaching its conclusions, the Court highlighted, amongst other things, that \u2018it must be held that the General Court erred in law, first\u2026by confusing the requirements resulting from the first and fourth paragraphs of Article 263 TFEU respectively and, second\u2026by formulating an incorrect test, relating to the lack of direct enforceability of the act at issue against WhatsApp, and by classifying the decision at issue as an intermediate measure producing no independent legal effects\u2019. Further, the Court considered that the EDPB\u2019s \u2018decision changes WhatsApp\u2019s legal position, since WhatsApp was required, in particular, as a result of the EDPB\u2019s intervention, to change its contractual relationship with the users of the messaging service provided by WhatsApp. It follows that there is a direct link between that decision and its effects on WhatsApp\u2019s situation\u2019. The case is fascinating, and touches on much more than can be dealt with in this brief summary \u2013 for example the relationship between the EDPB and national DPAs, and the relationship between possibilities to appeal decisions at national and European levels. It is, however, dense, and focused on the procedural aspects of data protection law. Accordingly \u2013 whilst we would thoroughly recommend reading it in full \u2013 it will likely most engage those interested with these aspects of law.<\/p>\n

-ECtHR Rules on \u2018Agents on Cover\u2019 in Bulgaria-<\/strong><\/a><\/h3>\n

On 17th<\/sup> February, the ECtHR ruled that the legal framework in Bulgaria on the deployment of \u2018agents on cover\u2019 breaches the right to correspondence and home under Article 8 ECHR in Green Alliance v Bulgaria.<\/em> <\/a>As to the facts of the case, it concerns the examination, in abstracto,<\/em> of the Bulgarian law on the infiltration of \u2018agents on cover\u2019 by the National Security Agency (NSA). More precisely, \u2018(t)hose \u201cagents on cover\u201d conceal only that they are working for the Agency, but are not permitted to use covert surveillance techniques or equipment, and are in Bulgaria considered as different from \u201cagents under cover\u201d\u2019. An NGO \u2013 Green Alliance \u2013 submitted that the Bulgarian legal provisions were in breach of Article 8 ECHR, in particular because of the lack of adequate safeguards in relation to the deployment and operation of such agents. The Court first ruled that the infiltration of such agents constitutes an interference with the right to confidentiality of communications and respect for home of the infiltrated entities because agents on cover could obtain information about the communications of the infiltrated entities and report on these to the NSA, and because they would have access to the respective premises. It ruled that the mere existence of the Bulgarian law could make the applicant NGO a victim to such infiltration. Second, the Court examined whether the interference was justified. It noted that the Bulgarian law was accessible to the public. However, after a detailed analysis, it concluded that the Bulgarian legal framework does not enshrine safeguards against abuse and arbitrariness, because: i) \u2018the broadly-defined grounds on which such agents can be deployed and fields in which they can be deployed, coupled with the way in which that deployment is decided, are capable of leading to arbitrariness and abuse\u2019; ii) there are \u2018no time-limits circumscribe the use of such agents\u2019; iii) \u2018the procedure for deploying such agents does not appear capable of ensuring that they will be used only when \u201cnecessary in a democratic society\u201d\u2019; iv) \u2018no arrangements exist for effective supervision of the use of such agents, which can lead to arbitrariness and abuse, as well as to corruption or the misuse of power by the \u201cagents on cover\u201d themselves\u2019; and v)\u00a0 \u2018there is no remedy in relation to the unlawful or unjustified use of such agents\u2019. Thus, it concluded that the Bulgarian law does not meet the \u2018 \u201cquality of the law\u201d\u2019 requirement and is not \u2018\u201dnecessary in a democratic society\u201d\u2019, in breach of Article 8 ECHR.<\/p>\n

-EDPB Releases New Documents-<\/strong><\/p>\n

In the past two weeks, the EDPB released the following documents:<\/p>\n