CJEU - T‑183/23 - Ballmann v European Data Protection Board

Summary

The General Court of the European Union (CJEU) ruled in case T-183/23 that complainants have a right to access case files when the European Data Protection Board (EDPB) adopts a binding decision based on a complaint. This decision stems from a case where a Facebook user complained about Meta's data collection practices, leading to a cross-border investigation and a binding decision by the EDPB. The court affirmed that this right to access is independent of the right to be heard.

Full text

Help CJEU - T‑183/23 - Ballmann v European Data Protection Board: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 10:58, 23 July 2025 view sourceCci (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators1,003 editsmTag: Visual edit← Older edit Latest revision as of 13:05, 29 July 2026 view source Sfl (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators522 editsm Tag: Visual edit (One intermediate revision by the same user not shown)Line 17: Line 17: |GDPR_Article_Link_3=|GDPR_Article_Link_3= |EU_Law_Name_1=Article 41 EU Charter of Fundamental Rights|EU_Law_Name_1=Article 41 CFR |EU_Law_Link_1=https://fra.europa.eu/en/eu-charter/article/41-right-good-administration?page=5|EU_Law_Link_1=http://data.europa.eu/eli/treaty/char_2012/oj |EU_Law_Name_2=Art. 263 Treaty on the Functioning of the European Union|EU_Law_Name_2=Article 263 Treaty on the Functioning of the European Union |EU_Law_Link_2=https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:12008E263:EN:HTML|EU_Law_Link_2=http://data.europa.eu/eli/treaty/tfeu_2012/oj |EU_Law_Name_3=|EU_Law_Name_3= |EU_Law_Link_3=|EU_Law_Link_3= Latest revision as of 13:05, 29 July 2026 CJEU - T‑183/23 Ballmann v European Data Protection Board Court: CJEU Jurisdiction: European Union Relevant Law: Article 65(1) GDPR Article 41 CFRArticle 263 Treaty on the Functioning of the European Union Decided: 16.07.2025 Parties: Lisa Ballmann EDPB Meta Platforms Ireland Ltd. (intervening party) Case Number/Name: T‑183/23 Ballmann v European Data Protection Board European Case Law Identifier: ECLI:EU:T:2025:735 Reference from: Language: 24 EU Languages Original Source: Judgement Initial Contributor: cci The General Court held that when the EDPB adopts a binding decision stemming from a complaint, the complainant has a right to access the case file. Contents 1 English Summary 1.1 Facts 1.1.1 Context: The case against Meta 1.1.2 The case against the EDPB 1.2 Holding 1.2.1 The action was admissible 1.2.2 The right of access is independent from the right to be heard 1.2.3 The file concerned the complainant 2 Comment 3 Further Resources English Summary Facts The ruling relates to the procedural aspects of a cross-border case involving Meta Platforms Ltd. The full summary for the case is available here. Context: The case against Meta In May 2018 a Facebook user (the complainant) lodged a complaint against Meta Platforms Ireland Ltd with the Austrian DPA. In her complaint, she claimed that the collection of personal data via Facebook violated several rules of the GDPR, including Articles 6 and 9. Short after the complaint was filed, the Austrian DPA held that the case was cross-border in nature and forwarded the complaint to the Irish DPA as the lead supervisory authority. In 2021 the Irish DPA submitted a draft decision to all EEA supervisory authorities. Some of them raised “reasoned and relevant objections” to the draft within the meaning of Article 4(24) GDPR. The DPC decided not to follow some of those objections and, therefore, referred the matter to the EDPB under the GDPR’s consistency mechanism. The EDPB decided the matter in December 2022 with its Binding Decision 3/2022. Following the Binding Decision, the Irish DPA decided the complaint and fined Meta €210,000,000 over the unlawful processing of personal data for targeted advertising on Facebook. The case against the EDPB After the dispute resolution procedure of the EDPB the complainant requested access to the case file relating to her complaint. She invoked several provisions of EU primary and secondary law, including Article 41(2)(b) of the EU Charter of Fundamental Rights (“Right to good administration”). The EDPB replied with an email to the complainant (from now on: “the Contested Decision”), granting the complainant access to some of the documents relative to the procedure based on EU Regulation 1049/2001. However, the EDPB held that the complainant had no right of access under Article 41(2)(b) CFREU. As a result, the EDPB only granted the complainant access to parts of the file. The complainant considered that the EDPB violated her rights and filed an action for the annulment of the contested decision under Article 263 TFEU. The complainant claimed that under Article 41(2)(b) CFREU, she had a right to access the EDPB case file in relation to her complaint. On this ground, she requested that the Court of Justice (General Court) set aside the Contested Decision. The EDPB, in turn, requested that the Court declare the complainant’s action inadmissible or, in the alternative, unfounded. Meta was granted the status of intervening party and put forwards the same demands as the EDPB. Holding The Court upheld the complainant's demands and annulled the contested decision from the EDPB. The action was admissible First, the Court held that the action was admissible. In this regard, the Court considered that the contested decision "contains a refusal to grant access to the file requested" under Article 41(2)(b) CFREU. It "immediately and irreversibly affects the applicant’s legal position" to access the EDPB case file. According to the settled case law of the CJEU, it follows that the complainant could bring an action for annulment under Article 263 TFEU. In response to an argument from the EDPB, the Court also clarified that it was not relevant that the contested decision acknowledged the complainant's limited right of access under Regulation 1049/2001. In the case at hand, the complainant would have had a broader right of access under Article 41(2)(b) CFREU than she did under the Regulation (as the EDPB itself conceded). The right of access is independent from the right to be heard The parties put forward different interpretations of Article 41 CFREU – in particular, with regard to the relationship between paragraphs (2)(a) and (2)(b) of the provision. The EDPB claimed that paragraph (2)(a) and (2)(b) embody corollary aspects of the rights of the defence. In this interpretation, the complainant’s right of access was not protected under paragraph (2)(b) because the requirements of paragraph (2)(a) (being adversely affected), was not fulfilled. Therefore, the EDPB claimed the contested decision rightfully denied access to the file. The complainant claimed that the two paragraphs are independent from each other and embody autonomous rights. In other words: proving that the file concerned her, should have been sufficient grounds for accessing the file. The Court confirmed the complainant’s interpretation: “everyone has the right of access to his or her file based on Article 41(2)(b) of the Charter, including where that file is not linked to a procedure liable to culminate in a measure adversely affecting him or her”[1]. Therefore, the EDPB erroneously applied the requirements of Article 41(2)(a) CFREU to the right to access the file under Article 41(2)(b) CFREU, as the complainant claimed. The file concerned the complainant After clarifying the interpretation of Article 41 CFREU, the Court assessed whether the file for the Article 65 GDPR procedure concerned the complainant. The Court held that even though the complainant is not a formal party to the procedure under Article 65(1)(a) GDPR, the complaint plays an essential role in that procedure as it constitutes the starting point of the entire decision-making process. The Court also pointed out that the relevant and reasoned objections (of supervisory authorities concerned) form part of the procedure initiated following the complaint. In particular, these objections determine the scope of the EDPB’s binding decisions under Article 65(1)(a) GDPR. For this reason, a complainant may legitimately want to ascertain whether elements of the complaint were reproduced in the objections or the extent they have been taken into account in the binding decision. Finally, the Court held that complai

Entities