The General Court of the European Union ruled that certain transitional provisions (Regulation 2022/991) amending Regulation 2016/794 on the EU Agency for law enforcement cooperation (Europol) do not directly affect the European Data Protection Supervisor (EDPS), thereby dismissing the latter’s action, in an order handed down on Wednesday 6 September (Case T-578/22).
In June 2022, the European Parliament and the Council of the European Union amended the Europol Regulation by inserting two transitional provisions: - setting out the conditions under which Europol would, within a specified period, categorise the personal data in its possession at the time of entry into force of the amended Regulation; - specifying the conditions and procedures under which the processing of personal data not relating to certain categories of persons (Annex II of the amended ‘Europol’ Regulation) and transferred to Europol before 28 June 2022 is authorised in support of an ongoing criminal investigation (see EUROPE 12945/10, 12881/5).
The EDPS considers that these transitional provisions violate its independence and powers as a supervisory authority (see EUROPE 12981/12). In its view, these provisions retroactively legalise Europol’s practices of retaining the disputed data and de facto annul its decision of 3 January 2022, which ordered Europol to categorise the personal data of certain individuals received from 4 January onwards within six months, and to categorise the sets of personal data existing on the date of the decision within twelve months (see EUROPE 12866/10).
The European Supervisor is of the opinion that its standing is justified by the need to have access to a legal recourse in order to defend its institutional prerogatives.
By order, the Court dismissed the action as inadmissible. In order to be treated as a legal person, the EDPS must demonstrate that the act whose annulment it is seeking directly concerns it. However, in the Court’s view, this is not the case here. In fact, while the legal regime whose correct application the EDPS is responsible for monitoring has been modified, its own powers have not been modified by the revision of the Europol Regulation.
Furthermore, as regards the possible effects of the contested provisions on the EDPS’s decision of 3 January 2022, the EDPS cannot rely on them in support of its action, since an administrative decision cannot have an impact on legislative acts such as the amended Europol Regulation or affect its content. (Original version in French by Mathieu Bion)