General Court Upholds Broader Role For EDPB In OSS System

In a judgment delivered on 29 January 2025, the General Court of the European Union dismissed a challenge by the Irish Data Protection Commission to directions issued to it by the European Data Protection Board. In doing so, the Court endorsed the EDPB's interpretation of its power to require a lead supervisory authority to broaden the scope of an investigation carried out under the one stop shop system. This is potentially significant for any organisation dealing with such an investigation being carried out by its lead supervisory authority.

Background

In 2018, individuals from Belgium, Germany, and Austria filed complaints regarding the processing of their personal data for behavioural advertising purposes by Facebook, Instagram, and WhatsApp through the non-profit association NOYB. Given the cross-border nature of the data processing which was the subject of these complaints, the DPC as the lead supervisory authority under Article 56(1) of the General Data