1. Introduction
On 10th February 2026, the Court of Justice (hereinafter, the Court) rendered its judgment in Case C-97/23, clarifying the analytical steps to determine the admissibility of an action for annulment under Article 263 TFEU of acts adopted by an EU body in the context of a ‘composite procedure’. Specifically, the Court held that binding decisions taken by the European Data Protection Board (EDPB) in the context of the consistency mechanism set out in Article 65 of the General Data Protection Regulation (GDPR) are open to direct challenge before the General Court (GC). Although such decisions are embedded in the ‘context of a process involving several procedural stages’, they produce binding independent legal effects vis-à-vis third parties. As a result, they qualify as challengeable acts under Article 263(1) TFEU.
This case note first provides an overview of the background to the present case, and then analyses the Court’s reasoning, highlighting both its relevance and limitations for widening access to effective judicial remedies in the context of composite administrative procedures.
2. Background to the case: composite administrative procedure in the GDPR
In 2018, the Irish National Supervisory Authority (NSA), acting as the lead supervisory authority, initiated ex officio investigations into WhatsApp’s compliance with the GDPR. The Irish NSA submitted a draft decision to the other NSAs concerned. Due to reasoned objections by some concerned NSAs and following the consistency mechanism laid down in Articles 60 and 65 GDPR, the Irish NSA referred the dispute to the EDPB. The EDPB adopted Binding Decision 1/2021, altering some of the findings of the Irish NSA draft decision and the amount of the fine imposed therein. Based on the EDPB decision, the Irish NSA adopted its final decision finding WhatsApp to be in breach of GDPR principle of transparency and related obligations for Articles 5(1)(a), 12(1), 13(1),(c-f) 13(2)(a,c,e) and 14 GDPR and reprehended WhatsApp with implementing measures and a final administrative fine of 225 million euros.
WhatsApp challenged both the final decision before a domestic court and the EDPB decision before the GC. The GC dismissed the action as inadmissible. It held the EDPB decision to be a preparatory, intermediate act not open to direct challenge and that WhatsApp lacked direct concern. WhatsApp appealed, arguing that the GC misinterpreted the concepts of challengeable act and of direct concern, and that had erred in its reading of the consistency mechanism.
3. Judgment at hand
In this case, the Court, before addressing the grounds of appeal, on a procedural level, rejected the EDPB’s argument that the action at first instance was brought after the two-month deadline enshrined in Article 263 TFEU, holding that it was not out of time (paras. 44-49). Subsequently and most importantly for this case note, the Court passed to analyse the substance of the appeal, and specifically, whether the decision at issue was a challengeable act for Article 263 first paragraph.
The Court highlighted the difference between, on the one hand, assessing the reviewability of an act and, on the other hand, the matter of whether a particular non-privileged applicant has legal standing.
As a matter of fact, an act is challengeable if it is intended to produce binding legal effects vis-à-vis third parties, regardless of whether the applicant is the addressee. The Court recalled that, in multi-stage procedures, only measures that definitively determine the position of the EU institution, body, office or agency are open to challenge, and that mere preparatory and intermediate acts are not (para. 69). Applying this test to the case at hand, the Court held that the EDPB decision is not a preparatory measure and constitutes an act open to challenge under Article 263(1) TFEU. It determines the final position of the EU body on the matter, and it produces autonomous binding effects on a third party – meaning, the NSAs concerned, and particularly the Irish NSA by obliging it to adopt a final decision consistent with it (Court’s judgment, para. 76).
The Court then examined whether the EDPB decision was of direct concern to WhatsApp. The Court reminded that, when the act is not directly addressed to them, a natural or legal person may initiate an action for annulment under the conditions of Article 263 fourth paragraph, if the act is of direct and individual concern to the applicant. Individual concern was not disputed, as the GC already found it; the focus of the Court was on direct concern only. According to settled case law, two cumulative conditions must be satisfied. First, the act must directly affect the legal situation of the applicant, and second, the act must leave no discretion to the addressees responsible for its implementation. The Court, following once again AG Ćapeta’s opinion, found both conditions satisfied. The EDPB decision altered WhatsApp’s legal position, without leaving any discretion to its addresses, meaning the Irish NSA, which had no discretion regarding those elements determined by the EDPB (Court’s judgment, para. 102).
The Court therefore ordered the set aside of the GC’s ruling and referred the case back to rule on the merits.
4. Analysis: access to justice in diagonal composite procedures
Both the AG Ćapeta’s opinion and the Court’s ruling situate the EDPB decision within a ‘composite procedure’, understood as a procedure that involves both EU and Member States authorities with different intensities and at various stages (Hofmann, 2009). Composite decision-making is polyform, with each procedure being differently designed by secondary law. Scholars have provided us with various systematisations on the basis of the actors involved and the ‘direction’ of the procedure; differentiating whether it starts at the national level and it is finished up at EU level (bottom-up), or the other way around (top-down) (Eliantonio, 2023).
Next to vertical cooperation between Member States (MS) and EU bodies, composite procedures may also be ‘horizontal’, where several MS authorities act together in the procedure, and even ‘diagonal’. In diagonal procedures, the final decision depends on the cumulative and interdependent exercise of decision-making power by the EU and national authorities. The GDPR consistency mechanism is an egregious example, where several NSAs and the EDPB jointly work towards the final decision (Hofmann 2019; Gentile & Lynskey, 2022).
Since the so-called Berlusconi ruling, the Court has tended to endorse the principle of ‘unitary judicial protection’ in vertical composite procedures, operationalised through the decisional dominance test (Brito Bastos, 2024, p. 163). This means that composite procedures shall be reviewed as a unified decision-making process and judicial review be centralised before the courts of the legal system in which the authority exercising ‘dominant’ decision-making power belongs to (i.e. where the EU body or institution determines the content of the final act and is not legally bound by national preparatory measures, review must be before the GC).
In the judgment at stake, however, the Court adopts a different approach. It rejected the GC’s attempt to concentrate proceedings in one court, the domestic one. The Court does emphasise that, although interrelated, the EDPB’s and the NSA’s decisions are two ‘separate acts’ whose scope at issue is well defined (para. 105), they are binding and produce distinct legal effects. Both are therefore independently reviewable. Specifically, AG Ćapeta considers the parallel proceedings a necessary consequence of the EU design of judicial remedies and the only solution to ensure ‘effective safeguard of all rights under EU law’ (AG Opinion paras. 174-175).
Rather than centralising review in a single forum, the Court relies on the principles of sincere cooperation and sound administration of justice to ensure consistency between parallel proceedings at domestic and EU levels (paras. 107-108). This approach enhances direct access to EU judicial review, but at the same time, it entails practical implications. The absence of a single forum and the need to challenge the validity of the acts in two separate courts increases the costs for the applicants and procedural complexity, as an applicant may be barred from contesting the validity of the decision indirectly in a national court, should it fail to act within the two-month limit in Article 263(6) TFEU. In fact, the AG points out that from TWD (Textilwerke Deggendorf) it follows that where an applicant is directly and individually concerned by an act of an EU body and yet fails to bring an action for annulment within the two-month time limit, it may be precluded from contesting the validity of that decision before the national court (AG Opinion, paras 177-178). This judgment reveals once again and compounds the complex functioning of the system of remedies provided for in EU law.
5. Conclusion
In Case C-97/23, the Court clarifies that decisions of EU bodies, adopted in the ‘context of a process involving several procedural stages’ are challengeable under Article 263(1) TFEU where they produce binding independent legal effects vis-à-vis third parties. This ruling strengthens direct judicial review of EU bodies’ binding decisions in diagonal composite procedures such as the GDPR consistency mechanism. At the same time, it highlights structural features of the EU system of remedies. Applicants may need to initiate both EU and domestic proceedings to secure a full review of all relevant legal issues. Therefore, this judgment consolidates access to direct review before the General Court while exposing the procedural complexity of the functioning of the system of remedies and the practical burden on applicants seeking comprehensive judicial protection under EU law.
