On 6 September 2023, the General Court (GC) dismissed the action for annulment of parts of the new Europol Regulation brought by the European Data Protection Supervisor (EDPS) as inadmissible. The EDPS sought the annulment of transitional provisions (Arts. 74a and 74b) of Europol Regulation (EU) 2022/991 that entered into force on 28 June 2022 (→ eucrim 2/2022, 98-100). The provisions confer on Member States the possibility to retroactively authorise Europol to process large data sets already shared with Europol prior to the entry into force of the amended Regulation. The EDPS considered these provisions contrary to his order of 3 January 2022 (→ eucrim 1/2022, 18) requesting Europol to delete data concerning individuals with no established link to a criminal activity within a predefined, clear time limit because otherwise the principle of data categorization, enshrined in Europol Regulation 2016/794 would be infringed (Case T-578/22). For the EDPS's action for annulment → eucrim 3/2022, 177-178.

The EDPS argued before the GC that the European Parliament and Council, when adopting the amendments to the 2016 Europol Regulation, infringed the independence and powers of the EDPS as a supervisory authority, as a consequence of the infringement of the principle of legal certainty and of the principle of non-retroactivity of legal acts. Accordingly, the contested provisions retroactively legalised Europol’s data retention practices and de facto annulled his decision of 3 January 2022.

The GC held, however, that the EDPS's action is inadmissible. The GC argues that the EDPS does not have a privileged standing before the CJEU, thus he must be treated in the same way as a "normal" legal person who must demonstrate that the EU act in question directly and individually concerns the person. According to the GC, this is not the case here because of, inter alia, the following reasons:

• The EU act in question (amending the initial Europol Regulation) has no bearing on the nature or scope of the tasks entrusted to the EDPS who can continue to exercise his powers;
• The EDPS decision of 3 January 2022 is an administrative decision which cannot affect legislative acts such as the amended Europol regulation or affect the content thereof;
• The contested provisions leave discretion to Europol as to the analysis of personal data, and are thus not purely automatic in nature.

The EDPS appealed the GC's order before the ECJ. The appeal case there is referred as Case C-698/23 P.