CJEU C-479/22 OC v Commission 7 Mar 2024

JUDGMENT OF THE COURT (Sixth Chamber)

7 March 2024 (*)

(Appeal – Actions for damages – Non-contractual liability of the European Union – Alleged unlawful conduct of the European Anti-Fraud Office (OLAF) – Press release from OLAF – Protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies – Regulation (EU) 2018/1725 – Article 3, point 1 – Concepts of ‘personal data’ and of ‘identifiable natural person’ – Investigations conducted by OLAF – Regulation (EU, Euratom) No 883/2013 – Presumption of innocence – Right to good administration)

In Case C-479/22 P,

APPEAL under Article 56 of the Statute of the Court of Justice of the European Union, brought on 14 July 2022,

OC, represented by I. Ktenidis, dikigoros,

appellant,

the other party to the proceedings being:

European Commission, represented by T. Adamopoulos, J. Baquero Cruz, F. Blanc Simonetti and A. Bouchagiar, acting as Agents,

defendant at first instance,

THE COURT (Sixth Chamber),

composed of T. von Danwitz (Rapporteur), President of the Chamber, P.G. Xuereb and A. Kumin, Judges,

Advocate General: N. Emiliou,

Registrar: A. Calot Escobar,

having regard to the written procedure,

having decided, after hearing the Advocate General, to proceed to judgment without an Opinion,

gives the following

Judgment

1 By her appeal, OC seeks to have set aside the judgment of the General Court of the European Union of 4 May 2022, OC v Commission (T-384/20, ‘the judgment under appeal’, EU:T:2022:273), by which it rejected her action under Article 268 TFEU seeking compensation for the damage she allegedly suffered as a result of Press Release No 13/2020 of the European Anti-Fraud Office (OLAF) of 5 May 2020, entitled ‘OLAF investigation uncovers research funding fraud in Greece’ (‘the press release at issue’), in that it allegedly unlawfully processed her personal data and conveyed false information about her.

I. Legal context

A. Regulation (EU, Euratom) No 883/2013

2 Article 5 of Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999 (OJ 2013 L 248, p. 1), entitled ‘Opening of investigations’, provides in paragraph 1:

‘The Director-General may open an investigation when there is a sufficient suspicion, which may also be based on information provided by any third party or anonymous information, that there has been fraud, corruption or any other illegal activity affecting the financial interests of the [European] Union. The decision by the Director-General whether or not to open an investigation shall take into account the investigation policy priorities and the annual management plan of [OLAF] established in accordance with Article 17(5). That decision shall also take into account the need for efficient use of [OLAF]’s resources and for proportionality of the means employed. With regard to internal investigations, specific account shall be taken of the institution, body, office or agency best placed to conduct them, based, in particular, on the nature of the facts, the actual or potential financial impact of the case, and the likelihood of any judicial follow-up.’

3 Under Article 9(1) of that regulation, that article being entitled ‘Procedural guarantees’:

‘In its investigations [OLAF] shall seek evidence for and against the person concerned. Investigations shall be conducted objectively and impartially and in accordance with the principle of the presumption of innocence and with the procedural guarantees set out in this Article.’

4 Article 10 of the regulation, entitled ‘Confidentiality and data protection’, provides:

‘1. Information transmitted or obtained in the course of external investigations, in whatever form, shall be protected by the relevant provisions.

2. Information transmitted or obtained in the course of internal investigations, in whatever form, shall be subject to professional secrecy and shall enjoy the protection afforded by the rules applicable to the Union institutions.

…

5. The Director-General shall ensure that any information provided to the public is given neutrally and impartially, and that its disclosure respects the confidentiality of investigations and complies with the principles set out in this Article and in Article 9(1).

…’

5 Under Article 11(1) of Regulation No 883/2013, that article being entitled ‘Investigation report and action to be taken following investigations’:

‘On completion of an investigation by [OLAF] a report shall be drawn up, under the authority of the Director-General. That report shall give an account of the legal basis for the investigation, the procedural steps followed, the facts established and their preliminary classification in law, the estimated financial impact of the facts established, the respect of the procedural guarantees in accordance with Article 9 and the conclusions of the investigation.

The report shall be accompanied by recommendations of the Director-General on whether or not action should be taken. Those recommendations shall, where appropriate, indicate any disciplinary, administrative, financial and/or judicial action by the institutions, bodies, offices and agencies and by the competent authorities of the Member States concerned, and shall specify in particular the estimated amounts to be recovered, as well as the preliminary classification in law of the facts established.’

B. The GDPR

6 Article 2(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’), that article being entitled ‘Material scope’, provides:

‘For the processing of personal data by the Union institutions, bodies, offices and agencies, Regulation (EC) No 45/2001 [of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ 2001 L 8, p. 1)] applies. Regulation (EC) No 45/2001 and other Union legal acts applicable to such processing of personal data shall be adapted to the principles and rules of this Regulation in accordance with Article 98.’

7 Article 4 of the GDPR, entitled ‘Definitions’, is worded as follows:

‘For the purposes of this Regulation:

(1) “personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

…’

8 Article 98 of the GDPR, entitled ‘Review of other Union legal acts on data protection’, provides:

‘The [European] Commission shall, if appropriate, submit legislative proposals with a view to amending other Union legal acts on the protection of personal data, in order to ensure uniform and consistent protection of natural persons with regard to processing. This shall in particular concern the rules relating to the protection of natural persons with regard to processing by Union institutions, bodies, offices and agencies and on the free movement of such data.’

C. Regulation (EU) 2018/1725

9 Recitals 4, 5 and 16 of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ 2018 L 295, p. 39), state as follows:

‘(4) [The GDPR] provides for the adaptation of Regulation (EC) No 45/2001 in order to ensure a strong and coherent data protection framework in the Union and to allow its application in parallel with [the GDPR].

(5) It is in the interest of a coherent approach to personal data protection throughout the Union, and of the free movement of personal data within the Union, to align as far as possible the data protection rules for Union institutions, bodies, offices and agencies with the data protection rules adopted for the public sector in the Member States. Whenever the provisions of this Regulation follow the same principles as the provisions of [the GDPR], those two sets of provisions should, under the case-law of the Court of Justice of the European Union (the “Court of Justice”), be interpreted homogeneously, in particular because the scheme of this Regulation should be understood as equivalent to the scheme of [the GDPR].

…

(16) The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information, should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person, to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.’

10 Article 2(1) of Regulation 2018/1725, that article being entitled ‘Scope’, provides that that regulation ‘applies to the processing of personal data by all Union institutions and bodies’.

11 Under Article 3 of that regulation, entitled ‘Definitions’:

‘For the purposes of this Regulation, the following definitions apply:

(1) “personal data” means any information relating to an identified or identifiable natural person …; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

…

(3) “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as … disclosure by transmission, dissemination or otherwise making available …

…’

12 Articles 4 and 5 of Regulation 2018/1725 list, respectively, the principles relating to processing of personal data and the criteria for processing to be lawful. Article 6 of that regulation sets out the factors which the person responsible for the processing must take into account in order to ascertain whether processing for a purpose other than that for which the data are initially collected is compatible with that purpose. Lastly, Article 15 of that regulation lists the information to be provided where personal data are collected from the data subject.

II. Background to the dispute

13 The background to the dispute, as set out in paragraphs 1 to 8 of the judgment under appeal, may, for the purposes of the present proceedings, be summarised as follows.

14 The appellant, a Greek national, is a university researcher in the fields of nanotechnology applications, energy storage and biomedicine.

15 In 2007, she submitted to the European Research Council a research proposal relating to a project entitled ‘Study on the transition from micro to nano: theoretical and experimental foundations, simulations and applications’ (‘the project’).

16 On 30 September 2008, the Commission of the European Communities and the Aristoteleio Panepistimio Thessalonikis (Aristotle University of Thessaloniki, Greece) (‘Aristotle University’) signed Grant Agreement No 211166 (‘the agreement’), relating to the project. Aristotle University was designated as the host institution for the project. On 15 July 2009, an addendum to the agreement came into force, under which the Commission was replaced by the European Research Council Executive Agency (ERCEA), as that university’s co-contractor.

17 The agreement provided for a maximum grant of EUR 1 128 400 for the implementation of the project, which was awarded to Aristotle University as the main beneficiary, to the appellant as lead researcher and to another research institution situated in Greece, which was replaced on 25 February 2012 by another research institution situated in Germany. The project was carried out in a laboratory at that university, which was led by the appellant’s father.

18 As the project was completed on 30 September 2013, Aristotle University declared to ERCEA expenditure totalling EUR 1 116 189.21, including staff costs in the amount of EUR 255 219.37 and an amount of EUR 15 020.54 in respect of travel expenses. She sought payment of that sum under the agreement.

19 Following an ex post financial audit, ERCEA concluded that staff costs in the amount of EUR 245 525.43 were ineligible and decided to claim reimbursement of that sum from Aristotle University, issuing a debit note to that end. Aristotle University challenged the validity of that debit note before the General Court. By judgment of 17 January 2019, Aristoteleio Panepistimio Thessalonikis v ERCEA (T-348/16 OP, EU:T:2019:14), the General Court held that the claim formulated in the ERCEA debit note, seeking reimbursement from that university of an amount of EUR 245 525.43, was unfounded up to an amount of EUR 233 611.75 corresponding to eligible costs. That judgment was subsequently upheld by the Court, on appeal, in the judgment of 14 January 2021, ERCEA v Aristoteleio Panepistimio Thessalonikis (C-280/19 P, EU:C:2021:23).

20 ERCEA having also informed OLAF of the results of its audit, the Director-General of OLAF decided, on 29 May 2015, in accordance with Article 5 of Regulation No 883/2013, to open an investigation into possible irregularities or fraud in carrying out the project.

21 In its final report on its investigation, dated 11 November 2019, OLAF set out a number of findings. On the basis of those findings, OLAF recommended, first, that ERCEA take appropriate steps to recover from Aristotle University the sums regarded as being overpaid. Secondly, OLAF sent that report to the national judicial authorities and recommended that they initiate proceedings for fraud and forgery against the appellant, her father and a number of members of the university staff.

22 On 5 May 2020, OLAF published on its website the press release at issue. That press release, which referred to the investigation mentioned in paragraphs 20 and 21 of the present judgment, read as follows:

‘The protection of EU budget foreseen for research has always been particularly important for [OLAF]. A complex fraud involving a Greek scientist and her network of international researchers has been uncovered by [OLAF investigators].

The case involves a grant of around [EUR 1.1 million] from [ERCEA] to a Greek university. The money was intended to finance a research project run by a promising young scientist, whose father was employed at the university in question. The project was said to involve a network of more than 40 researchers from around the world under the leadership of the Greek scientist.

OLAF first became suspicious when it discovered how the international researchers were allegedly being paid. Cheques were issued in the names of individual researchers but were then deposited into bank accounts with multiple beneficiaries. Suspicions increased when it emerged that the cheques were personally deposited into the bank accounts by the lead scientist.

OLAF’s investigative team decided to conduct an on-the-spot check at the university in question. Despite attempts from the lead researcher to obstruct the investigation, and with the help from the Greek national law enforcement authorities which provided access to bank accounts and OLAF’s own digital forensic investigations, OLAF was able to piece together the true history behind the fraud.

Hard evidence was found, which demonstrated that the lead scientist had set up the bank accounts used to “pay” the international researchers and made herself a co-beneficiary of the accounts in order to gain access to the money. OLAF followed the financial trails and was able to prove that large sums were either withdrawn in cash by the scientist or were transferred into her private account. A number of the researchers who were said to be involved in the research project were contacted by OLAF. None of them were aware that their name was linked to the project or had any knowledge of the bank accounts opened in their names or of any payments made into them.

…

The investigation was concluded in November last year with recommendations to ERCEA to recover approximately [EUR 190 000] (the share of the [EUR 1.1 million] grant allegedly paid to the international researchers) as well as to the national authorities to initiate judicial proceedings against the persons involved.’

III. The action before the General Court and the judgment under appeal

23 By application lodged at the Registry of the General Court on 16 June 2020, the appellant brought an action under Article 268 TFEU seeking an order that the Commission pay compensation for the non-material damage allegedly caused to her by the press release at issue.

24 In support of her action, the appellant submitted that, by publishing the press release at issue, OLAF had blatantly infringed the provisions of Regulation 2018/1725 relating to the protection of personal data, the principle of the presumption of innocence laid down in Article 48(1) of the Charter of Fundamental Rights of the European Union (‘the Charter’) and in Article 9(1) of Regulation No 883/2013, the obligation to respect the confidentiality of investigations referred to in Article 10(5) of that regulation, the right to good administration referred to in Article 41 of the Charter and the principle of proportionality.

25 By the judgment under appeal, the General Court rejected all the complaints raised by the appellant against OLAF and dismissed, in its entirety, the action brought by the appellant.

IV. Forms of order sought by the parties

26 By her appeal, the appellant claims that the Court should:

– set aside the judgment under appeal,

– give final judgment on the action, and

– order the Commission to pay the costs of the appeal proceedings and of the proceedings before the General Court.

27 The Commission contends that the Court should:

– dismiss the appeal and

– order the appellant to pay the costs.

V. The appeal

28 In support of her appeal, the appellant relies on three grounds of appeal, alleging (i) misinterpretation of the concept of ‘identifiable natural person’ within the meaning of Article 3, point 1, of Regulation 2018/1725; (ii) misinterpretation of Article 9(1) of Regulation No 883/2013 and Article 48(1) of the Charter, read in conjunction with Article 6(2) of the European Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950 (‘the ECHR’), concerning the scope of the presumption of innocence, and (iii) distortion of the evidence relating to the infringement of Article 41 of the Charter on the right to good administration.

A. First ground of appeal

29 By the first ground of appeal, which is divided into four parts, the appellant submits that the General Court infringed EU law by concluding, in paragraphs 91 and 92 of the judgment under appeal, that she had not established that the press release at issue alone had allowed the appellant to be identified, but also means reasonably likely to be used by a reader, with the result that the information contained in that press release fell outside the concept of ‘personal data’ within the meaning of Article 3, point 1, of Regulation 2018/1725 and that that regulation is not applicable.

1. First and second parts of the first ground of appeal

(a) Arguments of the parties

30 By the first and second parts of the first ground of appeal, which it is appropriate to examine together, the appellant complains that the General Court applied incorrect legal criteria in order to interpret the concept of ‘identifiable natural person’ under Article 3, point 1, of Regulation 2018/1725.

31 As regards the first part, she submits that the General Court, in paragraph 49 of the judgment under appeal, erred in law when it held that her identification must result from the press release at issue and could not derive from external or additional factors extraneous to the conduct of which OLAF is accused. According to the Court’s case-law, it is inherent in the concept of ‘indirect identification’ that additional factors are necessary for identification, such factors possibly being available to a person other than the controller (see, to that effect, judgment of 19 October 2016, Breyer, C-582/14, EU:C:2016:779, paragraphs 39 and 41).

32 According to the appellant, the General Court thus wrongly held, in paragraph 76 of the judgment under appeal, that a natural person to whom information relates is ‘identifiable’, within the meaning of Article 3, point 1, of Regulation 2018/1725, only if his or her identity may be established by an ‘average reader’ who is not himself or herself in possession of additional factors which enable that reader to establish the identity of the person to whom the information relates. On the contrary, in the appellant’s view, that provision covers any person other than the controller to whom such factors are available. Accordingly, the appellant argues that the General Court, in paragraphs 81, 82 and 87 of the judgment under appeal, was wrong to refuse to take into account the fact that the German journalist referred to in paragraph 77 of the judgment under appeal had identified her as the person who is the subject of the press release at issue. The General Court should have held that she could be identified by a reader to whom additional factors are available, as was the case with that German journalist, and that, in any event, the identifiers in that press release were capable of leading to her identification by the members of her family and her colleagues who were familiar with her professional background and her involvement as lead researcher for the project.

33 By the second part of the first ground of appeal, the appellant submits that the General Court, in paragraphs 65, 67 and 68 of the judgment under appeal, erred in law when it held that only means which are trivial or insignificant, capable of demonstrating easily and quickly the identity of the person to whom the information relates, are covered by the concept of ‘means reasonably likely to be used’ to identify the person to whom the personal data relate. Recital 16 of Regulation 2018/1725 states only that, in order to ascertain whether means are reasonably likely to be used to identify a person, account should be taken of the costs of and amount of time required for identification, without requiring those costs or that time to be minimal or insignificant.

34 The Commission contends that the first and second parts of the first ground should be rejected.

35 As regards the first part, the Commission argues that Regulation 2018/1725 uses the ‘risk of identification’ as the criterion for defining whether identification is possible and refers to the need to take into account ‘all objective factors’ in order to determine that risk. Thus, the mere hypothetical possibility that a person may be distinguished is not sufficient for that person to be regarded as ‘identifiable’. While recalling that an appeal is limited to points of law, the Commission notes that the General Court examined the appellant’s factual allegations in order to determine whether she could be identified, directly or indirectly, while pointing out that it was for the appellant to adduce evidence that the conditions for non-contractual liability of the European Union, under Article 340 TFEU, were satisfied. The General Court concluded, in paragraph 73 of the judgment under appeal, that the appellant had not demonstrated that she could be identified with certainty by someone reading the press release at issue, by means reasonably likely to be used to that end.

36 In addition, the Commission explains that the General Court concluded, in paragraph 58 of the judgment under appeal, that the appellant had not demonstrated the existence of any specific instance in which she was identified on the sole basis of someone reading the press release at issue. Thus, the appellant cannot validly base her argument on the fact that she could have been identified by members of her family or colleagues. In addition, as is apparent from paragraphs 73 and 78 to 81 of the judgment under appeal, it was established before the General Court that the only person who determined and disclosed to the public the appellant’s identity was the German journalist, but he was already familiar with her background and that of her father and that journalist was in possession of a large amount of information. However, at the appeal stage, it would not be possible to dispute the argument that that journalist had ‘subjective, external knowledge’ of the appellant.

37 As regards the second part of the first ground of appeal, the Commission submits that it is not apparent from paragraphs 65 to 68 of the judgment under appeal that only ‘trivial or insignificant’ means meet the definition of ‘means reasonably likely to be used’. In particular, the appellant’s arguments are based on a misreading of the last sentence of paragraph 65 of the judgment under appeal, taken in isolation, whereas it must be read in conjunction with the remainder of paragraph 65 and with paragraphs 61 to 68 of that judgment, in which the General Court examined the appellant’s arguments. The legal test used by the General Court related precisely to whether the appellant could be identified in the press release at issue by means reasonably likely to be used to that end.

(b) Findings of the Court

38 By the first and second parts of the first ground of appeal, the appellant complains, in essence, that the General Court made several errors of law when it held that the information in the press release at issue fell outside the concept of ‘personal data’ within the meaning of Article 3, point 1, of Regulation 2018/1725 and that, consequently, that regulation was not applicable to her.

(1) Whether the first part of the first ground of appeal is admissible

39 The Commission takes the view that certain arguments put forward in support of the first part of the first ground of appeal are part of the General Court’s assessment of the facts and, as such, are not subject to review by the Court of Justice in the context of the present appeal.

40 In that regard, it should be borne in mind that the classification of an act or a measure for legal purposes by the General Court is a question of law which may be raised in an appeal (judgment of 12 May 2022, Klein v Commission, C-430/20 P, EU:C:2022:377, paragraph 41 and the case-law cited).

41 It is apparent from the wording of the first part of the first ground of appeal and from all the arguments raised in support thereof that the appellant complains that the General Court erred in law by relying on incorrect legal criteria in its interpretation of the term ‘identifiable natural person’ and, on that basis, by making an incorrect classification for legal purposes of the information in the press release at issue as falling outside the concept of ‘personal data’ under Article 3, point 1, of Regulation 2018/1725.

42 The first part of the first ground of appeal is therefore admissible.

(2) Merits of the first and second parts of the first ground of appeal

43 As a preliminary point, it should be noted that the definition of the concept of ‘personal data’ referred to in Article 3, point 1, of Regulation 2018/1725 is essentially identical to that in Article 4, point 1, of the GDPR. In addition, as is apparent from recitals 4 and 5 of Regulation 2018/1725 and from Article 2(3) and Article 98 of the GDPR, the EU legislature intended to establish a regime for the protection of personal data by the Union institutions, bodies, offices and agencies which is equivalent to that of the GDPR in order to ensure uniform and consistent protection of natural persons with regard to the processing of their personal data within the European Union. It is therefore necessary to ensure that Article 3, point 1, of Regulation 2018/1725 and Article 4, point 1, of the GDPR are interpreted in the same way.

44 Article 3, point 1, of Regulation 2018/1725 states that ‘personal data’ means ‘any information relating to an identified or identifiable natural person’.

45 The Court has held that the use of the expression ‘any information’ in the definition of the concept of ‘personal data’ in Article 4, point 1, of the GDPR reflects the aim of the EU legislature to assign a wide scope to that concept, which potentially encompasses all kinds of information, not only objective but also subjective, in the form of opinions and assessments, provided that it ‘relates’ to the data subject. Information relates to an identified or identifiable natural person where, by reason of its content, purpose or effect, it is linked to an identifiable person (judgment of 4 May 2023, Österreichische Datenschutzbehörde and CRIF, C-487/21, EU:C:2023:369, paragraphs 23 and 24).

46 With regard to the ‘identifiable’ nature of a natural person, Article 3, point 1, of Regulation 2018/1725 states that an identifiable natural person is ‘one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person’.

47 The use by the EU legislature of the word ‘indirectly’ suggests that, in order to treat information as personal data, it is not necessary that that information alone allows the data subject to be identified (see, by analogy, judgment of 19 October 2016, Breyer, C-582/14, EU:C:2016:779, paragraph 41).

48 Recital 16 of Regulation 2018/1725 states, in that respect, that in order to determine whether a natural person is identifiable, account should be taken of ‘all the means reasonably likely’ to be used, either by the controller or ‘by another person’, to identify the natural person ‘directly or indirectly’ Thus, for information to be treated as ‘personal data’, it is not required that all the information enabling the identification of the data subject must be in the hands of one person (see, by analogy, judgment of 19 October 2016, Breyer, C-582/14, EU:C:2016:779, paragraph 43).

49 In particular, the fact that additional information is necessary to identify the data subject does not mean that the data at issue cannot be classified as personal data (see, by analogy, judgment of 19 October 2016, Breyer, C-582/14, EU:C:2016:779, paragraph 44).

50 It is also necessary, however, that the possibility of combining the data in question with additional information constitutes a means reasonably likely to be used to identify the data subject. To ascertain whether means are reasonably likely to be used in order to identify a natural person, account should be taken, according to recital 16 of Regulation 2018/1725, of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments.

51 In that regard, the Court has already held that a means is not reasonably likely to be used to identify the data subject where the identification of that person is prohibited by law or impossible in practice, on account of the fact that it requires a disproportionate effort in terms of time, cost and labour, so that the risk of identification appears in reality to be insignificant (see, by analogy, judgment of 19 October 2016, Breyer, C-582/14, EU:C:2016:779, paragraph 46).

52 In the present case, in the context of its examination of whether the press release at issue contains personal data within the meaning of Article 3, point 1, of Regulation 2018/1725, the General Court recalled, in paragraph 49 of the judgment under appeal, that only acts or conduct attributable to a Union institution or body can give rise to liability on the part of the European Union. It inferred therefrom, in that paragraph 49, that the identification of the appellant must result from the press release at issue and could not derive from external factors extraneous to the conduct of which OLAF was accused, with the result that it had examined the information contained in that press release alone, which could be used, in the present case, to allow its readers to identify the appellant.

53 As regards, next, the disclosure of the appellant’s identity by the German journalist who had published an article on social media (Twitter) relating to the accusations made by OLAF in the press release at issue concerning her, the General Court held, in paragraphs 82 and 87 of the judgment under appeal, that that disclosure could not be taken into account, since that journalist was unable to identify the appellant solely on the basis of the identifiers present in the press release at issue and that it had been necessary for him to use identifying factors external and additional to that press release. In reaching that conclusion, the General Court found, inter alia, in paragraphs 76 and 81 of the judgment under appeal, that that journalist was not an average reader but a professional investigative journalist specialised in science who had subjective, external knowledge of the appellant.

54 However, the question whether information contained in a press release emanating from a Union institution or body is covered by the concept of ‘personal data’ within the meaning of Article 3, point 1, of Regulation 2018/1725 cannot be confused with the question relating to the conditions necessary for the European Union to incur non-contractual liability. That first question must be assessed exclusively in the light of the conditions laid down by that provision and therefore, contrary to what the General Court held in paragraph 49 of the judgment under appeal, cannot depend on considerations relating to the imputability of an act to the European Union.

55 In that latter regard, as is apparent from the considerations set out in paragraphs 48 to 51 of the present judgment, it is inherent in the ‘indirect identification’ of a person that additional information must be combined with the data at issue for the purposes of identifying the person concerned. It also follows that the fact that that additional information comes from a person or source other than that of the controller of the data in question in no way rules out the identifiable nature of a person, contrary to what the General Court held in paragraphs 49 and 87 of the judgment under appeal.

56 Furthermore, Regulation 2018/1725 does not lay down any conditions as regards the persons capable of identifying the person to whom an item of information is linked, since recital 16 of that regulation refers not only to the controller but also to ‘another person’.

57 In the particular case of a press release issued by an investigating authority in order to inform the public about the outcome of an investigation, that press release is, by its very nature, intended for journalists in particular, with the result that they cannot be distinguished from an ‘average reader’, to whom paragraph 76 of the judgment under appeal refers.

58 However, the fact that an investigating journalist has, as in the present case, disseminated the identity of a person who is the subject of a press release cannot, alone, lead to the conclusion that the information contained in that press release must necessarily be classified as personal data within the meaning of Article 3, point 1, of Regulation 2018/1725 and exempt from the obligation to examine whether the person in question is identifiable.

59 As regards the question whether the General Court erred in law in the classification for legal purposes of the facts as regards the question whether the appellant is identifiable, the press release at issue contains, as the General Court observed, in essence, in paragraphs 53 to 55 of the judgment under appeal, a certain amount of information relating to the appellant which might allow her to be identified, namely her gender, nationality and profession, the mention that she was a young person and that she was responsible for the funded research project at issue, as well as the reference to the amount of the grant, the awarding body, namely ERCEA, the nature of the entity which hosted the project and the country in which it was located, namely a university in Greece, the reference to the father of the person in question and the fact that he pursued his profession within that entity, and the approximate number of researchers working for that project, under the leadership of the person in question.

60 Contrary to the conclusion reached by the General Court in paragraph 68 of the judgment under appeal, information relating to the gender of a person who is the subject of a press release, that person’s nationality, his or her father’s occupation, the amount of the grant for a scientific project and the geographical location of the entity hosting that scientific project, taken together, contain information that may allow the person who is the subject of that press release to be identified, in particular by those working in the same scientific field and familiar with that person’s professional background.

61 In that context, the Court’s case-law referred to in paragraph 51 of the present judgment does not allow the risk of identification of the data subject to be regarded as insignificant. In that regard, for persons working in the same scientific field, information such as that referred to in the preceding paragraph of the present judgment, taken together, can be used to identify the person concerned without that identification entailing a disproportionate effort in terms of time, cost and labour. Moreover, contrary to the Commission’s contention, the appellant was not required to adduce evidence that she had actually been identified by one of those persons, since no such condition is laid down in Article 3, point 1, of Regulation 2018/1725, which merely requires a person to be ‘identifiable’.

62 Furthermore, as is apparent from paragraph 66 of the judgment under appeal, the description on the ERCEA website of the 70 or so projects funded by that agency, the host institutions of which were located in Greece, contained several key factors enabling internet users to find the information sought, such as the name of the project manager or the name of the host institution or even the amount of funding.

63 A press release concerning allegedly unlawful conduct, such as fraud or corruption, is likely to arouse interest among the public and to induce readers, in particular journalists, to investigate the person who is the subject of the press release. In such a context, the effort involved in carrying out such searches on a website, such as that of ERCEA, by browsing the description of some 70 funded projects listed on that website, combined with other internet searches likely to make it possible to obtain the name and other identifiers of the person who is the subject of the press release at issue, does not appear to be in any way disproportionate, with the result that the risk of identification of the appellant by journalists or other persons unfamiliar with her professional background could not be regarded as insignificant within the meaning of the case-law cited in paragraph 51 of the present judgment.

64 It follows from the foregoing that the General Court, in paragraphs 49 and 87 of the judgment under appeal, erred in law in finding that the identification of the appellant could not derive from external or additional factors extraneous to the conduct of which OLAF was accused. In addition, the General Court erred in law in its classification for legal purposes of the facts before it when it held, in paragraph 68 of that judgment, that the identifiers in the press release at issue did not reasonably allow the appellant to be identified, either on the basis of a simple, objective reading of that press release or by means ‘reasonably likely to be used’ by one of its readers.

65 Consequently, the General Court was also wrong, in paragraphs 91 and 92 of the judgment under appeal, to hold that the information contained in the press release at issue was not covered by the concept of ‘personal data’ referred to in Article 3, point 1, of Regulation 2018/1725 and that that regulation did not apply in the present case.

66 In those circumstances, the first and second parts of the first ground of appeal must be upheld.

2. Third and fourth parts of the first ground of appeal

67 In the light of what has been held in paragraph 65 of the present judgment, there is no need to examine the third and fourth parts of the first ground of appeal, since they also concern the merits of the findings in paragraphs 91 and 92 of the judgment under appeal.

B. The second ground of appeal

1. Arguments of the parties

68 By the second ground of appeal, the appellant disputes the General Court’s finding, in paragraph 106 of the judgment under appeal, that she could not rely on a failure to observe the principle of the presumption of innocence laid down in Article 9(1) of Regulation No 883/2013 and enshrined in Article 48(1) of the Charter, read in conjunction with Article 6(2) of the ECHR, in so far as she was not identified or identifiable in the press release at issue. In her opinion, the General Court erred in law in any event in that it applied the criteria under Article 3, point 1, of Regulation 2018/1725 in the context of the examination of the existence of a possible failure to observe that principle. It is sufficient that a person can be identified by any means, irrespective of the time and costs involved for that purpose.

69 The Commission contends that the second ground of appeal should be rejected, in particular on the ground that a failure to observe the presumption of innocence presupposes that the person who relies on such a failure is an identified or identifiable person, which is not the case here.

2. Findings of the Court

70 In the light of the conclusion in paragraph 65 of the present judgment, the General Court erred in law when it held, in paragraph 106 of the judgment under appeal, that the appellant was not identified or identifiable in the press release at issue and that she had therefore been unable to demonstrate any failure to observe her presumption of innocence.

71 Accordingly, without there being any need to examine the other arguments raised in the second ground of appeal, this ground of appeal must be upheld.

C. Third ground of appeal

1. Arguments of the parties

72 By her third ground of appeal, the appellant submits that, in paragraphs 157 and 169 of the judgment under appeal, the General Court manifestly distorted evidence relating to the infringement of the right to good administration enshrined in Article 41 of the Charter.

73 In the first place, the appellant observes that, contrary to the finding made by the General Court in paragraph 157 of the judgment under appeal, it is apparent from a simple reading of OLAF’s final report that all the researchers – and not just some of them – stated that they were involved in the project. Paragraph 2.3.3.2 of that report expressly states that ‘the ten researchers who replied to OLAF’s questionnaires confirmed having been involved in the MINATRAN project’. Similarly, she argues that it is apparent from that paragraph 2.3.3.2, according to which, ‘however, a number of the researchers confirmed neither the expenses declared by [Aristotle University] on their behalf nor having a Greek bank account’, and from the summary of the researchers’ replies in that report, that the majority of the researchers had in fact been aware that bank accounts had been opened in their names and that payments had been made into them. Thus, in her view, while it is apparent from all of the researchers’ replies that they had all been aware that their names were linked to the project, the press release at issue incorrectly states that none of the researchers had any knowledge thereof. Furthermore, the appellant submits that General Court’s assessment that that press release meant ‘a number of’ researchers while using the word ‘none’ constitutes a distortion of the press release.

74 In the second place, as regards paragraph 169 of the judgment under appeal, the appellant notes that it is apparent from paragraph 2.3.3.1 of OLAF’s final report that the only criticism levelled against her, as an attempt to obstruct the investigation, was the fact that she had sent a single email to a single researcher. Even if the sending of that single message, in which she had merely indicated to that researcher that he was not obliged to reply to the OLAF questionnaire, could be regarded as an attempt to obstruct the investigation, the finding in paragraph 169 of the judgment under appeal that she had ‘on several occasions contacted a number of researchers’ would constitute a manifest distortion of the facts.

75 According to the Commission, the General Court correctly held, in paragraph 157 of the judgment under appeal, that OLAF had not disclosed in the press release at issue any inaccurate information distorting the conclusions of its final report. In any event, only a sufficiently serious breach of the principle of diligence would be capable of giving rise to non-contractual liability on the part of the European Union.

76 Furthermore, the Commission argues that appellant’s arguments against paragraph 169 of the judgment under appeal should also be rejected. Indeed, in order to substantiate the alleged distortion, the appellant relies on certain specific elements of OLAF’s final report, without taking into account the fact that other elements in that report indicated that she had also contacted a researcher to inform him that he did not have to reply to OLAF as well as another researcher so that he would rectify his initial replies. Moreover, according to the Commission, OLAF took the view that the spontaneous withdrawal or modification by certain researchers, during that period, of the replies which they had initially given was an indication that those researchers had received emails with similar content.

2. Findings of the Court

77 In paragraph 157 of the judgment under appeal, the General Court held, inter alia, that it was apparent from the file that, by using the words ‘none of [those researchers] were aware’ in the fifth paragraph of the press release at issue to designate ‘a number of researchers’, OLAF had not disclosed inaccurate information which distorted the conclusions of its final report. In paragraph 169 of that judgment, it held, as regards the reference in the fourth paragraph of that press release to the appellant’s alleged ‘attempts’ to obstruct the investigation, that, as was apparent from OLAF’s final report, during its investigation OLAF had found that the appellant had on several occasions contacted a number of researchers and that it had regarded those acts as constituting an obstacle to its investigation.

78 It must be recalled that, according to settled case-law, a distortion must be obvious from the documents in the Court’s file, without any need for a new assessment of the facts and evidence (judgment of 25 July 2018, Orange Polska v Commission, C-123/16 P, EU:C:2018:590, paragraph 75 and the case-law cited). Distortion exists where, without recourse to new evidence, the assessment of the existing evidence is manifestly incorrect (judgment of 17 June 2010, Lafarge v Commission, C-413/08 P, EU:C:2010:346, paragraph 17 and the case-law cited).

79 Furthermore, although distortion of the evidence may consist of an interpretation of a document contrary to the content of that document, it must be obvious from the file before the Court of Justice, and it presupposes that the General Court has manifestly exceeded the limits of a reasonable assessment of that evidence. In that regard, it is not sufficient to show that a document could be interpreted differently from the interpretation adopted by the General Court (judgment of 16 February 2023, Commission v Italy and Spain, C-635/20 P, EU:C:2023:98, paragraph 127 and the case-law cited).

80 In the light of that case-law, the findings of fact made by the General Court in paragraphs 157 and 169 of the judgment under appeal could be called into question only if it were shown that it is manifestly clear from the documents submitted to the General Court that those findings are incorrect.

81 As regards, in the first place, paragraph 157 of the judgment under appeal, the appellant complains that the General Court distorted both the press release at issue and the findings of OLAF’s final report.

82 In that respect, it should be recalled that OLAF stated, in the third sentence of the fifth paragraph of the press release at issue, that it ‘[had] contacted number of the researchers who were said to be involved in the research project’. The statement, in the following sentence, that ‘none of them were aware that their name was linked to the project or had any knowledge of the bank accounts opened in their names or of any payments made into them’ must therefore be understood as applying to all the researchers whom OLAF had contacted.

83 Accordingly, first, by interpreting, in that paragraph 157, that last sentence of the press release at issue as meaning that OLAF was seeking to establish that a number of researchers it had contacted either were not aware that their names were linked to the project or had no knowledge of the bank accounts opened in their names or of any payments made into them, whereas the press release at issue can only be understood as referring to all the researchers contacted by OLAF, the General Court distorted the content of that press release.

84 Secondly, as regards the alleged distortion of the conclusions of OLAF’s final report, it must be noted that it is apparent from those conclusions, set out in paragraph 2.3.3.2 of that report, that ten researchers who were said to be involved in the project replied to the OLAF questionnaire and ‘confirmed that they were involved in the MINATRAN project’. It is also apparent that ‘however, a number of the researchers confirmed neither the expenses declared by [Aristotle University] in their name nor having a Greek bank account’. In those circumstances, it is clear that, contrary to what is stated in the press release at issue, it is not all the researchers contacted by OLAF who were not aware that their names were linked to the research project and had no knowledge of the bank accounts opened in their names or of any payments made into them. The General Court therefore distorted the conclusions of that final report by holding, in paragraph 157 of the judgment under appeal, that OLAF had not disclosed inaccurate information in the fifth paragraph of the press release at issue.

85 As regards, in the second place, paragraph 169 of the judgment under appeal, it is apparent from the wording of paragraph 2.3.3.1 of the final report from OLAF, to which the appellant refers, that she was accused of sending, in an attempt to obstruct the investigation, an email to a single researcher, whereas the press release at issue refers in the abstract to several obstruction attempts. However, it is not obvious that OLAF intended, in that paragraph of the final report, to cover exhaustively the obstruction attempts of which the appellant is accused.

86 Thus, it is not obvious that the General Court distorted OLAF’s final report when it held, in paragraph 169 of the judgment under appeal, that, as is apparent from that report, during its investigation OLAF had found that the appellant had on several occasions contacted a number of researchers and that it had regarded those acts as constituting an obstacle to its investigation.

87 It follows that the third ground of appeal must be upheld only in so far as the General Court rejected the plea alleging infringement of the right to good administration as regards the fifth paragraph of the press release at issue.

88 Since the first and second grounds of appeal and part of the third ground of appeal have been upheld, the judgment under appeal must be set aside in so far as, by that judgment, the General Court rejected the form of order in the action seeking an order that the Commission pay compensation for the damage resulting from OLAF’s infringement of its obligations under Regulation 2018/1725 of the principle of the presumption of innocence and of the right to good administration.

89 The remainder of the appeal must be dismissed.

VI. The action before the General Court

90 In accordance with the second sentence of the first paragraph of Article 61 of the Statute of the Court of Justice of the European Union, if the decision of the General Court is set aside, the Court of Justice may itself give final judgment in the matter, where the state of the proceedings so permits.

91 That is not the case here.

92 The General Court did not proceed to verify whether OLAF, by publishing the press release at issue, had infringed the presumption of innocence referred to in Article 9(1) of Regulation No 883/2013 and enshrined in Article 48(1) of the Charter, read in conjunction with Article 6(2) of the ECHR, or whether, in the event of such an infringement, the requisite conditions for a finding of non-contractual liability on the part of the European Union under Article 340 TFEU were satisfied.

93 In those circumstances, the state of the proceedings does not permit final judgment to be given in the matter.

VII. Costs

94 As the case is to be referred back to the General Court, it is appropriate to reserve the costs relating to the appeal.

On those grounds, the Court (Sixth Chamber) hereby:

1. Annuls the judgment of the General Court of the European Union of 4 May 2022, OC v Commission (T-384/20, EU:T:2022:273), in so far as, by that judgment, the General Court rejected the form of order of the action seeking an order that the European Commission pay compensation for the damage resulting from the infringement by the European Anti-Fraud Office (OLAF) of its obligations under Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC, of the principle of the presumption of innocence and of the right to good administration;

2. Dismisses the appeal as to the remainder;

3. Refers Case T-384/20 back to the General Court of the European Union;

4. Reserves the costs.

[Signatures]

* Language of the case: Greek.

of 7 Mar 2024, C-479/22 (OC v Commission)