An academic researcher (the data subject) received EU funding for a project

Facts — An academic researcher (the data subject) received EU funding for a project. The European Commission was initially a party to the funding agreement, but was later replaced by the European Research Council Executive Agency (ERCEA). The ERCEA later carried out a financial audit and informed the European Anti-Fraud Office (OLAF) of the results. OLAF alleged that the data subject had fraudulently claimed part of the funding for personal expenses, and published a press release on its website. The data subject brought an action to the General Court, requesting compensation from the Commission for the damage caused by the press release. The General Court dismissed the action, and stated that there was no violation of the data subject’s rights. According to the General Court, whether the data subject is identifiable depends on the ‘means reasonably likely to be used’ to identify the applicant as well as whether the ‘average or likely reader’ of said press release would be able to identify them.

The General Court did not take into account the journalist that identified the data subject, as it did not fall under the definition of "average reader" . The data subject appealed the decision to the CJEU. The CJEU held that the General Court had misinterpreted the EUDPR and GDPR; the CJEU dismissed the General Court’s reasoning of the “average reader”, and stated that the information in the press release (such as the data subject’s gender, nationality, grant amount and father’s occupation) allow the data subject to be identifiable. The CJEU referred the case back to the General Court. The Commission argued that the press release is anonymous, does not disclose any personal data of the data subject and does not contain inaccurate data. Therefore, the press release cannot cause the data subject any harm. Holding — The Court first clarified that there are three cumulative conditions for the EU to incur non-contractual liability: a sufficiently serious breach of law, damage to the data subject, and a causal link between them.

Sufficient breach of law — The Court first held that OLAF had processed the data subject’s data unlawfully, in accordance with Articles 4(1)(a), 5(1)(a), and 6(c) to (e) EUDPR. The Court considered that including information beyond the funding granted was unnecessary. Furthermore, the purpose of including the data in the press release was incompatible with the initial purpose of investigating fraud. Second, the Court held that OLAF violated the principle of the presumption of innocence in accordance with Articles 9(1) and 10 of Regulation 883/2013. This is because OLAF used the term “fraud” in its press release, which implied guilt of the data subject even if national proceedings were ongoing. Finally, the Court held that OLAF violated the right to good administration under Article 41 of the EU Charter of Fundamental Rights (CFREU), and Article 10(5) of Regulation 883/2013. Under Article 10(5) Regulation 883/3013, OLAF has the obligation to provide information to the public in a neutral and impartial manner.

This is also linked to the duty to act diligently. OLAF did not meet these requirements, as it also included inaccurate information in its press release. Furthermore, the use of the term “fraud” was not neutral, as it implied guilt of the data subject. The Court considered the violations above sufficiently serious breaches capable of giving rise to liability. Damage to the data subject and causal link — The Court then assessed the damage to the data subject, and the causal link with the serious breaches of OLAF’s obligations. The Court first referred to CJEU case C‑300/21 (Österreichische Post) to state that the mere infringement of the EUDPR is not sufficient to confer a right to compensation. The Court divided the non-material damage into three groups, and assessed the link to the OLAF violations separately: damage to the data subject’s honour and reputation, damage to the data subject’s professional career, and damage linked to the data subject’s health.

Damage to the data subject’s reputation — The Court first stated that OLAF damaged the data subject's reputation due to the unlawful processing, the use of the term "fraud", and the inaccuracies of the press release. The Court then noted a specific requirement for reputation damages; the right to compensation does not depend on the data subject's standing, however, a person's reputation may only be taken into account if disclosing the information (particularly through the press) has a greater impact compared to an ordinary citizen. The data subject had a distinguished academic career and international reputation. The Court concluded that there was a causal link between the press release and the damage to the data subject's reputation. This was the case even if third parties (journalists) published articles on the matter. Damage to the data subject’s professional career — The Court considered that it was unclear how the OLAF investigations and press release had affected their professional career and opportunities.

Specifically, the absence of a promotion did not have a sufficiently direct causal link to the press release. The Court also considered the risk of dismissal as purely hypothetical. However, according to the Court, there was a clear link between the OLAF investigations and specific career opportunities. For example, the data subject demonstrated through e-mail exchanges that the withdrawal of a formal offer for a job position was linked to the OLAF investigations. Damage to the data subject’s health — The Court took into consideration the medical certificate presented by the data subject, which showed that the data subject suffered from intense psychological distress after the press release was published. The Court considered this sufficient to link the damage to the violations by OLAF, even other factors (such as OLAF's investigations and prosecution by national authorities) may have also contributed to the deterioration of the data subject's health.

The Court ordered the Commission to pay the data subject €50,000 in damages. Holding — The Court first clarified that there are three cumulative conditions for the EU to incur non-contractual liability: a sufficiently serious breach of law, damage to the data subject, and a causal link between them. Sufficient breach of law — The Court first held that OLAF had processed the data subject’s data unlawfully, in accordance with Articles 4(1)(a), 5(1)(a), and 6(c) to (e) EUDPR. The Court considered that including information beyond the funding granted was unnecessary. Furthermore, the purpose of including the data in the press release was incompatible with the initial purpose of investigating fraud. Second, the Court held that OLAF violated the principle of the presumption of innocence in accordance with Articles 9(1) and 10 of Regulation 883/2013. This is because OLAF used the term “fraud” in its press release, which implied guilt of the data subject even if national proceedings were ongoing.

Finally, the Court held that OLAF violated the right to good administration under Article 41 of the EU Charter of Fundamental Rights (CFREU), and Article 10(5) of Regulation 883/2013. Under Article 10(5) Regulation 883/3013, OLAF has the obligation to provide information to the public in a neutral and impartial manner. This is also linked to the duty to act diligently. OLAF did not meet these requirements, as it also included inaccurate information in its press release. Furthermore, the use of the term “fraud” was not neutral, as it implied guilt of the data subject. The Court considered the violations above sufficiently serious breaches capable of giving rise to liability. Damage to the data subject and causal link — The Court then assessed the damage to the data subject, and the causal link with the serious breaches of OLAF’s obligations. The Court first referred to CJEU case C‑300/21 (Österreichische Post) to state that the mere infringement of the EUDPR is not sufficient to confer a right to compensation.

The Court divided the non-material damage into three groups, and assessed the link to the OLAF violations separately: damage to the data subject’s honour and reputation, damage to the data subject’s professional career, and damage linked to the data subject’s health. Damage to the data subject’s reputation — The Court first stated that OLAF damaged the data subject's reputation due to the unlawful processing, the use of the term "fraud", and the inaccuracies of the press release. The Court then noted a specific requirement for reputation damages; the right to compensation does not depend on the data subject's standing, however, a person's reputation may only be taken into account if disclosing the information (particularly through the press) has a greater impact compared to an ordinary citizen. The data subject had a distinguished academic career and international reputation. The Court concluded that there was a causal link between the press release and the damage to the data subject's reputation.

This was the case even if third parties (journalists) published articles on the matter. Damage to the data subject’s professional career — The Court considered that it was unclear how the OLAF investigations and press release had affected their professional career and opportunities. Specifically, the absence of a promotion did not have a sufficiently direct causal link to the press release. The Court also considered the risk of dismissal as purely hypothetical. However, according to the Court, there was a clear link between the OLAF investigations and specific career opportunities. For example, the data subject demonstrated through e-mail exchanges that the withdrawal of a formal offer for a job position was linked to the OLAF investigations. Damage to the data subject’s health — The Court took into consideration the medical certificate presented by the data subject, which showed that the data subject suffered from intense psychological distress after the press release was published.

The Court considered this sufficient to link the damage to the violations by OLAF, even other factors (such as OLAF's investigations and prosecution by national authorities) may have also contributed to the deterioration of the data subject's health. The Court ordered the Commission to pay the data subject €50,000 in damages. Comment — Share your comments here!