JUDGMENT OF THE GENERAL COURT (First Chamber)
8 September 2021 (*)
(Civil service – Members of the contract staff – Disclosure of personal data – Request for assistance – Rejection of the request – Lack of competence of the author of an act adversely affecting a member of staff – Document prepared and signed by an external law firm – Liability – Non-material damage)
In Case T‑52/19,
AH, represented by N. de Montigny, lawyer
applicant,
v
European Foundation for the Improvement of Living and Working Conditions (Eurofound), represented by F. van Boven and M. Jepsen, acting as Agents, assisted by C. Callanan, Solicitor,
defendant,
APPLICATION under Article 270 TFEU for, first, annulment of the decision of 22 March 2018, prepared and signed by an external law firm, concerning a request for assistance from the applicant regarding the disclosure of his personal data and a claim for compensation and, secondly, compensation for the non-material damage allegedly suffered by the applicant as a result of that decision and that disclosure,
THE GENERAL COURT (First Chamber),
composed of H. Kanninen, President, N. Półtorak and M. Stancu (Rapporteur), Judges,
Registrar: L. Ramette, Administrator,
having regard to the written part of the procedure and further to the hearing on 8 December 2020,
gives the following
Judgment
Background to the dispute and events subsequent to the bringing of the action
1 The applicant, AH, is a member of the contract staff of the European Foundation for the Improvement of Living and Working Conditions (Eurofound).
2 On 13 June 2017, the applicant submitted a request under Article 90(1) of the Staff Regulations of Officials of the European Union (‘the Staff Regulations’) for retroactive reclassification of his function group. That request was rejected by Eurofound by decision of 11 July 2017.
3 On 8 September 2017, the applicant lodged a complaint under Article 90(2) of the Staff Regulations against that decision (‘the complaint of 8 September 2017’), which was rejected by the authority authorised to conclude contracts of employment (‘the AECE’) of Eurofound on 8 January 2018. No appeal was brought by the applicant against the latter decision.
Discovery of the ‘hrlink’ file
4 On 12 January 2018, the applicant discovered a file entitled ‘hrlink’ (‘the “hrlink” file’), which was accessible to Eurofound staff on one of its servers. That file contained a number of confidential sub-files concerning Eurofound staff, including a file relating to the complaint of 8 September 2017 (‘the file at issue’). That file contained documents concerning the handling of that complaint, including an email dated 9 September 2017 in which the [confidential] (1) and the [confidential] discussed, inter alia, the possibility of initiating disciplinary proceedings against the applicant in the light of false allegations made by him in the complaint of 8 September 2017.
5 Following that discovery, on 15 January 2018 the applicant sent the hyperlink to the file at issue to several colleagues and asked them to verify whether they were able to access that file. After receiving their confirmation, the applicant reported the incident to the European Data Protection Supervisor (EDPS) by email on the same day. The EDPS opened an investigation into the matter, registered under number [confidential] (‘the first EDPS investigation’).
6 By email dated 30 January 2018, the trade union [confidential] wrote to the Executive Director stating that disclosure of personal data in respect of one of Eurofound’s employees, who was also a member of the Executive Committee of that trade union within Eurofound, had taken place.
The request of 2 February 2018 and the contested decision
7 On 2 February 2018, through his lawyer, the applicant sent an email to the Executive Director and the Head of Human Resources at that time (‘the request of 2 February 2018’) concerning, first, a request for assistance, asking Eurofound to investigate the serious failures by his hierarchy which had been uncovered on reading the file at issue in respect of inter alia the disclosure of his personal data and the comments made by the [confidential] in the email of 9 September 2017 and, secondly, a claim for compensation on the basis of Article 90(1) of the Staff Regulations, seeking the provisional payment of EUR 60 000 by way of compensation for the damage suffered as a result of those failures.
8 On 14 February 2018, an Irish law firm (‘the external law firm’) acknowledged receipt of the request of 2 February 2018 on behalf of Eurofound.
9 By decision of 22 March 2018 (‘the contested decision’), the external law firm informed the applicant that his claim for compensation contained in the request of 2 February 2018 had been rejected on the ground that no intentional disclosure of his personal data had taken place and that, consequently, he was not due any compensation. In that decision, that law firm also stated that, whilst acknowledging that the ‘hrlink’ file had not been secured, Eurofound was going to open an internal investigation into that security breach. To that end, it asked the applicant to answer a number of questions regarding how he himself had gained access to that file.
10 Following the adoption of the contested decision, the applicant’s lawyer sent the external law firm two emails on 5 April and 9 May 2018, to which the latter replied by email on 26 April and 1 June 2018. Those emails sought to clarify the content and scope of that decision, in particular the scope of the investigation referred to in paragraph 9 above.
11 On 21 June 2018, the applicant lodged a complaint under Article 90(2) of the Staff Regulations against the contested decision (‘the complaint of 21 June 2018’), requesting that Eurofound, principally, annul that decision and carry out the investigation which he had requested before rejecting the claim for compensation lodged on account of the disclosure of his personal data and prosecute the persons responsible for that disclosure, in accordance with Article 49 of Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ 2001 L 8, p. 1) and, in the alternative, award him compensation of EUR 30 000 for the non-material damage he has suffered.
12 By decision of 18 October 2018, the external law firm informed the applicant that his complaint had been rejected. That decision was signed by one of the firm’s lawyers as a ‘legal agent of Eurofound’.
The measures adopted by Eurofound following the applicant’s request for assistance and the discovery of the security breach in respect of the ‘hrlink’ file
13 By two emails dated 2 February 2018, Eurofound first informed staff of the existence of unsecured access to the ‘hrlink’ file and of the adoption of corrective measures in that regard and, secondly, reported that security breach to the EDPS. As a result of the second email, the EDPS opened an investigation, registered under number [confidential] (‘the second EDPS investigation’).
14 On 28 March 2018, Eurofound’s Data Protection Officer (‘the DPO’) drafted an initial report on the security breach in respect of the ‘hrlink’ file.
15 By email dated 3 April 2018, the EDPS informed Eurofound that, despite the serious disclosure of personal data as a result of the unsecured access to that file, the corrective measures taken up to that point were satisfactory and that, consequently, his second investigation would be closed.
16 By email dated 13 April 2018, the DPO asked the applicant to complete a questionnaire in connection with the investigation she was conducting, in order to prepare a report for the attention of the EDPS and the Executive Director concerning unauthorised access to the ‘hrlink’ file. The applicant replied on the same day, requesting that the DPO contact his lawyer. His lawyer wrote to the DPO on 20 April 2018 setting out the latter’s position on that investigation.
17 By email of 24 May 2018, the DPO informed the EDPS about the developments in the internal investigation into unauthorised access to the ‘hrlink’ file. Following that email, on 14 December 2018, the EDPS again notified Eurofound of his intention to close the second investigation.
18 By email of 4 July 2018, the EDPS wrote to the Executive Director, in his capacity as Eurofound’s controller of personal data, to inform him of the applicant’s complaint to the EDPS and asked him whether he had any comments to make on the claims made by the applicant in connection with the first investigation. The Executive Director replied to that email on 1 August 2018.
19 By email dated 18 October 2018, the DPO informed the EDPS that Eurofound had requested an IT expert report from an external company concerning the security breach in respect of the ‘hrlink’ file, the final report of which had confirmed that that file had been accessible since at least 2014 and that no intentional changes had been made to the security settings of the file in order to disclose the file at issue.
20 By email of 21 June 2019, the Executive Director wrote to the EDPS, informing him of the latest developments concerning the applicant’s complaint and of the action pending before the General Court in the present case. On 3 July 2019, the EDPS replied to Eurofound, stating that his first investigation would be suspended pending the decision closing the present proceedings. A similar email was sent to the applicant on 31 July 2019.
Procedure and forms of order sought
21 By application lodged at the Registry of the General Court on 28 January 2019, the applicant brought the present action. By separate document of the same date, the applicant applied for anonymity, in accordance with Article 66 of the Rules of Procedure of the General Court, which was granted to him on 11 March 2019.
22 Eurofound lodged its defence on 26 April 2019. By separate document of the same date, Eurofound submitted an application for the omission of certain information contained in the application vis-à-vis the public, in accordance with Article 66 of the Rules of Procedure.
23 The applicant lodged his reply on 10 July 2019, which also contained an application for measures of organisation of procedure. By separate document of the same date, he requested the omission of certain information contained in the reply vis-à-vis the public.
24 On 12 August 2019, the applicant lodged an offer of evidence at the Registry of the General Court. By letter of 20 August 2019, the General Court invited Eurofound to submit its observations on that offer of evidence in the rejoinder.
25 Eurofound lodged its rejoinder on 18 September 2019. By separate document of the same date, it reiterated its request for the omission of certain information vis-à-vis the public in respect of all the documents relating to the present case, including the reply and the rejoinder.
26 On 20 September 2019, the applicant requested, principally, in accordance with Article 68 of the Rules of Procedure, that Case T‑630/19, AH v Eurofound, be joined to the present case and, in the alternative and in the event that the joinder is not granted, to stay the proceedings in Case T‑630/19. Eurofound submitted its observations on those requests on 29 October 2019.
27 On 17 October 2019, in the interest of the proper administration of justice, by reasoned decision and after consulting the judges concerned, the President of the General Court designated, pursuant to Article 27(3) of the Rules of Procedure, a new Judge-Rapporteur, sitting in the First Chamber of the General Court.
28 On 20 November 2019, the Registry of the General Court informed the parties that the written part of the procedure had been closed and that the President of the First Chamber had decided not to join the present case to Case T‑630/19 at that stage of the procedure.
29 On 2 December 2019, the applicant made a reasoned application, under Article 106(2) of the Rules of Procedure, to be heard in the oral part of the procedure.
30 On 13 January 2020, the applicant lodged a further offer of evidence, on which Eurofound submitted its observations on 7 February 2020.
31 By decision of 1 October 2020, the General Court joined the present case to Case T‑630/19, AH v Eurofound, for the purposes of the oral part of the procedure.
32 On the same day, the General Court opened the oral part of the procedure and decided to put questions to the parties for written reply, by way of measures of organisation of procedure provided for in Article 89 of the Rules of Procedure. The parties answered those questions within the period prescribed.
33 On 13 November 2020, the First Chamber of the General Court decided, pursuant to Article 89 of the Rules of Procedure, to put new questions to Eurofound for written reply, to which it replied within the period prescribed.
34 On 25 November 2020, Eurofound lodged an offer of evidence. On 30 November 2020, the General Court invited the applicant to present his observations on that offer of evidence orally at the hearing.
35 On 1 December 2020, Eurofound submitted a request for derogation from the language rules for the oral part of the procedure, in order to be able to express itself in English. On 3 December 2020, the President of the First Chamber of the General Court decided not to grant Eurofound’s request to plead in English at the hearing as, under Article 1(2)(f) and Article 45(1)(c) of the Rules of Procedure, such a request may not be submitted by an EU body or agency.
36 The parties presented oral argument and replied to the General Court’s oral questions at the hearing on 8 December 2020.
37 In his application, the applicant claims, in essence, that the Court should:
– annul the contested decision;
– order Eurofound to pay the sum of EUR 30 000 as compensation for the non-material damage suffered as a result of the disclosure of his personal data and the rejection of the request of 2 February 2018;
– order Eurofound to pay the costs.
38 In its defence, Eurofound contends that the Court should:
– dismiss the action for annulment and for compensation in its entirety as inadmissible and unfounded;
– order the applicant to pay all the costs.
39 In his reply, the applicant claims, in essence, that the Court should:
– grant his request for the production of documents by requesting that Eurofound produce evidence of all authority to act granted to its representatives at all stages of the pre-litigation procedure and the procedure before the General Court;
– annul the contested decision;
– order Eurofound to pay compensation assessed at EUR 200 000, to be increased by default interest from the date of delivery of the judgment at the rate set by the European Central Bank (ECB);
– order Eurofound to pay the costs.
40 In its rejoinder, Eurofound contends that the Court should:
– dismiss as inadmissible or, in any event, as unfounded, all of the requests for the production of documents made in the reply concerning the authority to act granted to its representatives;
– examine and rule solely on the form of order sought in the application, as requested in its defence, and reject the new claims for compensation and the corresponding pleas in law and evidence adduced in support of those pleas, presented for the first time in the reply with regard to both the letter of 1 August 2018 to the EDPS and the documents submitted in Annexes 9, 10 and 13 to the reply;
– order the applicant to pay the costs.
Law
The claim for annulment
41 In support of his claim for annulment, the applicant raises seven pleas in law, alleging, first, the lack of competence of the author of the act adversely affecting him; secondly, breach of the duty to provide assistance and the premature rejection of his claim for compensation; thirdly, the contradictory nature of the administration’s position and breach of the duty to state reasons and of the right to be heard; fourthly, infringement of Article 26 of the Staff Regulations and the applicable provisions regarding the right to protection of personal data; fifthly, conflict of interest and breach of the duty of objectivity, impartiality and independence of public administrations; sixthly, misuse of powers; and seventhly, infringement of Article 17 of the Staff Regulations and breach of the confidentiality of trade union activities.
42 With regard to the contested decision, in so far as it rejects his claim for compensation, by his second plea in law, the applicant submits, inter alia, that the rejection of such a claim was premature. In that regard, according to settled case-law, an institution’s decision rejecting a request for compensation forms an integral part of the administrative procedure prior to the bringing of an action for liability before the General Court and, consequently, the claim for annulment of such a decision cannot be assessed in isolation from the claim for compensation (see, to that effect, judgment of 6 May 2019, Mauritsch v INEA, T‑271/18, not published, EU:T:2019:286, paragraph 26 and the case-law cited). In the present case, since the applicant has submitted claims for compensation seeking, inter alia, compensation for the non-material damage he allegedly suffered on account of the disclosure of his personal data (see paragraph 82 below), there is no need to give a separate ruling on the claim for annulment directed against the rejection of that claim for compensation.
Admissibility of the claim for annulment
43 Without formally raising a plea that the claim for annulment is inadmissible, Eurofound submits that it is inadmissible on the ground that the applicant has no specific, current and vested interest in bringing proceedings since it had not refused to carry out an investigation into the disclosure of his personal data and has always cooperated with the EDPS in that regard. The applicant disputes those arguments and asserts, in essence, that the purpose of Eurofound’s investigation was never to respond to the requests made on 2 February 2018, namely to identify the cause of and the persons responsible for the disclosure of his personal data.
44 According to settled case-law, an action for annulment brought by a natural or legal person is admissible only in so far as the applicant has an interest in the annulment of the contested measure. Such an interest presupposes that the action must be likely, if successful, to procure an advantage for the party who brought it. That advantage may relate to both material and non-material interests and to the future prospects of the person concerned (see order of 20 October 2009, Lebard v Commission, T‑89/06, not published, EU:T:2009:408, paragraph 35 and the case-law cited).
45 In the present case, the applicant contests the rejection of his request for assistance in so far as it sought to carry out, under external supervision, an administrative investigation into the allegedly unlawful disclosure of his personal data to third parties without his prior consent and the identification of the persons responsible for such disclosure. That finding is sufficient to conclude that the present action is capable of procuring an advantage for the applicant in so far as the annulment of the contested decision could lead Eurofound to carry out such an investigation.
46 It follows from the foregoing that the applicant’s claim for annulment must be regarded as admissible.
The merits of the claim for annulment
– The first plea in law, alleging the lack of competence of the author of the act adversely affecting him
47 By his first plea in law, the applicant submits that the contested decision and the decision rejecting the complaint are vitiated by a lack of competence, in so far as they were adopted by the external law firm, which cannot be regarded as an authority within the meaning of the Staff Regulations.
48 Eurofound contends that this plea should be rejected as inadmissible since it was not raised in the pre-litigation procedure and, in any event, as unfounded. First, the contested decision was drafted and signed by the external law firm in its capacity as a representative of Eurofound, acting under its instructions. In that regard, Eurofound states that the powers of the AECE remained within the exclusive competence of the Executive Director throughout the pre-litigation stage and were not entrusted to the external law firm. Secondly, it states that Irish law provides that an external law firm may sign a decision taken by an administrative authority. Thirdly, the choice to be assisted by an external law firm is said to have been imposed by the fact that the applicant had himself requested the assistance of legal counsel. Fourthly, it states that the AECE’s decisions are not subject to any formal requirement since requests from officials or other members of staff themselves do not have to comply with any such conditions.
49 Without there being any need to consider whether the complaint of 21 June 2018 contains, in essence, a complaint which can be linked to the present plea in law, it must be borne in mind that the plea alleging that the author of an act adversely affecting a party lacked competence is a plea concerning a matter of public interest which the General Court, where appropriate, must raise of its own motion (see, to that effect, judgment of 17 November 2017, Teeäär v ECB, T‑555/16, not published, EU:T:2017:817, paragraph 36 and the case-law cited).
50 The merits of that plea in law must therefore be examined.
51 It should be noted that, in the first place, the external law firm was authorised to prepare and sign the contested decision. However, it is not apparent from the file submitted to the General Court, contrary to the applicant’s submissions, that that law firm did not act on Eurofound’s instructions. First, it is common ground that that law firm always stated that it had acted in the name of and on behalf of Eurofound. Second, the contextual information submitted by Eurofound before the General Court concerning its exchanges with the external law firm during the pre-litigation stage attest to the fact that that law firm’s submissions had been agreed with Eurofound.
52 In the second place, as regards the authorisation thus given by Eurofound to the external law firm to prepare and sign the contested decision, it submits, in essence, that that law firm had been granted a delegation of authority to sign and that that delegation was lawful.
53 In that regard, irrespective of the nature of the authorisation given to the external law firm to prepare and sign the contested decision, it must be observed, first of all, that the Court of Justice has held, in respect of the delegation of powers, that an EU institution or body must be entitled to lay down a body of measures of an organisational nature, delegating powers to its own internal decision‑making bodies, in particular as regards the management of its own staff (see, to that effect, judgment of 26 May 2005, Tralli v ECB, C‑301/02 P, EU:C:2005:306, paragraphs 41 to 43).
54 Next, it should be recalled that Article 2 of the Staff Regulations provides that ‘each institution shall determine who within it shall exercise the powers conferred by [the] Staff Regulations on the appointing authority’ and that ‘one or more institutions may entrust to any one of them or to an inter-institutional body the exercise of some or all of the powers conferred on the Appointing Authority other than decisions relating to appointments, promotions or transfers of officials’. Thus, the competent authority must be determined ‘within’ that institution, and therefore those powers, in principle, may be conferred only on one or more persons answerable to that institution. The only exception authorised by the Staff Regulations concerns the situation where one or more institutions decide to entrust to any one of them or to an inter-institutional body the exercise of those powers, which may not, in any case, extend to decisions relating to appointments, promotions or transfers of officials.
55 In addition, the delegation of authority to sign is a measure relating to the internal organisation of the services of the EU administration and is the usual means by which it exercises its powers. It follows that, under a delegation of authority to sign, only servants and officials may in principle be authorised to take, on behalf of the administration and under its responsibility, clearly defined management or administrative measures (see, to that effect, judgment of 6 December 1994, Lisrestal and Others v Commission, T‑450/93, EU:T:1994:290, paragraph 34 and the case-law cited).
56 Finally, the lawfulness of delegation such as that at issue in the present case must be assessed in the light of the purpose of the pre-litigation procedure, provided for under Articles 90 and 91 of the Staff Regulations. That procedure consists of establishing a dialogue between the institution and its official or other member of staff about the problems which may have arisen in the employment relationship and thereby giving them the opportunity to find an amicable solution to the dispute (see judgment of 12 March 2019, TK v Parliament, T‑446/17, not published, EU:T:2019:151, paragraph 44 and the case-law cited). It follows that, in order to maintain the open attitude and dialogue required in that stage, the institution must remain the primary contact for the official or other member of staff throughout that process.
57 In the present case, in the light of the principles referred to above, it must be held that, although Eurofound was able to obtain advice from the external law firm in the context of a pre-litigation procedure falling within the scope of the Staff Regulations, that option cannot, however, extend so far as to enable it to authorise an external private entity, such as that law firm, to prepare and sign the contested decision.
58 In that regard, it must be noted that the only interlocutor with which the applicant had exchanges throughout the entire pre-litigation stage was the external law firm and not Eurofound. Thus, the dominant role played by that firm in the pre-litigation stage prevented a measured dialogue being established between Eurofound and the applicant about the problems which may have arisen in the employment relationship, giving them the opportunity to find an amicable solution to the dispute. Moreover, that fact was confirmed by Eurofound at the hearing when it stated that the choice to be represented by an external law firm had been made in the light of the ‘contentious’ nature of the claim for compensation made on 2 February 2018.
59 In the third place, it should be borne in mind that the administrative procedure is governed by rules and principles inherent in the actions of public authorities. Thus, in particular, the principle of sound administration requires that the allocation of powers and authority to sign within the institutions be clearly defined and published (see, to that effect, judgments of 17 November 2017, Teeäär v ECB, T‑555/16, not published, EU:T:2017:817, paragraph 53, and of 19 December 2019, XG v Commission, T‑504/18, EU:T:2019:883, paragraph 87). Observance of the principle of legal certainty, whereby an act adopted by the public authorities cannot be enforced against individuals before they have had the opportunity to make themselves acquainted with it, requires that, even in the absence of any express written provision to that effect, decisions relating to the exercise of the powers conferred by the Staff Regulations on the appointing authority and by the Conditions of Employment of Other Servants of the European Union on the AECE be given adequate publicity according to the rules and forms which it is for the administration to determine (see judgment of 30 November 2009, Wenig v Commission, F‑80/08, EU:F:2009:160, paragraph 90 and the case-law cited).
60 In the present case, the fact remains that, even if Eurofound was able to authorise the external law firm to prepare and sign the contested decision, there is no evidence in the file to show that that authorisation was clearly defined or, a fortiori, published.
61 In the light of those considerations, it must be held that the contested decision is unlawful in that it was prepared and signed by an external law firm.
62 That conclusion cannot be called into question by the other arguments put forward by Eurofound.
63 First, it is important to recall that, as regards the determination of which authority is competent to reject a request for assistance based on Article 24 of the Staff Regulations and a claim for compensation brought by an official under Article 90(1) of the Staff Regulations, Eurofound is not subject to Irish law. It is clear from a combined reading of the final recital and Article 17 of Regulation (EEC) No 1365/75 of the Council of 26 May 1975 on the creation of a European Foundation for the improvement of living and working conditions (OJ 1975 L 139, p. 1), as amended by Council Regulation (EC) No 1111/2005 of 24 June 2005 (OJ 2005 L 184, p. 1), that (i) Eurofound was set up within the framework of the European Union and functions in accordance with EU law and (ii) its staff recruited after 4 August 2005 are subject to the Staff Regulations. Thus, even if an external law firm may, under the national law to which it is subject, prepare and sign a decision taken by a public administration, such a rule cannot be applied to decisions taken on the basis of the Staff Regulations.
64 Secondly, Eurofound cannot validly claim that, since the applicant was represented by a lawyer, it was obliged also to use the services of an external law firm.
65 It is sufficient to recall, in that regard, that, according to settled case-law, it is not possible to prohibit the seeking of legal advice by those concerned at the pre-litigation stage (see, to that effect, judgment of 5 November 1991, Parliament v Virgili-Schettini, C‑348/90 P, EU:C:1991:413, paragraph 5 and the case-law cited). That principle is explained by the fact that, whereas an institution, which has more extensive resources than an official or other member of staff, may have recourse to a legal service and be assisted or advised by its staff, the official or member of staff, who does not necessarily have legal knowledge, has the right to use the services of an external legal adviser. Moreover, it must be observed, in any event, that, as Eurofound stated in its replies to the measures of organisation of procedure, it was not obliged to be assisted by an external law firm since it had a Service Level Agreement with the European Commission’s Directorate for Human Resources for the handling of administrative complaints.
66 Thirdly, Eurofound is wrong to claim, by relying in particular on the judgment of 5 November 1991, Parliament v Virgili-Schettini (C‑348/90 P, EU:C:1991:413), that the AECE’s decisions are not subject to any particular formal requirement and that, therefore, they may be prepared and signed by an external law firm.
67 That judgment in fact reproduces a pre-existing principle, enshrined in the judgment of 9 March 1978, Herpels v Commission (54/77, EU:C:1978:45), in accordance with which no form is prescribed for a request within the meaning of Article 90 of the Staff Regulations submitted by the official and it must be interpreted and understood by the administration with all the care that a large and well-equipped organisation owes to those having dealings with it, including members of its staff. Contrary to Eurofound’s submissions, the flexibility concerning the formal requirements applies exclusively to requests from officials or members of staff, who may make such a request even without being represented by a lawyer, and not to the formal decision which the institution is called on to take on the basis of that request, the drafting and signature of which may not be delegated to an external private entity, as is clear from paragraph 57 above.
68 It follows from the foregoing that the contested decision is vitiated by a lack of competence which, having regard in particular to the considerations set out in paragraphs 58 and 60 above, has breached the principles of sound administration in the management of staff. It must be annulled on that ground (see, to that effect, judgment of 17 November 2017, Teeäär v ECB, T‑555/16, not published, EU:T:2017:817, paragraph 52 and the case-law cited).
69 However, in order to ensure the proper administration of justice, the second plea in law put forward by the applicant must also be examined.
– The second plea in law, alleging inter alia breach of the duty to provide assistance
70 The applicant submits, in essence, that Eurofound breached the duty to provide assistance in that it prematurely rejected the claim for compensation, without carrying out the investigation he had requested on 2 February 2018. The purpose of that investigation, in the applicant’s view, should have been to shed light on the security breach, that is to say to identify the persons responsible for that breach, those who viewed the file at issue and the reason why they did so, and thus to enable him to justify the damage in respect of which he sought compensation.
71 Eurofound disputes those arguments. In the first place, it contends that the rejection of the claim for compensation was not premature since, at the time the claim was lodged, it had the relevant information in order to make its decision and the applicant should then either have withdrawn his claim for compensation or waited for the outcome of the administrative investigation for harassment and that by the EDPS and then lodged a claim for compensation if the outcome of either of those investigations had warranted doing so. In the second place, it submits that it was under no obligation to carry out an investigation to enable the applicant to assess the compensation to which he is entitled, or to provide him with the evidence necessary to support such a claim.
72 First of all, it must be observed that it is clear from the purely illustrative list of conduct set out in Article 24 of the Staff Regulations, which refers inter alia to threats, insulting or defamatory acts or utterances, or any attack to the person or property of the official by reason of his or her position or duties, that the sole purpose of the obligation to provide assistance is to protect EU officials and staff members against unjustified attacks, which are incompatible with the good order and tranquillity of the service, by third parties or EU officials or staff members. The case-law of the General Court states in that regard that the obligation to provide assistance applies solely against acts which are suspected to be unlawful and which may reasonably be regarded as harmful to the rights of officials (see judgment of 9 September 2016, De Esteban Alonso v Commission, T‑557/15 P, not published, EU:T:2016:456, paragraph 41 and the case-law cited).
73 Under the duty to provide assistance, arising from the first paragraph of Article 24 of the Staff Regulations, the administration must, when faced with an incident which is incompatible with the good order and tranquillity of the service, intervene with all the necessary vigour and respond with the rapidity and solicitude required by the circumstances of the case with a view to ascertaining the facts and, consequently, taking the appropriate action in full knowledge of the facts. To that end, it is sufficient that the official who is seeking the protection of his or her institution provide at least some evidence of the reality of attacks of which he or she claims to have been the victim. When such evidence is provided, the institution concerned is under an obligation to take the necessary measures, in particular to undertake an inquiry, with the cooperation of the complainant, to determine the facts which gave rise to the complaint (see judgment of 9 September 2016, De Esteban Alonso v Commission, T‑557/15 P, not published, EU:T:2016:456, paragraph 40 and the case-law cited).
74 It is in the light of that case-law that it must be examined whether Eurofound has fulfilled its obligation to provide assistance following the request made by the applicant to report a disclosure of his personal data, which may be regarded as an act which adversely affects the rights of officials.
75 It must be observed at the outset that, following the applicant’s request for assistance, Eurofound adopted a number of measures concerning the security breach. First, it corrected that breach and informed staff members of the incident; secondly, it immediately reported the breach to the EDPS with whom it remained in constant contact in the second EDPS investigation; thirdly, it requested assistance from the other agencies, in particular the European Union Agency for Criminal Justice Cooperation (Eurojust) and the European Agency for Law Enforcement Cooperation (Europol), in order to analyse the technical aspects of the security breach; fourthly, it commissioned an IT expert report from an external company; fifthly, it carried out a comprehensive review of its IT policies and procedures in force, including from the point of view of the protection of personal data.
76 Nevertheless, the Court notes that, despite the efforts made in adopting those measures, which sought to curb the effects of the ‘hrlink’ file security breach, an administrative investigation in the strict sense was not carried out in order to ascertain whether the applicant himself had actually suffered a disclosure of his personal data following that breach, in particular in the light of the obligations arising from Regulation No 45/2001 (now Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation No 45/2001 and Decision No 1247/2002/EC (OJ 2018 L 295, p. 39)).
77 Eurofound has always maintained, both during the pre-litigation stage and in the proceedings before the General Court, that the applicant has never proved to the requisite legal standard either that the disclosure of his personal data had been intentional or that he had suffered damage as a result of that disclosure. Moreover, since the error that led to the security breach was of a technical nature and the EDPS indicated that he was satisfied with the measures taken by Eurofound, no other action on its part was required.
78 It is sufficient to note, in that regard, that Eurofound is wrong to assert that, in order to justify the damage suffered, such disclosure must be intentional. It is important to bear in mind that, according to the case-law, the disclosure, even if unintentional, of personal information in breach of the provisions of Regulation No 45/2001 (now Regulation 2018/1725) constitutes a fault of such a kind as to render the institution concerned liable (see, to that effect, judgment of 15 January 2019, HJ v EMA, T‑881/16, not published, EU:T:2019:5, paragraphs 54 and 57).
79 Furthermore, Eurofound cannot validly rely on the fact that the EDPS was satisfied with the measures taken as he closed only the second investigation, which was initiated following Eurofound’s reporting of the breach, and not the first one, initiated following the applicant’s complaint, which has been suspended pending the decision closing the present proceedings.
80 In the light of the foregoing, it must be held that Eurofound has also failed in its duty to provide assistance.
81 In those circumstances, the second plea in law must be upheld and the contested decision must be annulled, without there being any need to examine the other pleas in law raised by the applicant and his offers of evidence and the application for measures of organisation of procedure made by the applicant in the reply concerning inter alia the production of the proof of authority to act (mandat ad litem) of the representatives of Eurofound. Moreover, as regards the offer of evidence submitted by Eurofound on 25 November 2020 concerning a complaint within the meaning of Article 90(2) of the Staff Regulations, submitted on 13 November 2020 in the context of his staff report, it is sufficient to note that that offer does not concern any of the pleas which the Court has considered it appropriate to examine in the context of the annulment of the contested decision, and therefore there is no need to examine it. The same applies to Annexes 9, 10 and 13 to the reply, which Eurofound contends to be inadmissible in the rejoinder.
The claim for compensation
82 In the application, the applicant seeks compensation for alleged non-material damage as a result of, first, the disclosure of his personal data and, secondly, the contested decision. In the reply, he submits that the discovery, on reading the defence, that the entire content of his request for assistance on account of harassment had been disclosed to the EDPS and the accusatory and derogatory tone used by Eurofound in those pleadings exacerbated the non-material damage suffered, which must be increased to EUR 200 000.
83 Eurofound contends that the claims for compensation, as set out in both the application and the reply, are inadmissible and, in any event, unfounded.
Admissibility of the claim for compensation set out in the application
84 Eurofound submits that, first, the subject matter of the application does not correspond to that of the complaint of 21 June 2018, which constitutes a breach of the rule of correspondence and, secondly, the applicant has failed to comply with the rule that available administrative remedies must be exhausted before legal proceedings. Eurofound submits inter alia that, in the first place, in the complaint, the applicant did not request the annulment of the contested decision in so far as it rejected his claim for compensation and, in the second place, his claim for damages was not part of the principal form of order sought in that complaint, but was formulated in a vague and subsidiary manner. Moreover, it was only at the time of the application that the applicant specified, for the first time, that the claim for compensation submitted on 2 February 2018 concerned non-material damage resulting from both the disclosure of his personal data and from the alleged acts of harassment against him and that the sum of EUR 60 000 was thus divided into two lots of EUR 30 000 for each of those heads of damage. Furthermore, since the claim for compensation is closely connected with the action for annulment, it should be dismissed as inadmissible on the ground that the action for annulment should also be regarded as inadmissible or, in any event, unfounded.
85 The applicant disputes those arguments.
86 First of all, it should be noted that the forms of order sought in the complaint of 21 June 2018 are formulated in almost identical terms to those submitted by the applicant in his application (see paragraph 11 above), which Eurofound also acknowledges in paragraph 1.2 of the defence.
87 Next, even though, in the complaint of 21 June 2018, the applicant does not explain why he altered the quantum of the damage in relation to the request of 2 February 2018, that fact cannot affect the admissibility of the claim for compensation. According to the case-law, there must be correspondence between complaints only in respect of the administrative complaint and the application, in order inter alia to prevent the official or other staff member from making some, or all, of his or her claims only at the litigation stage of the proceedings, thereby significantly reducing any possibility of an extra-judicial settlement of the dispute (see, to that effect, judgment of 19 December 2019, Wehrheim v ECB, T‑100/18, not published, EU:T:2019:882, paragraph 39 and the case-law cited).
88 Finally, it must be borne in mind that that rule of correspondence should not have the effect of binding, strictly and absolutely, the judicial stage of the proceedings, provided that the claims submitted to the EU Courts change neither the cause nor the subject matter of the complaint (see, to that effect, judgment of 19 December 2019, Wehrheim v ECB, T‑100/18, not published, EU:T:2019:882, paragraph 40 and the case-law cited). It must be noted, in the latter regard, that the request of 2 February 2018, the complaint of 21 June 2018 and the application are based on the same matters, namely compensation for non-material damage.
89 Consequently, since the applicant is submitting before the General Court heads of claim which are based on the same matters as those raised in the complaint, the claim for compensation is admissible.
90 That conclusion cannot be called into question by the argument that the action for compensation must be dismissed since it is closely connected with the action for annulment, which must itself be dismissed. It is important to recall, in that regard, that it follows from the examination of the first and second pleas in law that the action is well founded.
91 In the light of the foregoing, the plea of inadmissibility raised by Eurofound must be rejected.
Admissibility of the claim for compensation set out in the reply
92 Eurofound submits that the claim for compensation set out in the reply must be declared inadmissible on the ground that, first, it is based on new heads of damage introduced for the first time at the reply stage and, secondly, the applicant did not exhaust the administrative remedies before initiating the litigation procedure in respect of those heads of damage.
93 The applicant disputes those arguments.
94 In accordance with Article 76(e) of the Rules of Procedure, the applicant is required to state the form of order sought in the application. Thus, in principle, only the form of order set out in the application may be taken into consideration and the merits of the action must be examined solely in the light of the form of order sought in the application. Article 84(1) of the Rules of Procedure allows new pleas in law to be introduced on condition that they are based on matters of law or of fact which come to light in the course of the procedure. It is clear from the case-law that that condition governs a fortiori any amendment to the forms of order sought and, in the absence of matters of law or of fact which came to light in the course of the written procedure, only the order sought in the application may be taken into consideration (see order of 27 March 2017, Frank v Commission, T‑603/15, not published, EU:T:2017:228, paragraph 41 and the case-law cited). Moreover, a submission which changes the very basis on which the European Union could be held liable must be regarded as constituting a new plea in law which cannot be introduced in the course of proceedings (see judgment of 11 June 2019, TO v EEA, T‑462/17, not published, EU:T:2019:397, paragraph 236 and the case-law cited).
95 In the present case, it must be observed that the new claim for compensation contained in the reply is based on new heads of damage, which changes the very basis of the European Union’s liability, in particular the facts giving rise to the non-material damage relied on by the applicant in the application. The applicant submits that it is the disclosure of the entire content of his file to the EDPS by the letter of 1 August 2018 and the accusatory and derogatory tone used by Eurofound in the defence which justify the increase in the amount claimed in respect of the non-material damage he alleges to have suffered.
96 Therefore, since those new heads of damage are the consequence of errors alleged to have been committed by the administration, they must be the subject of a new pre-litigation procedure. In that regard, it must be recalled that, in such a case, it is imperative that that procedure should be initiated by a request under Article 90(1) of the Staff Regulations calling on the AECE to make good the damage allegedly suffered and continue, where appropriate, with a complaint against the decision rejecting the request (see, to that effect, order of 25 March 2020, Lucaccioni v Commission, T‑507/19, not published, EU:T:2020:118, paragraphs 54 and 55).
97 Consequently, since the applicant did not follow, or even initiate, the appropriate pre-litigation procedure in order to challenge those errors, the claim for compensation set out in the reply is inadmissible, and therefore the only admissible claim for compensation is that set out in the application.
The merits of the claim for compensation for the non-material damage allegedly suffered
98 First, as regards the head of non-material damage resulting from the contested decision, it must be noted that, according to settled case-law, the annulment of an unlawful measure constitutes, in itself, adequate and, in principle, sufficient compensation for all non-material damage which that measure may have caused. That cannot, however, be the case where the applicant shows that he or she has suffered non-material damage which is separable from the unlawfulness which is the basis for the annulment and which is incapable of being entirely repaired by that annulment (see judgment of 30 January 2020, BZ v Commission, T‑336/19, not published, EU:T:2020:21, paragraph 54 and the case-law cited).
99 In the present case, it must be observed that the applicant has not shown how that head of damage cannot be entirely remedied by the annulment of the contested decision, which is said to be the cause of that damage.
100 In those circumstances, the Court takes the view that that damage is adequately and sufficiently compensated by the annulment of the contested decision, and therefore the heads of claim seeking compensation for that damage must be dismissed.
101 Secondly, as regards the head of non-material damage resulting from the disclosure of the applicant’s personal data, it must be recalled that it will be for Eurofound, in accordance with Article 266 TFEU, to take the necessary measures to comply with the judgment. Moreover, the first EDPS investigation, which was launched following a complaint by the applicant, has been suspended pending the decision closing the present proceedings.
102 Thus, since the Court is unable to prejudge either the conclusions of that investigation or the measures taken to comply with the judgment, in the light of which the applicant may decide to submit a new claim for compensation, the heads of claim seeking compensation for the non-material damage arising from that disclosure must be dismissed as premature.
103 In the light of all the foregoing, the contested decision must be annulled in so far as it rejects the applicant’s request for assistance and the action must be dismissed as to the remainder.
Costs
104 Under Article 134(3) of the Rules of Procedure, the parties are to bear their own costs, where each party succeeds on some and fails on other heads. However, if it appears justified in the circumstances of the case, the General Court may order that one party, in addition to bearing his own costs, pay a proportion of the costs of the other party.
105 In the present case, since the action has in all essential respects been upheld, a fair assessment of the circumstances of the case dictates that Eurofound be ordered to bear its own costs and to pay those incurred by the applicant.
On those grounds,
THE GENERAL COURT (First Chamber)
hereby:
1. Annuls the decision of 22 March 2018, prepared and signed by an external law firm, concerning a request for assistance made by AH as regards the disclosure of his personal data;
2. Dismisses the action as to the remainder;
3. Orders the European Foundation for the Improvement of Living and Working Conditions (Eurofound) to pay, in addition to its own costs, those incurred by AH.
Delivered in open court in Luxembourg on 8 September 2021.
[Signatures]