JUDGMENT OF THE GENERAL COURT (Fourth Chamber)

20 July 2016 (*)

(Non-contractual liability — Damage caused by the Commission in the context of an OLAF investigation and by OLAF — Actions for damages — Action for a declaration that certain measures taken by OLAF were void and inadmissible for evidentiary purposes before the national authorities — Admissibility — Misuse of powers — Processing of personal data — Rights of the defence)

In Case T‑483/13,

Athanassios Oikonomopoulos, residing in Athens (Greece), represented initially by N. Korogiannakis and I. Zarzoura, lawyers, and subsequently by G. Georgios, lawyer,

applicant,

v

European Commission, represented by J. Baquero Cruz and A. Sauka, acting as Agents,

defendant,

APPLICATION, first, for compensation for the damage caused by the Commission and by the European Anti-Fraud Office (OLAF) and, secondly, that certain measures taken by OLAF be declared legally void and inadmissible for evidentiary purposes before the national authorities,

THE GENERAL COURT (Fourth Chamber),

composed of M. Prek (Rapporteur), President, I. Labucka and V. Kreuschitz, Judges,

Registrar: C. Heeren, Administrator,

having regard to the written part of the procedure and further to the hearing on 10 June 2015,

gives the following

Judgment (1)

 Facts

1        The applicant, Athanassios Oikonomopoulos, is an electrical engineer and businessman active in the field of the robotics and informatics market. He founded, and then managed from 1987 to 2006, Zenon Automation Technologies SA (‘Zenon’), a company established in Greece.

2        Between 2004 and 2006, Zenon concluded several contracts with the Directorate-General (DG) ‘Information Society and Media’ (‘DG Information Society’) of the European Commission, under the Sixth Framework Programme for Research, Technological Development and Demonstration, contributing to the creation of the European Research Area and to innovation (2002-2006) (‘the Sixth Framework Programme’).

3        In November 2008, at the Commission’s request, an audit was carried out by an external auditor at Zenon’s premises in relation to the Alladin and Gnosys projects which formed part of the Sixth Framework Programme. That audit gave rise, inter alia, to the report for audit 08-BA59-028 of 13 May 2009 (‘the initial audit report’).

4        It is apparent from the initial audit report that there were anomalies in respect of personnel costs. Zenon had applied to the Commission for funding, in a significant amount, of expenses which had in reality been invoiced to it by the Cypriot company Comeng Computerised Engineering (‘Comeng’). Those costs were wrongly claimed under the category of direct personnel costs as costs for ‘in-house consultants’, whereas they should have been claimed as subcontracting costs. That practice had been systematic. The Commission concluded from this that those costs could not be considered admissible either as personnel costs or as subcontracting costs.

5        In those circumstances, an investigation was opened by the European Anti-Fraud Office (OLAF) on 10 December 2009 in respect of project GR/RESEARCH-INFSO-FP6-Robotics and informatics for the implementation of the Sixth Framework Programme. OLAF has the mission, under Regulation (EC) No 1073/1999 of the European Parliament and of the Council of 25 May 1999 concerning investigations conducted by OLAF (OJ 1999 L 136, p. 1), of conducting external investigations, that is to say, investigations outside the EU institutions, and internal investigations, that is to say, those within those institutions.

6        On 25 and 26 February 2010, OLAF carried out a check at Comeng’s premises.

7        On 6 August 2010, DG Information Society prepared a draft final audit report.

8        On 18 February 2011, the Commission adopted the final audit report.

9        In July 2011, OLAF informed the applicant that he was considered to be a person concerned by the investigation mentioned in paragraph 5 above. On 7 September 2011, representatives of OLAF questioned the applicant at his home address, at the time in Patmos (Greece).

10      By letter of 19 September 2012, OLAF informed the applicant that the investigation was closed. In that letter it stated that the findings of the investigation indicated that there were grounds for believing that criminal offences affecting the financial interests of the European Union had been committed. It also stated in the letter that it had recommended to the Greek judicial authorities to initiate judicial proceedings in the matter. OLAF further asked the DG for Communications Networks, Content & Technology, which replaced the DG Information Society, to undertake appropriate measures to ensure the recovery of the sum of EUR 1.5 million from Zenon.

 Procedure and forms of order sought

…

19      The applicant claims that the Court should:

–        declare that the actions and measures decided upon by OLAF are legally non-existent;

–        declare that the information and data relating to it and any relevant evidence forwarded to the national authorities constitute inadmissible evidence;

–        order the Commission to pay him the amount of EUR 2 million in recognition of its unlawful conduct and of the loss caused to the applicant’s professional activities and reputation;

–        order measures of inquiry and measures of organisation of procedure, in accordance with Articles 64 and 65 of the Rules of Procedure of 2 May 1991, in the form of the production of documents and oral testimony;

–        order the Commission to pay the costs.

20      The Commission contends that the Court should:

–        dismiss the application as in part inadmissible and in part unfounded, or in any event as unfounded in its entirety;

–        order the applicant to pay the costs, including those relating to the application for interim measures.

 Law

 1. Admissibility of certain of the forms of order sought

…

25      In the first place, it is appropriate to consider the admissibility of the application for a declaration that the measures taken by OLAF are legally void. In that context, it is appropriate to recall the powers of the EU judicature when hearing an action for damages.

26      According to settled case-law, the European Union’s non-contractual liability under the second paragraph of Article 340 TFEU is subject to the satisfaction of a number of conditions, namely, the unlawfulness of the conduct alleged against the EU institution, the fact of damage and the existence of a causal link between the conduct of the institution and the damage complained of (judgment of 9 November 2006 in Agraz and Others v Commission, C‑243/05 P, EU:C:2006:708, paragraph 26 and the case-law cited). With regard to the condition relating to the conduct complained of, it is required that there be established a sufficiently serious breach of a rule of law intended to confer rights on individuals (judgments of 4 July 2000 in Bergaderm and Goupil v Commission, C‑352/98 P, EU:C:2000:361, paragraphs 42 and 43, and 9 September 2008 in FIAMM and Others v Council and Commission, C‑120/06 P and C‑121/06 P, EU:C:2008:476, paragraph 173). Furthermore, it should be recalled that, according to settled case-law, the action for damages is an autonomous form of action, with a particular purpose to fulfil within the system of actions and subject to conditions on its use dictated by its specific purpose (judgment of 28 April 1971 in Lütticke v Commission, 4/69, EU:C:1971:40, paragraph 6, and order of 15 October 2013 in Andechser Molkerei Scheitz v Commission, T‑13/12, not published, EU:T:2013:567, paragraph 46).

27      It must be held that the application for a declaration that the measures taken by OLAF are legally void amounts, in reality, to asking the Court to invalidate the measures taken by OLAF and to hold they have no legal effect (see, to that effect, judgment of 9 September 2011 in dm-drogerie markt v OHIM — Distribuciones Mylar (dm), T‑36/09, EU:T:2011:449, paragraph 83). This goes beyond the mere finding of unlawfulness that the Court may be called upon to make in connection with an action for damages.

28      It follows that the applicant’s first head of claim must be declared inadmissible.

29      That declaration of inadmissibility does not constitute breach of the right to effective judicial protection or of the principles of sound administration of justice and procedural economy. Judicial review of compliance with the European Union legal order is ensured, as can be seen from Article 19(1) TEU, by the Court of Justice and the courts and tribunals of the Member States. To that end, the FEU Treaty has established, by Articles 263 and 277 TFEU, on the one hand, and Article 267 TFEU, on the other, a complete system of legal remedies and procedures designed to ensure judicial review of the legality of European Union acts, and has entrusted such review to the European Union judicature (judgment of 19 December 2013 in Telefónica v Commission, C‑274/12 P, EU:C:2013:852, paragraph 57). The decisions taken by the national authorities on the basis of the information provided by OLAF must be actionable before the national courts, which, in turn, may refer a question for a preliminary ruling on the interpretation of the provisions of EU law which they deem necessary in order to deliver their judgments (see, to that effect, order of 19 April 2005 in Tillack v Commission, C‑521/04 P(R), EU:C:2005:240, paragraphs 38 and 39).

30      It should be noted that the applicant has not produced any other element in order to demonstrate that the abovementioned law and principles have been infringed.

31      It follows that the mere fact that a head of claim is declared inadmissible is not sufficient to demonstrate a breach of the right to effective judicial protection or of the principles of sound administration of justice and procedural economy.

32      In the second place, the head of claim seeking a declaration by the Court that the applicant’s information and data and any relevant evidence sent to the national authorities constitute inadmissible evidence must also be rejected.

33      That head of claim cannot be construed as anything other than an application for a declaration by the Court that the evidence is legally inadmissible before national courts. It is settled case-law that the action taken by the national authorities in response to the information forwarded to them by OLAF is within their sole and entire responsibility and that it is for those authorities to ascertain whether such information justifies or requires the bringing of criminal proceedings. Consequently, judicial protection against such proceedings must be ensured at national level with all the guarantees provided by domestic law, including those which follow from fundamental rights, and the possibility for the court hearing the action of seeking a preliminary ruling from the Court of Justice under Article 267 TFEU (see order of 19 April 2005 in Tillack v Commission, C‑521/04 P(R), EU:C:2005:240, paragraphs 38 and 39 and the case-law cited). It has further been stated that the national authorities, in the event they decide to open an investigation, would assess the conclusions to be drawn from any possibly unlawful conduct on the part of OLAF and that that assessment could be challenged before the national courts. In the event that criminal proceedings are not brought or are brought to a close by an acquittal, the bringing of an action for damages, before the EU judicature, is sufficient to ensure the protection of the interests of the person concerned by allowing that person to obtain compensation for any loss flowing from OLAF’s unlawful conduct (see, to that effect, judgment of 20 May 2010 in Commission v Violetti and Others, T‑261/09 P, EU:T:2010:215, paragraph 59).

34      It must be held that, in accordance with the case-law referred to in paragraph 33 above, a decision by the Court declaring the evidence submitted to the Greek judicial authorities to be inadmissible is, evidently, outside the scope of the Court’s jurisdiction. The Court therefore has no jurisdiction to decide that the applicant’s information and data and any relevant evidence sent to the national authorities constitute inadmissible evidence before the national courts.

35      Accordingly, the second head of claim must be dismissed without any need to examine the substance.

 2. Substance

36      As a preliminary point, it is appropriate to examine the argument raised by the Commission that the action for damages is premature. It submits that the transmission of the OLAF report has not, so far, led to any action by the competent national authorities. In addition, there is no loss since there have been no leaks or public disclosure of the information.

37      It is common ground that national judicial proceedings are still pending. However, the outcome of those proceedings cannot affect the present proceedings. In the present case, the issue is not to ascertain whether the applicant is responsible for an irregularity or a fraud, but to examine the manner in which OLAF conducted and completed an investigation which refers to the applicant by name and possibly attributes liability to him for the irregularities, and the way in which the Commission conducted itself in the context of that investigation. If the applicant is found not guilty by the national judicial authorities, that finding may not necessarily make good the loss that he would then have suffered (see, to that effect, judgment of 8 July 2008 in Franchet and Byk v Commission, T‑48/05, EU:T:2008:257, paragraphs 90 and 91).

38      Accordingly, since the loss complained of in the present action is distinct from the loss that might be established by a finding of not guilty by the national judicial authority, the claims for compensation cannot be rejected as premature with the consequence that the applicant may submit such a claim only after any definitive decisions had been taken by the national judicial authorities.

39      Consequently, as the action is not premature, there is no need to reserve examination of the questions relating to the nature and extent of the loss for a possible later stage.

40      As part of its third head of claim, the applicant submits that the Union must incur non-contractual liability.

…

 Unlawful conduct

…

 The second plea, alleging infringement of Regulation No 45/2001, Regulation No 1073/1999, of the obligation to maintain confidentiality and professional secrecy, of the right to private life and of the principle of sound administration

…

51      As a preliminary point, it should be noted that the provisions of Regulation No 45/2001 are rules of law intended to confer rights on the data subjects whose personal data are held by the institutions and bodies of the European Union. The very purpose of those rules is to protect such persons from possibly unlawful processing of their personal data (judgment of 12 September 2007 in Nikolaou v Commission, T‑259/03, not published, EU:T:2007:254, paragraphs 210 and 232).

 – The first, second and third heads of claim, alleging infringement of Articles 4, 5, 7, 8 and 12 of Regulation No 45/2001, of the obligation to maintain confidentiality, professional secrecy, the right to private life and of the principle of sound administration and, in particular, of Article 8(1) of Regulation No 1073/99 and of Article 8(1) of Regulation No 2185/96

52      As a preliminary point, first of all, it is appropriate to note that Article 2(a) of Regulation No 45/2001 provides that ‘personal data’ refers to ‘any information relating to an identified or identifiable natural person’ and that ‘an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity’. Article 2(b) of that regulation defines the ‘processing of personal data’ as ‘any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction’.

53      According to the case-law, the communication of such data falls within the definition of ‘processing’ within the meaning of Article 2(b) of Regulation No 45/2001 (judgments of 29 June 2010 in Commission v Bavarian Lager, C‑28/08 P, EU:C:2010:378, paragraphs 68 and 69, and 7 July 2011 in Valero Jordana v Commission, T‑161/04, not published, EU:T:2011:337, paragraph 91). In the present case, it must be held that the information concerning the applicant is ‘personal data’ and that ‘processing’ of the latter had taken place within the meaning of the above provision, both by the Commission and OLAF, which, moreover, the parties do not dispute.

…

59      In the first place, it is appropriate to examine the complaint that none of the conditions mentioned in Article 5 of Regulation No 45/2001 was met.

60      As regards the transmission by OLAF of information to the Commission and the Greek authorities, it should be recalled that, in principle, OLAF carries out tasks in the public interest, within the meaning of Article 5(a) of Regulation No 45/2001. In the present case, the processing of the applicant’s personal data was part of OLAF’s investigation into the existence of a possible fraud which would have been detrimental to the financial interests of the Union. Such processing of data by OLAF was therefore necessary for the performance of its task. It must therefore be held that the transmission by OLAF of information to the Commission and the Greek authorities was carried out in the public interest. OLAF therefore did not overstep the limits of its discretion under Article 5(a) of Regulation No 45/2001.

61      As for the transmission by the Commission of information to Zenon, it must be held that, in principle, that transmission is consistent with Article 5 of Regulation No 45/2001.

62      The Commission was entitled to send Zenon a final audit report whose conclusions were based on extracts of OLAF’s report which included information contained in OLAF’s mission report, in OLAF’s report concerning the on-the-spot checks conducted on Comeng’s premises on 25 and 26 February 2010, in the written record of the hearing of Comeng’s director and in the documents scanned during the on-the-spot checks by OLAF inspectors, with the authorisation of Comeng’s director and sent by OLAF to DG information Society on 4 May 2010.

63      That information enabled the Commission to confirm that Zenon had not complied with the provisions set out in the FP6 contracts for the implementation of the Sixth Framework Programme and to reject all the costs claimed by Zenon in that context.

64      Without mentioning OLAF’s findings in the Commission’s final audit report, the Commission could not have explained the reason why it made an adjustment in respect of Zenon. In those circumstances, DG Information Society may not therefore, in principle, be criticised for sending a final audit report to Zenon containing information which it was necessary for it to know in order to understand the reasons for which financial adjustments were required. Nor, accordingly, can it be argued that the transmission to Zenon of such a report containing information relating to an investigation conducted by OLAF was not, in principle, consistent with Article 5 of Regulation No 45/2001.

65      It should be noted that among the information collected by OLAF and included in DG Information Society’s final audit report, the information mentioning the applicant’s name in the context of banking transactions carried out between 2002 and 2006 in Comeng’s name at the applicant’s request was necessary in order to demonstrate that those banking transactions were not connected with the performance of FP6 contracts concluded for the implementation of the Sixth Framework Programme. The audit report also mentions the applicant’s name in the context of financial transactions conducted in the same period in favour of other companies owned or controlled by him and states that he did not demonstrate that those transactions occurred in the context of the performance, by Zenon, of contracts concluded for the implementation of the Sixth Framework Programme. Such information also proved necessary in order to provide proof of the lack of a connection between those transactions and the performance of the FP6 contracts by Zenon. Furthermore, it is apparent from the audit report that it was the applicant who decided to resort to Comeng in order to deliver the invoices to Zenon and to conduct the banking transactions between the latter and Comeng. It must be stated that that information may be deduced from the email of 29 September 2010, sent by the applicant himself to the new director of Zenon and to the Commission by the new shareholders of that company. The applicant indicated therein that resort had been had to Comeng in order to inflate profits by 10% without the company suffering any losses. That data thus enabled the Commission to confirm that the resort to Comeng in the context of the performance of the contracts concluded for the implementation of the Sixth Framework Programme was not an ‘error’, but was instead quite deliberate, to reject the argument that a mere miscalculation had been made, consequently to set aside Zenon’s proposal in its email of 18 October 2010 for a mere adjustment to the calculation of the personnel costs and, therefore, to justify the scope of the financial adjustment made in respect of Zenon. It is therefore not apparent that the transmission to Zenon of that information via the audit report was not consistent with Article 5 of Regulation No 45/2001.

…

67      As to the other arguments relied on by the applicant, he submits that Article 5(a) and (b) of Regulation No 45/2001 was not complied with, on the ground that he is a third party in respect of the contracts concluded by Zenon with the European Union and that no provision of EU law authorises the Commission to process the personal data of third parties. As correctly noted by the Commission, it must be stated that, at the material time, the applicant was both director of Zenon and its legal representative with regard to several FP6 contracts concluded for the implementation of the Sixth Framework Programme and that he was the managing director of Comeng until 2006 as well as its ultimate owner.

68      In addition, the applicant submits that, within the framework of the FP6 contracts, the Commission acted as a contracting party and not as a public authority in sending the final audit report to Zenon, and that it necessarily follows that none of the conditions referred to in Article 5 of Regulation No 45/2001 was met. The applicant’s argument seems to be that the final audit report was part of a purely contractual framework, that the report was inseparable from that framework, and, accordingly, that DG Information Society was not entitled to transmit the complainant’s personal data in those circumstances to Zenon.

69      Admittedly, the final audit report is part of the contractual framework. However, the findings in that report were based on the information contained in the OLAF report, which exercised its powers in the public interest within the meaning of Article 5(a) of Regulation No 45/2001.

70      Accordingly, the complaint that none of the conditions mentioned in Article 5 of Regulation No 45/2001 was met must be dismissed.

71      In the second place, the applicant argues incorrectly that, assuming that OLAF had the right to collect personal data concerning him, it in any event infringed Articles 7 and 8 of Regulation No 45/2001 by sending those data to various Commission DGs, the Greek national authorities, Zenon and its employees as well as Comeng and its employees.

72      The transmission of data by OLAF to DG Information Society was necessary for the legitimate performance of the task falling within the powers of that DG. The findings of the final audit were reached on the basis of information provided by OLAF. Those data enabled DG Information Society to find that the increase in personnel costs was equivalent to the personnel costs invoiced by Comeng and that the terms set out in Article II.6 of the Sixth Framework Programme model contracts had not been complied with, since costs that had been presented as ‘in-house consultants’ costs were in fact subcontracting costs. It was also by relying on that information that the Commission then carried out the costs adjustment. Accordingly, Article 7 of Regulation No 45/2001 was not infringed.

73      Moreover, the applicant complains that DG Information Society sent the final audit report to DG Energy and Transport and to DG Enterprise and Industry and, accordingly, sent them personal data.

74      It should be noted that, in response to a question put to the Commission on that subject, it indicated that DG Enterprise and Industry and DG Energy and transport were part of the Directorates-General in the ‘“Research” family’, which manage the framework programmes for research. The Commission stated that the exchange of information regarding audit reports, within the Directorates-General in the ‘“Research” family’, was a common practice to protect the financial interests of the European Union and to ensure coherent implementation of the framework programmes, since the beneficiaries are very often in receipt of several subsidies granted by various Directorates-General.

75      In the present case, the transmission of the final audit report containing the applicant’s personal data to DG Enterprise and Industry and DG Energy and Transport did not infringe Article 7 of Regulation No 45/2001. Given the role played by those two DGs, belonging to the Directorates-General in the ‘“Research” family’, in the implementation of the Sixth Framework Programme, it must be held, as stated in paragraph 65 above, that the transfers of personal data were necessary for the legitimate performance of tasks falling within their competence.

76      The applicant also alleges breach of Article 8 of Regulation No 45/2001. He submits that OLAF should have established, as part of the transmission to the competent authorities of the Member State falling within Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31), that the data was necessary for the performance of a mission in the public interest. That argument must be rejected. It is clear that the data collected by OLAF — which include in particular that contained in the Commission’s final audit report — which was sent to the Greek authorities was by its nature necessary to those authorities in order for them to be able to carry out their public interest mission relating to the prosecution of criminal offences possibly committed by the applicant in connection with the performance of contracts concluded for the implementation of the Sixth Framework Programme.

77      In the third place, the complaint alleging breach of Article 8(1) of Regulation No 1073/99 and of Article 8 of Regulation No 2185/96 cannot be upheld. Those provisions, read together, provide in substance that the information obtained in the course of external investigations are covered by professional secrecy and enjoy the protection afforded to personal data. By sending to Zenon the data mentioned in paragraphs 62 and 65 above, the Commission merely confirmed what the applicant had already announced to the new managing director of Zenon in his email of 29 September 2010, namely, that resort had been had to Comeng in order to inflate profits. In so doing, the applicant admitted that he had deliberately resorted to a subcontracting arrangement and that the situation was not therefore the result of a miscalculation. In addition, and as is pointed out in paragraphs 62 and 65 above, that information necessarily had to be sent to Zenon in order to dismiss the argument that a mere miscalculation had been made and to reject at the same time Zenon’s proposal, contained in its email of 18 October 2010 to the Commission, simply to adjust the calculation of personnel costs.

78      In the fourth place, the applicant submits in vain that Article 12(1) of Regulation No 45/2001 was also infringed on the grounds that at no point was he informed of the transmission of his personal data. It should be noted that OLAF decided to defer notification of the applicant to 31 March 2010. Article 20 of Regulation No 45/2001 provides that ‘the Community institutions and bodies may restrict the application of ... Article 12(1) ... where such restriction constitutes a necessary measure to safeguard: (a) the prevention, investigation, detection and prosecution of criminal offences’. In the present case, as noted by the Commission, the deferral of the applicant’s notification could easily be justified by the need to investigate, detect and prosecute criminal offences and to prevent a serious risk of destruction of evidence if the applicant were to become aware of the OLAF investigation. The applicant was then duly informed about the processing of his data by OLAF on several occasions, specifically, when invited to the interview, during the interview itself and when the investigation was closed.

79      It follows from the foregoing that the first and second heads of claim, alleging infringements of Articles 4, 5, 7, 8 and 12 of Regulation No 45/2001 must be dismissed. It is also necessary to reject the third complaint, alleging breach of the obligation to protect professional secrecy and maintain confidentiality of personal data laid down in essence in Article 8(1) of Regulation No 1073/99 and Article 8(1) of Regulation No 2185/96, read in conjunction with each other.

 – The fourth head of claim, alleging unlawful processing by DG Information Society of the applicant’s personal data in the course of financial audits conducted as part of contracts

80      The applicant submits that the audits on which the OLAF investigation is based are unlawful, there being no legal provision empowering the Commission to process personal data during financial audits performed in the context of contracts. None of the criteria of Article 5(a) to (c) and (e) of Regulation No 45/2001 was fulfilled. Likewise, Article 5(d) of that regulation was infringed, in that the applicant’s consent to the processing of personal data was not even sought. Article 12(1) of Regulation No 45/2001 was also infringed because the applicant was never informed of the transmission of such data.

81      In essence, DG Information Society is alleged to have processed personal data during the audit in breach of Article 5 of Regulation No 45/2001, on the one hand, and to have sent it to OLAF, on the other.

82      In the first place, as regards the allegation that DG Information Society processed personal data in breach of Article 5 of Regulation No 45/2001, it should be noted that the audit was conducted in order to check whether the contract had been properly implemented. The Commission does not deny having processed, in that context, personal data. However, it correctly contends that the contract provided that the beneficiaries of the Sixth Framework Programme had to indicate actual personnel costs, namely, the hours actually worked by the persons directly carrying out the work and the hourly costs of the consultants. It was therefore legitimate for the Commission to have access to certain personal data in order to conduct an audit efficiently.

83      In that regard, in the initial audit report, it is noted that the auditors found that consultants presented as Zenon employees appeared in reality to be consultants belonging to another company, namely Comeng, that there was a contract between the two companies in that respect and that the use of those consultants had an impact on personnel costs, since the hourly rate of the consultants appeared to be significantly higher than that of Zenon employees. In response to that finding, Zenon observed that the contract required a high level of scientific knowledge and that it had thus had to resort to Comeng’s consultants, since they had specialised knowledge and skills in that regard. In those circumstances, and as noted by the Commission, the auditors required access to all data in order to be able to assess the individual costs of the people working on the project in order to determine whether the personnel costs differed significantly from the actual costs. It follows that the processing of certain personal data was necessary in the present case and that anonymous data would not have permitted the auditors to perform their task efficiently.

84      In addition, it should be noted that the applicant’s name appears only in Annex 2 of the initial audit report in a table listing members of staff and their hours worked as part of the European projects in which Zenon is involved. However, there is no mention of other personal data relating to the applicant that would suggest that he was the author of or accessary to an irregularity or fraud.

85      Given the nature of the personal data and the circumstances of the case, it must be held that the processing of that data was necessary for the Commission to perform its task consisting in the protection of the financial interests of the Union and thus fulfilled the requirement under Article 5(a) of Regulation No 45/2001.

86      In the second place, as regards the complaint that DG Information Society sent personal data to OLAF, it should be noted that the initial audit report stated that the findings concerning the use of consultants from a third company revealed a potentially systematic practice. On the strength of that information, the Commission was entitled to raise the question of the existence of fraud or potential irregularities.

87      As correctly noted by the Commission, the contractual framework is irrelevant in the event of suspicions of fraud or potential irregularities. In that context, the Commission was entitled to inform OLAF of the situation at issue and to send it the information obtained in the course of the audit. The transfer of the personal data to OLAF was necessary for it to perform its task consisting in the protection of the financial interests of the Union and thus fulfilled the requirement under Article 7 of Regulation No 45/2001. Accepting the applicant’s argument would mean that the Commission, despite having suspicions of fraud, was not entitled to warn OLAF because it was in a contractual relationship with the company in respect of which it harboured those suspicions. That interpretation is in clear contradiction with the need to ensure the protection of the financial interests of the Union against fraud and other irregularities. Moreover, the initial audit report mentions the applicant’s name only as a consultant and does not raise any suspicion of fraud against him.

88      The argument must also be dismissed that Article 4(1)(b) and (e) and Article 6 of Regulation No 45/2001 were infringed because the data relating to Zenon and the projects at issue were no longer held for their original purpose (namely, reviewing whether the company had observed the financial terms of the contract) when they were sent by DG information Society to OLAF.

89      It should be recalled that, under Article 4 of Regulation No 45/2001, ‘personal data must be: (a) processed fairly and lawfully; (b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes ...; (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed’. Article 6(1) of that regulation provides that ‘personal data shall only be processed for purposes other than those for which they have been collected if the change of purpose is expressly permitted by the internal rules of the Community institution or body’.

90      In the present case, protection of the financial interests of the Union is the purpose for which the Commission collected the data from Zenon and for which it forwarded them to OLAF.

91      Finally, the applicant submits that Article 4 of Regulation No 45/2001 was infringed, on the ground that the financial interests of the Union would have been fully protected if OLAF and DG Information Society had not named him in the final investigation report and in the audit reports sent to the Greek authorities. In his view, the mention of his name was not necessary since the Greek authorities were themselves competent to determine the liability of Zenon’s board members and attribute it to them.

92      That complaint is unfounded. First, the mention of the applicant’s name and of the relationship between Comeng and Zenon at the time when he was a director of Zenon made it possible to explain, at that stage, why the Commission had imposed an adjustment on Zenon in the context of the implementation of the contracts of the Sixth Framework Programme. Moreover, the fact that the applicant’s name is mentioned in no way prejudices the power of the competent Greek authorities to determine for themselves the potential liability of Zenon’s board members. The collection and gathering of personal data relating to the applicant were therefore necessary and did not constitute an infringement of Article 4 of Regulation No 45/2001.

93      It follows that the fourth complaint, alleging the unlawful processing of personal data in the course of financial audits carried out as part of the contract, must be rejected.

 – The fifth complaint, alleging infringement of Articles 25, 27 and 28 of Regulation No 45/2001

94      The applicant argues that Articles 25, 27 and 28 of Regulation No 45/2001 were infringed, on the ground that the Data Protection Officer was not informed of the processing of the applicant’s personal data and that OLAF did not ask the EDPS to conduct a prior check.

…

98      First of all, as regards Article 25(1) of Regulation No 45/2001, the applicant points out, without it being challenged by the Commission, that DG Information Society began to submit notifications of personal data processing to the data protection officer from 2011.

99      The Commission refers to the privacy statement for external investigations in order to demonstrate that it satisfied the requirement to give prior notice laid down by Article 25(1) of Regulation No 45/2001. The applicant noted, however, that the document relied on by the Commission was in fact lodged on 18 June 2013 and is therefore irrelevant in respect of the assessment of compliance with the above provision. The Commission seeks to justify that delay by the fact that the practices required by Article 25(1) of Regulation No 45/2001 could be carried out only gradually and that the EDPS held, in a decision relating to a delayed notification, that there was no reason to find that the above regulation had been infringed since the infringement had been remedied.

100    However, the rectification of the situation does not make it possible to find that no infringement occurred. Article 25(1) of Regulation No 45/2001 was infringed since the data was notified after it had been processed. It must therefore be held that the Commission infringed a rule of law whose purpose is to confer rights on the persons concerned by the personal data held by the institutions and bodies of the European Union (see the case-law cited in paragraph 51 above). However, the question arises whether that infringement may be regarded as sufficiently serious within the meaning of the case-law referred to in paragraph 42 above. In that regard, first, it is important to note that, under Regulation No 45/2001, the data protection officer’s role is to ensure that the processing of personal data does not affect the rights and freedoms of the relevant data subjects. In that context, his role is, inter alia, to warn the EDPS against any processing of data which could constitute a risk within the meaning of Article 27 of Regulation No 45/2001. It follows that, if the data protection officer is not informed of that data processing, he will himself not be in a position to notify the EDPS and therefore cannot effectively fulfil the essential task of supervision assigned to him by the European legislature.

101    Moreover, it must be recalled that, as stated in recital 14 of Regulation No 45/2001, the provisions thereof apply to any processing of personal data carried out by all the institutions. The institutions and bodies of the Union thus have no discretion when applying Regulation No 45/2001.

102    In the light of those elements, the essential character of the data protection officer’s monitoring role and the lack of any discretion on the part of the institutions and bodies of the Union, it must be held that the mere breach of Article 25(1) of Regulation No 45/2001 is sufficient in the present case to establish the existence of a sufficiently serious breach of a rule of law intended to confer rights on individuals.

103    In those circumstances, the Commission argues in vain that, in a decision of 17 May 2014, the EDPS found that the delay in the progressive implementation of Regulation No 45/2001 was due to the various steps required by the regulation itself, inherent in its provisions. Such a justification does not call into question the conclusion that, in the present case, the Commission committed a sufficiently serious breach of a rule of law.

104    The question of the extent to which that breach has caused damage to the applicant will be examined in paragraph 247 below.

105    Next, the applicant invokes an infringement of Article 27 of Regulation No 45/2001 on the grounds that the processing to be carried out as part of the audits was not subject to prior checking by the EDPS. However, on the one hand, it should be noted that the applicant has not submitted any argument showing that the audits should be considered to be processing capable of presenting specific risks to the rights and freedoms of the data subjects by virtue of their nature, their scope or their purpose. On the other hand, the interpretation of the above provision, as advocated by the Commission, must be upheld. It correctly notes that prior notification to the EDPS is not required in the case of audits such as that carried out in the present case, since the processing is not likely to present specific risks to the rights and freedoms of the data subjects because of their nature, their scope and their purpose. It should be noted that the primary purpose of the audit carried out by the Commission was to ensure the proper performance of the contract and the regularity of the financial transactions carried out under the funded project and not to detect possible fraud which could give rise to the opening of an investigation by OLAF.

106    It is true that, in order for an audit to be carried out efficiently and effectively and for appropriate conclusions to be drawn therefrom, the collection and analysis of personal data may be required. That does not, however, mean that the prior checking required by Article 27 of Regulation No 45/2001 is necessary, in view of the purpose of the audit. In the present case, the auditor processed the personal data of the applicant and other consultants, namely, the data concerning their role, the number of hours they had worked and the direct personnel costs having regard to their hourly cost. The purpose of the processing, however, was neither a focused assessment of the individual performance of the applicant and the other consultants or the identification of possible fraud. It follows that the submission to the prior checking provided for in Article 27 of Regulation No 45/2001 was not necessary in the present case and that it was therefore impossible for that provision to be infringed.

107    In those circumstances, it is helpful to note that submission to prior checking by the EDPS under Article 27(2)(a) of Regulation No 45/2001 is necessary in the event of the processing of the information contained in the OLAF investigation report, since that processing may lead OLAF to suspect that individuals have committed breaches.

108    In that regard, with respect to the applicant’s allegation that OLAF did not ask the EDPS to perform a prior review of its on-the-spot checks and inspections and thus infringed Article 27 of Regulation No 45/2001, the Commission notes that the conduct of OLAF’s investigations was consistent with the advice set out in several opinions (of 4 October 2007 and 3 February 2012) from the EDPS and that OLAF external investigations had been the subject of an opinion by the EDPS of 4 October 2007, well before the external investigation of the project which is the subject of the present case. The applicant nonetheless submits that the legal basis of the opinion of 4 October 2007, namely Articles 18 and 20 of Regulation (EC) No 2321/2002 of the European Parliament and of the Council of 16 December 2002 concerning the rules for the participation of undertakings, research centres and universities in, and for the dissemination of research results for, the implementation of the European Community Sixth Framework Programme (2002-2006) (OJ 2002 L 355, p. 23), is not sufficient to justify the external investigations by OLAF of the projects of the Sixth Framework Programme. As for the opinion of 3 February 2012 to which the Commission also refers, it is irrelevant as regards the inspection carried out at Comeng premises in February 2010.

109    It must be noted that the EDPS issued an opinion on 4 October 2007 which concerns the external investigations by OLAF regarding in particular, the Sixth Framework Programme. Thus, the applicant’s argument has no factual basis.

110    Furthermore, that argument has no legal basis. Article 20 of Regulation No 2321/2002 provides as follows:

‘Protection of the Community’s financial interests

The Commission shall ensure that, when indirect actions are implemented, the financial interests of the Community are protected by effective checks and by deterrent measures and, if irregularities are detected, by penalties which are effective, proportionate and dissuasive, in accordance with Council Regulations (EC, Euratom) No 2988/95 and (Euratom, EC) No 2185/96, and with Regulation (EC) No 1073/1999 of the European Parliament and of the Council.’

111    That provision refers unambiguously to Regulation No 1073/1999 and constitutes a sufficient legal basis to allow OLAF to carry out on-the-spot inspections and checks. In that regard, the applicant does not indicate how that interpretation is flawed and merely argues that Article 20 of the above regulation does not authorise OLAF to conduct external investigations of contractors in projects of the Sixth Framework Programme.

112    In addition, the applicant submits that the external financial audits constituted an administrative measure in respect of the relevant consultants and that, therefore, notification to the EDPS under Article 28 of Regulation No 45/2001 was necessary. The applicant does not, however, indicate how that provision would be applicable in the present case. The argument must therefore be rejected.

113    Finally, the applicant submits that the notification of the document on 2 February 2011 to the data protection officer constituted an infringement of Article 25 of Regulation No 45/2001 since that document contained two false statements, one relating to the EDPS opinion concluding that Article 27 of Regulation No 45/2001 had not been applied, the other consisting in the failure to mention the name of the ‘subcontractor’ (see paragraphs 152 to 155 below).

114    With respect to the first allegedly false statement, it follows from paragraphs 105 and 106 above that Article 27 of Regulation No 45/2001 was, in any event, not applicable in the present case. The notification does not, therefore, contain any error on that point.

115    As to the second allegedly false statement relating to item 3 of the notification, concerning ‘subcontractors’, the lack of express reference to the subcontractor at most makes it possible to consider that the notification is imprecise and not that it is false. Accordingly, it cannot be considered that Article 25 of Regulation No 45/2001 was infringed on account of that sole inaccuracy.

116    It follows from paragraphs 98 to 102 above that the plea must be upheld inasmuch as it concerns the infringement of Article 25 of Regulation No 45/2001 and dismissed as to the remainder.

 The first plea in law, alleging misuse of powers by OLAF

…

 – The power of OLAF to conduct an investigation concerning the performance of a contract

128    The applicant argues, in essence, that OLAF did not have the power to conduct an investigation into the performance of a contract signed for the implementation of a framework programme.

129    In that regard, it should be recalled that Article 310(6) TFEU provides that ‘the Union and the Member States, in accordance with Article 325, shall counter fraud and any other illegal activities affecting the financial interests of the Union’ and that Article 325 TFEU which relates to combating fraud provides that ‘the Union and the Member States shall counter fraud and any other illegal activities affecting the financial interests of the Union through measures ... which shall act as a deterrent and be such as to afford effective protection in the Member States, and in all the Union’s institutions, bodies, offices and agencies’.

130    It should be noted that substantial amounts of Community funds are lost each year as a result of fraud and other irregularities committed by natural and legal persons, and that the EU institutions and the Member States granted the European Union a specific legal basis for action in the field of fraud prevention, established administrative structures and adopted legislative measures aimed at prevention of fraud by individual recipients of EU funds in the Member States or by members and staff of the institutions and bodies of the European Union (see, to that effect, Opinion of Advocate General Jacobs in Commission v EIB, C‑15/00, EU:C:2002:557, point 4).

131    It was with that objective that OLAF was established by Decision 1999/352. The first subparagraph of Article 2(1) of that decision provides:

‘[OLAF] shall exercise the Commission’s powers to carry out external administrative investigations for the purpose of strengthening the fight against fraud, corruption and any other illegal activity adversely affecting the Community’s financial interests, as well as any other act or activity by operators in breach of Community provisions.’

132    With respect to the investigations carried out by OLAF, Article 1 of Regulation No 1073/1999 provides as follows:

‘1. In order to step up the fight against fraud, corruption and any other illegal activity affecting the financial interests of the European Community, ... [OLAF] shall exercise the powers of investigation conferred on the Commission by the Community rules and Regulations and agreements in force in those areas.

2. [OLAF] shall provide the Member States with assistance from the Commission in organising close and regular cooperation between their competent authorities in order to coordinate their activities for the purpose of protecting the European Community’s financial interests against fraud. [OLAF] shall contribute to the design and development of methods of fighting fraud and any other illegal activity affecting the financial interests of the European Community.’

133    Article 2 of Regulation No 1073/1999 defines the concept of ‘administrative investigations’ as follows:

‘Within the meaning of this Regulation, “administrative investigations” (hereinafter “investigations”) shall mean all inspections, checks and other measures undertaken by employees of [OLAF] in the performance of their duties, in accordance with Articles 3 and 4, with a view to achieving the objectives set out in Article l and to establishing, where necessary, the irregular nature of the activities under investigation. These investigations shall not affect the powers of the Member States to bring criminal proceedings.’

134    Article 3 of Regulation No 1073/1999, entitled ‘External investigations’, provides as follows:

‘[OLAF] shall exercise the power conferred on the Commission by Regulation (Euratom, EC) No 2185/96 to carry out on-the-spot inspections and checks in the Member States and, in accordance with the cooperation agreements in force, in third countries.

As part of its investigative function, [OLAF] shall carry out the inspections and checks provided for in Article 9(1) of Regulation (EC, Euratom) No 2988/95 and in the sectoral rules referred to in Article 9(2) of that Regulation in the Member States and, in accordance with the cooperation agreements in force, in third countries.’

135    With respect to the decision to open an investigation, the first paragraph of Article 5 of Regulation No 1073/1999 provides that ‘external investigations shall be opened by a decision of the Director of [OLAF], acting on his own initiative or following a request from a Member State concerned’.

136    Article 6 of Regulation No 1073/1999 sets out the rules governing the investigations procedure as follows:

‘1. The Director of [OLAF] shall direct the conduct of investigations.

2. [OLAF’s] employees shall carry out their tasks on production of a written authorisation showing their identity and their capacity.

3. [OLAF’s] employees shall be equipped for each intervention with a written authority issued by the Director indicating the subject matter of the investigation.

4. During on-the-spot inspections and checks, [OLAF’s] employees shall adopt an attitude in keeping with the rules and practices governing officials of the Member State concerned, with the Staff Regulations and with the decisions referred to in the second subparagraph of Article 4(1).

5. Investigations shall be conducted continuously over a period which must be proportionate to the circumstances and complexity of the case.

6. The Member States shall ensure that their competent authorities, in conformity with national provisions, give the necessary support to enable [OLAF’s] employees to fulfil their task. The institutions and bodies shall ensure that their members and staff afford the necessary assistance to enable [OLAF’s] agents to fulfil their task; the offices and agencies shall ensure that their managers and staff do likewise.’

137    Article 7 of Regulation No 1073/1999 also lays down an obligation for the institutions, bodies, offices and agencies to forward to OLAF without delay any information relating to possible cases of fraud or corruption or any other illegal activity.

138    The investigation report and the action taken following investigations are set out in Article 9 of Regulation No 1073/1999 as follows:

‘1. On completion of an investigation carried out by [OLAF], the latter shall draw up a report, under the authority of the Director, specifying the facts established, the financial loss, if any, and the findings of the investigation, including the recommendations of the Director of [OLAF] on the action that should be taken.

2. In drawing up such reports, account shall be taken of the procedural requirements laid down in the national law of the Member State concerned. Reports drawn up on that basis shall constitute admissible evidence in administrative or judicial proceedings of the Member State in which their use proves necessary, in the same way and under the same conditions as administrative reports drawn up by national administrative inspectors. They shall be subject to the same evaluation rules as those applicable to administrative reports drawn up by national administrative inspectors and shall be of identical value to such reports.

3. Reports drawn up following an external investigation and any useful related documents shall be sent to the competent authorities of the Member States in question in accordance with the rules relating to external investigations …’

139    It should also be noted that Article 20 of Regulation No 2321/2002 affirms the protection of the financial interests of the Union. That provision expressly refers to Regulation No 1073/1999 and, thus, confirms OLAF’s power to protect the financial interests of the Union in the following terms:

‘The Commission shall ensure that, when indirect actions are implemented, the financial interests of the Community are protected by effective checks and by deterrent measures and, if irregularities are detected, by penalties which are effective, proportionate and dissuasive, in accordance with Council Regulations (EC, Euratom) No 2988/95 and (Euratom, EC) No 2185/96, and with Regulation (EC) No 1073/1999 of the European Parliament and of the Council.’

140    Finally, it must be noted that, according to settled case-law, where the wording of secondary EU law is open to more than one interpretation, preference should be given to the interpretation which renders the provision consistent with the Treaty (judgments of 24 June 1993 in Dr Tretter, C‑90/92, EU:C:1993:264, paragraph 11, and 10 September 1996 in Commission v Germany, C‑61/94, EU:C:1996:313, paragraph 52).

141    In that regard, it should be borne in mind that, according to settled case-law, in interpreting a provision of EU law, it is appropriate to consider not only its wording but also its context and the objectives pursued by the rules of which it forms part (see judgment of 7 June 2005 in VEMW and Others, C‑17/03, EU:C:2005:362, paragraph 41 and the case-law cited).

142    In addition, since the textual and historical interpretations of secondary EU law, and in particular one of its provisions, do not permit its precise scope to be assessed, the legislation in question must be interpreted by reference to its purpose and general structure (see, to that effect, judgments of 31 March 1998 in France and Others v Commission, C‑68/94 and C‑30/95, EU:C:1998:148, paragraph 168, and 25 March 1999 in Gencor v Commission, T‑102/96, EU:T:1999:65, paragraph 148).

143    It is in the light of those provisions and the above case-law that it is appropriate to review the legislation governing OLAF’s power to conduct an investigation into the performance of a contract concluded for the implementation of a framework programme.

144    It is apparent from the provisions referred to in paragraphs 129 to 139 above that OLAF was given broad competence for the purposes of combating fraud, corruption and any other illegal activity affecting the financial interests of the Union.

145    In order to make the protection of the financial interests of the Union affirmed in Article 325 TFEU effective, it is imperative that the deterrence and combating of fraud and other irregularities occurs at all levels and in respect of all activities as part of which Union interests may be affected by such phenomena. It is in order best to fulfil that objective that the Commission stated that OLAF should exercise its powers in external administrative investigations.

146    It is also to that effect that, in actual fact, Article 20 of Regulation No 2321/2002, referred to in paragraph 139 above — which relates to the rules for the participation of undertakings in the implementation of the Sixth Framework Programme — provided that the Commission was to ensure that the financial interests of the Union would be protected by the carrying out of effective checks in accordance with Regulation No 1073/1999. Specifically, that regulation provides that OLAF had the power, conferred on the Commission by Regulation No 2185/96, to carry out checks and inspections in the Member States.

147    It is thus apparent that the existence of a contractual relationship between the Union and natural or legal persons suspected of illegal activities has no impact on OLAF’s investigative power. OLAF may conduct investigations in respect of those persons if they are suspected of fraud or illegal activity, notwithstanding the existence of a contractual relationship between those parties.

148    It is thus in vain that the applicant argues that the above provisions should be interpreted as meaning that OLAF is not entitled to use its powers in cases involving contracts concluded on behalf of the European Union. That interpretation — which thus implies a limitation of the powers of the institutions in combating fraud or any other illegal activity — is consistent neither with the Treaty, nor with the purpose or general economy of the provisions thereof.

149    In those circumstances, the applicant is incorrect in calling into question OLAF’s independence in suspecting the Commission of being subject to a conflict of interest in the event of a contract concluded by it on behalf of the Union. Recital 12 of Regulation No 1073/1999 highlights the need to ensure that OLAF is independent in carrying out the tasks conferred on it by that regulation, by giving its Director the possibility of opening an investigation on his own initiative. Article 12(3) of that regulation gives effect to that recital by providing that ‘the Director shall neither seek nor take instructions from any government or any institution, body, office or agency in the performance of his duties with regard to the opening and carrying out of external and internal investigations or to the drafting of reports following such investigations’, and that ‘if the Director considers that a measure taken by the Commission calls his independence into question, he shall be entitled to bring an action against his institution before the Court of Justice’.

150    OLAF’s independence is reaffirmed in Article 3 of Decision 1999/352, as amended by Commission Decision 2013/478/EU of 27 September 2013 (OJ 2013 L 257, p. 19) which provides as follows:

‘Independence of the investigative function

[OLAF] shall exercise the powers of investigation referred to in Article 2(1) in complete independence. In exercising these powers, the Director [General] of [OLAF] shall neither seek nor take instructions from the Commission, any government or any other institution or body.’

…

 – The lawfulness of the contractual clause relating to checks and audits

157    The applicant submits in vain that the contractual clause providing for OLAF’s participation in inspections and audits carried out in the context of the contracts of the Sixth Framework Programme is wrongful and unlawful. It was noted in paragraphs 144 and 145 above that OLAF had the power to conduct external investigations of natural and legal persons who were suspected of fraud or illegal activities affecting the financial interests of the Union, notwithstanding the existence of a contractual relationship between the institution and those persons. In those circumstances, OLAF does not act pursuant to Article II.29 of the FP6 Model Contract — which provides that the Commission may conduct inspections and on-the-spot checks and refers in that regard to Regulations No 2185/96 and 1073/1999 — but pursuant to the powers conferred by the above regulations and Decision 1999/352.

158    The contractual clause thus constitutes a simple reminder of the powers already available to the Commission and OLAF. It does not appear that the application of that clause by the Commission and OLAF constitutes misconduct capable of causing injury to the applicant.

…

 – The lack of sufficiently serious suspicions relating to fraudulent acts or corruption

…

175    According to case-law, a decision by OLAF’s Director to open an investigation, like the decision of an institution, body, agency or organ established by, or on the basis of, the Treaties to request that an investigation be opened, may not be taken unless there are sufficiently serious suspicions relating to acts of fraud or corruption or other illegal activities detrimental to the financial interests of the European Union (judgments of 10 July 2003 in Commission v ECB, C‑11/00, EU:C:2003:395, paragraph 141, and Commission v EIB, C‑15/00, EU:C:2003:396, paragraph 164).

176    It is therefore appropriate to examine whether OLAF’s suspicions were sufficiently serious.

177    In that regard, the initial audit report includes a certain amount of information showing that Zenon had not sent the personnel costs form required for certain periods, that a significant proportion of personnel costs declared by Zenon related to persons that Comeng had posted to it, that the hourly rate of a worker posted by Comeng was significantly higher than that of a worker employed by Zenon and that Comeng’s personnel costs could not be considered ‘in-house consultants’ costs. It is also apparent from that information that the practice of viewing Comeng’s personnel costs as in-house consultant costs was potentially systematic. The report further highlights the fact that the links between those two companies were not known and that it was the audit that made it possible to confirm the existence of an agreement signed on 1 April 2005 between Comeng and Zenon.

178    It is important to note that that information represents part of the information contained in the confidential document containing OLAF’s assessment of the initial information.

179    It must be held that, in the light of those elements — namely, the lack of information about the links between Zenon and Comeng, apparently seemingly exaggerated personnel costs, statements relating to personnel not consistent with the actual facts, an apparently systematic practice with respect to the classification of the personnel costs — OLAF was entitled to consider that there were sufficiently serious suspicions relating to acts of fraud or other illegal activities detrimental to the budget of the Union to open an investigation.

…

 – OLAF’s lack of jurisdiction to organise interviews as part of the external investigations

…

187    In the present case, it must be recalled that two members of OLAF’s staff questioned the complainant in Patmos on 6 September 2011.

188    With respect to the legislation, from a purely literal point of view, it must be conceded that, contrary to what is provided for in Article 4 of Regulation 1073/1999 in respect of internal investigations, no provision expressly provides for the possibility for OLAF to seek oral information as part of external investigations.

189    However, the lack of a specific provision in that regard is not to be interpreted as meaning that OLAF is prohibited from organising interviews as part of external investigations. The power to carry out on-the-spot checks and inspections undeniably entails the power to schedule interviews with people involved in those checks and inspections. Moreover, the interviews conducted by OLAF are not binding, since the relevant persons have the right to refuse to take part or to answer certain questions.

190    Furthermore, it should be recalled that Article 7 of Regulation No 2185/1996 and Article 2 of Regulation No 1073/1999, read in conjunction, indicate that OLAF has access ‘under the same conditions as national administrative inspectors and in compliance with national legislation’ to all the information and documentation on the operations concerned which are required for the proper conduct of the on-the-spot checks and inspections.

191    The applicant has not presented any argument intended to demonstrate the existence of a fault by OLAF in that regard. The applicant has not indicated how OLAF’s action in inviting him to an interview as a person to whom the checks and inspections related was not consistent with Article 7 of Regulation No 2185/96 and Article 2 of Regulation No 1073/1999, read in conjunction.

192    For that very reason, the argument that Opinion 2/2012 given by OLAF’s Supervisory Committee which confirms that OLAF may not request oral information as part of the external investigations must also be rejected.

193    Accordingly, the complaint relating to OLAF’s lack of power to organise interviews as part of the external investigations must be dismissed.

 – OLAF’s lack of power to conduct investigations of third parties

…

196    In that regard, it should be noted that Regulation No 2185/96 provides in the third paragraph of Article 5 that ‘where strictly necessary in order to establish whether an irregularity exists, the Commission may carry out on-the-spot checks and inspections on other economic operators concerned, in order to have access to pertinent information held by those operators on facts subject to on-the-spot checks and inspections’.

197    Furthermore, no provision of Regulation No 2185/96 or, moreover, of any other regulation prevents the Commission or, in the present case, OLAF from carrying out an on-the-spot check or inspection at a subcontractor’s premises without having previously carried out a check or inspection at the premises of the trader suspected of fraud. Provided that it is strictly necessary to establish the existence of an irregularity, OLAF may carry out an on-the-spot check or inspection at the premises of other traders.

198    It must be recalled that Comeng was indeed a subcontractor of Zenon’s in the context of the disputed performance of the FP6 contracts concluded for the implementation of the Sixth Framework Programme. An inspection at that trader’s premises was therefore necessary in order to collect the relevant information held by it in respect of the facts that were the subject of the investigation.

199    As for the choice to conduct an inspection at that trader’s premises prior to that carried out at Zenon’s premises, it could be justified by the necessity of contriving an element of surprise. In any event, provided the inspections carried out comply with Regulation No 2185/96 — which is the case of the inspection carried out at Comeng’s premises — the choice of the timing of those inspections is a matter solely for the Commission and OLAF to determine.

200    In the light of the circumstances of the case and the existence of sufficiently serious suspicions, set out in paragraphs 177 to 181 above, it must be held that the inspection carried out at Comeng’s premises was strictly necessary and fell within OLAF’s discretion.

201    Consequently, no infringement of Article 5 of Regulation No 2185/96 may be attributed to the Commission.

 – The unlawfulness of the extension of the investigation to the financial transactions for the period from 2002 to 2006

…

210    In the second place, the arguments alleging the action was time-barred and those alleging infringement of the principles of reasonable time and legal certainty should be examined together.

…

213    It should be recalled that, according to case-law, the limitation rule laid down in Article 3(1) of Regulation No 2988/95 is applicable both to irregularities resulting in the imposition of an administrative penalty within the meaning of Article 5 of that regulation and to those which entail an administrative measure within the meaning of Article 4 of that regulation, such measure involving the withdrawal of the wrongly obtained advantage without, however, constituting a penalty (judgments of 29 January 2009 in Josef Vosding Schlacht-, Kühl- und Zerlegebetrieb and Others, C‑278/07 to C‑280/07, EU:C:2009:38, paragraph 22; 15 April 2011 in IPK International v Commission, T‑297/05, EU:T:2011:185, paragraph 147; and 19 April 2013 in Aecops v Commission, T‑53/11, not published, EU:T:2013:205, paragraph 41).

214    The Court of Justice has also held that, by adopting Regulation No 2988/95 and, in particular, the first subparagraph of Article 3(1) thereof, the EU legislature intended to establish a general limitation rule applicable to that area, by which it intended, first, to define a minimum period applied in all the Member States and, secondly, to waive the possibility of recovering sums wrongly received from the EU budget after the expiry of a four-year period following the occurrence of the irregularity affecting the payments at issue. It follows that, as from the date on which Regulation No 2988/95 entered into force, any advantage wrongly received from the EU budget can, as a rule and apart from in the sectors for which the EU legislature has prescribed a shorter period, be recovered by the competent authorities of the Member States within a period of four years (judgment of 29 January 2009 in Josef Vosding Schlacht-, Kühl- und Zerlegebetrieb and Others, C‑278/07 to C‑280/07, EU:C:2009:38, paragraphs 27 and 28).

215    In the light of the scope of Article 3(1) of Regulation No 2988/95, as set out in the case-law, and of the fact that OLAF’s investigation, inasmuch as it concerned the applicant, could only lead to administrative or criminal measures or sanctions under national law and not EU law, the applicant was not entitled to rely on any limitation period under Article 3(1) of Regulation No 2988/95.

216    In any event, even if it were appropriate to consider that the limitation rules laid down in Regulation No 2988/95 were applicable to the Greek national courts in respect of possible criminal proceedings, it should be noted, as the Commission correctly does, that the irregularity which occurred in the context of the performance of the contracts under the Sixth Framework Programme was continuous. It should also be noted that the irregularity ended on 30 September 2007, which is the date on which the last project of the Sixth Framework Programme in which Zenon was active (namely Gnosys) ended. It is appropriate to consider that the alleged irregularity ceased on that date. It follows that the limitation period began to run only from 1 October 2007.

217    In those circumstances, it should be recalled that, under the third subparagraph of Article 3(1) of Regulation No 2988/95, the limitation period for bringing proceedings against the applicant may be considered to have been interrupted only by an act notified to the applicant. The applicant acknowledged, at the hearing, having been informed of the investigation in a letter of July 2011. It should also be noted that the letter stated that the applicant was considered a ‘person concerned’ by the investigation in question and that he had been in contact with OLAF representatives, since there was a reference to the applicant’s email of 6 July 2011 to OLAF, in which he confirmed his agreement to the date of the hearing at his usual residence in Greece. In those circumstances, it must be held that the letter sent in July 2011 to the applicant interrupted the limitation period and caused a new period of four years to start running from the date of the letter (see, to that effect and by analogy, judgment of 13 March 2003 in José Martí Peix v Commission, T‑125/01, EU:T:2003:72, paragraph 94).

218    It follows that the applicant’s argument alleging that the proceedings were time-barred must be rejected.

219    As regards the argument alleging breach of the obligation to conduct administrative procedures within a reasonable time, it must be noted that that obligation is a general principle of EU law which is enforced by the European Union Courts and is, moreover, referred to, as an element of the right to good administration, in Article 41(1) of the Charter of Fundamental Rights of the European Union (see, to that effect, judgment of 21 May 2014 in Catinis v Commission, T‑447/11, EU:T:2014:267, paragraph 34). Similarly, it should be recalled that the reasonableness of the length of an administrative procedure must be appraised in the light of the circumstances specific to each case and, in particular, its context, the various procedural stages followed, the complexity of the case and its importance for the various parties involved (see judgments of 22 October 1997 in SCK and FNK v Commission, T‑213/95 and T‑18/96, EU:T:1997:157, paragraph 57; 16 September 1999 in Partex v Commission, T‑182/96, EU:T:1999:171, paragraph 177; and 19 April 2013 in Aecops v Commission, T‑53/11, not published, EU:T:2013:205, paragraph 57). In the present case, the contracts concluded for the implementation of the Sixth Framework Programme concerned the period between 2002 and 2006 and thus extended over several years. Moreover, the irregularity noted by the Commission was continuous and extended over that period. The applicant cannot therefore claim that OLAF conducted an investigation over a period going back several years. Furthermore, OLAF complied with Article 6(5) of Regulation No 1073/1999, since the investigation was conducted continuously over a period which was proportional to the circumstances and complexity of the case. OLAF opened its investigation in December 2009. In February 2010, it carried out an inspection at Comeng’s premises. In August 2010, the Commission drafted the final audit report and sent it to Zenon who commented on it in October and November 2010. The Commission adopted the final audit report in February 2011. On the basis of the elements in the final audit report, OLAF, in July 2011, informed the applicant that he was a person concerned, interviewed him in September 2011, closed its investigation in September 2012 and sent its final investigation report to the Greek authorities in October 2012. It follows that OLAF did not infringe the obligation to conduct administrative procedures within a reasonable time or the right to good administration of which the obligation is a component. Similarly, in the light of the above, OLAF has not in any way infringed the principle of diligence.

…

 The third plea, alleging breach of the rights of the defence

225    As part of the third plea in law, the applicant submits that only a little information was available to him, at the time of his interview and until the date on which he brought his action, on the subject of the investigations and of the allegations made by OLAF against him. He submits that, as a person concerned, he ought to have been accurately and clearly informed of every one of the matters relating to him. He claims, however, not to have been given conclusive detailed information about the allegations made against him or the conduct complained of, or of the accusations and information forwarded to DG Information Society and the Greek authorities, and not to have been given the chance to defend himself, comment on those matters or refute any false allegations.

226    The Commission rejects those claims.

227    In that regard, it should be noted that, by his third plea, the applicant argues that his rights of defence were infringed and submits, in essence, two complaints. On the one hand, he was not informed accurately and clearly of the conduct complained of and was therefore not able to comment on those matters. On the other, he had access neither to the OLAF file before OLAF drafted its report and mentioned his name therein, nor to the final report itself.

228    As a preliminary point, it should be borne in mind that, according to settled case-law, respect for the rights of the defence is, in all proceedings initiated against a person which are liable to culminate in a measure adversely affecting that person, a fundamental principle of EU law which must be guaranteed even in the absence of any rules governing the proceedings in question. That principle requires that any person who may be adversely affected by the adoption of a decision must be placed in a position in which he may effectively make known his views on the evidence against him which the Commission has taken as the basis for the decision (see, to that effect, judgment of 24 October 1996 in Commission v Lisrestal and Others, C‑32/95 P, EU:C:1996:402, paragraph 21).

229    In the first place, as regards the complaint that the applicant was not informed clearly enough of the conduct complained of and was therefore not able to comment on those matters, it must firstly be stated that there is no obligation laid down in any regulation to inform the data subjects as part of OLAF’s external investigations. However, with respect to internal investigations, Article 4 of Commission Decision 1999/396/EC, ECSC, Euratom, of 2 June 1999 concerning the terms and conditions for internal investigations in relation to the prevention of fraud, corruption and any illegal activity detrimental to the Communities’ interests (OJ 1999 L 149, p. 57), headed ‘Informing the interested party’, provides as follows:

‘Where the possible implication of a Member, official or servant of the Commission emerges, the interested party shall be informed rapidly as long as this would not be harmful to the investigation ...

In cases necessitating the maintenance of absolute secrecy for the purposes of the investigation and requiring the use of investigative procedures falling within the remit of a national judicial authority, compliance with the obligation to invite the Member, official or servant of the Commission to give his views may be deferred in agreement with the President of the Commission or its Secretary-General respectively.’

230    The Court has previously held that observance of the rights of the defence was sufficiently guaranteed during an internal investigation by OLAF if OLAF complied with Article 4 of Decision 1999/396 (judgment of 12 September 2007 in Nikolaou v Commission, T‑259/03, not published, EU:T:2007:254, paragraph 245).

231    The same applies to OLAF’s external investigation procedure. Thus, observance of the rights of the defence is sufficiently guaranteed in such an investigation if, like what is provided for in Article 4 of Decision 1999/396, the person is promptly informed of the possibility of personal involvement in acts of fraud, corruption or illegal activities detrimental to the interests of the Union, where doing so does not interfere with the investigation.

232    In the present case, it should be recalled that, as early as July 2011, OLAF sent the applicant a letter informing him that he was regarded as a person covered by the investigation into the GR/RESEARCH-INFSO-FP6-Robotics and informatics project. OLAF made clear in that letter that it was asking the applicant for explanations and information on Zenon and Comeng’s involvement in the research projects which were part of the Sixth Framework Programme. In the same letter, OLAF invited the applicant to an interview in order to give him the ‘opportunity to express [his] views and comments on all the relevant facts which concern [him] as an interested party’. It stated that in order to facilitate the interview, the applicant was invited to gather the necessary documents concerning Zenon and Comeng’s involvement in those research projects of the European Union, namely copies of invoices issued by Comeng to Zenon, proof of payment, copies of signed service contracts between Zenon and Comeng, copies of documents relating to work carried out by the consultants on behalf of Comeng, copies of records of hours worked by the consultants and copies of the signed service contracts concluded between Comeng and other companies such as [confidential]. (2)

233    OLAF also stated that the applicant had the right to be advised by legal counsel or any other representative, that, after the interview, he would be asked to read the report and to sign it if he agreed with its contents, that the interview could be used as part of administrative, disciplinary, legal or criminal proceedings and that the investigation could lead to financial recovery or the referral of the case to the disciplinary authorities of the Union or to the competent national judicial authorities.

234    On 7 September 2011, two representatives of OLAF met the applicant at his home. It is apparent from the minutes of the interview signed by the parties that the applicant was informed at the outset that OLAF was seeking to check the essential facts and gather information on the relationship between Zenon and Comeng in the context of the performance of the contracts under the Sixth Framework Programme. In that regard, it must be noted that the report first discloses [confidential].

235    By letter of 19 September 2012, the applicant was informed that OLAF had completed the investigation and that there were grounds to believe that criminal offences affecting the financial interests of the Union had been committed. The letter stated that, on the basis of the findings of the investigation, OLAF had recommended to the Greek judicial authorities that they take legal action.

236    In the light of all of those elements, it must be stated that, in the circumstances of the present case, the applicant was fully informed of the reasons for the external investigation conducted by OLAF and of the reasons why he was a person concerned by the investigation and that he was, to the requisite standard, given the opportunity to be heard. In particular, it is apparent from the report of the interview that he was fully aware [confidential].

237    It follows that the complaint that the applicant was not clearly informed of the conduct complained of and could not therefore be heard on that conduct must be dismissed.

238    In those circumstances, and in the second place, the applicant’s complaint that he did not have access to OLAF’s file or to the final report itself must also be dismissed.

239    First, with respect to access to OLAF’s file, it should be noted that OLAF is under no obligation to grant a person concerned by an external investigation access to the documents which are the subject of such an investigation or to those drawn up by OLAF itself for that purpose, since the effectiveness and confidentiality of the mission entrusted to OLAF and OLAF’s independence could be impeded. Respect of the applicant’s rights of defence was sufficiently guaranteed by the information he received (see, by analogy, order of 18 December 2003 in Gómez-Reino v Commission, T‑215/02, EU:T:2003:352, paragraph 65, and judgments of 12 September 2007 in Nikolaou v Commission, T‑259/03, not published, EU:T:2007:254, paragraph 241, and 8 July 2008 in Franchet and Byk v Commission, T‑48/05, EU:T:2008:257, paragraph 255) and by the fact that he was given the opportunity to state his views in the course of the interview.

240    Second, as regards access to the final report of an external investigation, no provision places such an obligation on OLAF. As regards the inter partes principle, the existence of an illegality on OLAF’s part can be established only where the final report is published or in so far as it is followed by the adoption of an act adversely affecting the person concerned (see, to that effect and by analogy, judgments of 12 September 2007 in Nikolaou v Commission, T‑259/03, not published, EU:T:2007:254, paragraphs 267 and 268, and 8 July 2008 in Franchet and Byk v Commission, T‑48/05, EU:T:2008:257, paragraph 259).

241    In so far as the persons to whom the final reports were addressed, namely the Commission and the Greek judicial authorities, intended to adopt such an act vis-à-vis the applicant on the basis of the final report, it is for those other authorities, where appropriate, and not for OLAF, to give the applicant access to that final report in accordance with their own procedural rules.

…

243    It follows that the Commission did not infringe the applicant’s rights of defence and, therefore, that the third plea must be dismissed.

 Damage and causal link

…

247    In that regard, it must be stated that the applicant has succeeded in establishing the infringement of Article 25(1) of Regulation No 45/2001 (see paragraphs 98 to 102 and 172 above). However, the applicant has not demonstrated the existence of any causal link between that infringement and the damage complained of. He has not submitted any argument making it possible to understand how, in the present case, late notification informing the data protection officer of the processing of personal data undermined his reputation and led him to cease his business activities and interrupt his academic activities. Nor did he explain how the late notification caused him any non-pecuniary loss. Accordingly, inasmuch as it is based on the above infringement, the claim for damages must be dismissed as unfounded.

248    In the light of the foregoing considerations, the claim for damages must be rejected as unfounded.

…

On those grounds,

THE GENERAL COURT (Fourth Chamber)

hereby:

1.      Dismisses the action;

2.      Orders Athanassios Oikonomopoulos to pay the costs, including those incurred in the proceedings for interim relief.

Prek Labucka Kreuschitz

Delivered in open court in Luxembourg on 20 July 2016.

[Signatures]

* Language of the case: English.

1      Only the paragraphs of the present judgment which the Court considers it appropriate to publish are reproduced here.

2      Redacted confidential information.