Action brought on 19 December 2023 – BW v Europol and Eurojust

(Case T-1180/23)

Language of the case: Dutch

Parties

Applicant: BW (represented by: J. Reisinger, lawyer)

Defendants: European Union Agency for Law Enforcement Cooperation (Europol) and European Union Agency for Law Enforcement Cooperation (Eurojust)

Form of order sought

The applicant claims that the General Court should:

declare null and void the acts of Europol and Eurojust in the establishment and implementation of the Agreement on the setting up of a joint investigation team Belgium – France – Netherlands of 13 December 2019 (‘the JIT Agreement’) and the collection, processing, analysis and sharing by those agencies of data originating from the cryptocommunication service ‘Sky ECC’ – whether or not on the basis of that agreement;

declare inapplicable the JIT Agreement and the associated acts of Europol and Eurojust;

award damages amounting to EUR 50 000 for the harm suffered by reason of the JIT Agreement and the associated acts;

order the defendants to pay the costs.

Pleas in law and main arguments

In support of the action, the applicant relies on four pleas in law.

First plea: illegality and disproportionality in the collection and processing of data/personal data. The applicant submits that, in the context of the collection and processing of the Sky ECC data, in particular due to the lack of necessity and proportionality in the carrying out of eavesdropping and ‘hacking’ practices on all Sky users, there was an infringement of Articles 18, 28 and 38, in conjunction with Articles 47 and 50, of Regulation 2016/794, Articles 9, 26 and 27 of Regulation 2018/1727 and Articles 71 and 72 of Regulation 2018/1725, as well as of fundamental provisions of EU law and international treaty law, in particular Articles 7, 8, 10 to 12, in conjunction with Articles 51 and 52, of the Charter of Fundamental Rights of the European Union, Article 8 of the European Convention on Human Rights (ECHR), and Article 17 of the International Covenant on Civil and Political Rights (ICCPR).

Second plea: the absence of a possibility of reviewing the usefulness of evidence originating from the Sky ECC operation and the absence of formal and substantive safeguards in the use of that evidence in criminal proceedings, which violated the applicant’s right to a fair criminal trial.

Third plea: double prosecution of the applicant and/or lack of optimal coordination with regard to the applicant’s criminal prosecution. Despite the intention to take coordinated action at EU and inter-State level, as evidenced by the JIT Agreement and relevant EU legislation, the applicant is being prosecuted in two different countries, namely in the Netherlands and in Serbia.

Fourth plea: lack of proper security in the collection and processing of Sky ECC data as required under the regulations cited by the applicant. To the extent that there can be fair and lawful collection and processing of personal data at all, such data – as also follows from Article 32 of Regulation 2016/794 and Article 92 of Regulation 2018/1725 – must be properly secured. According to the applicant, no such security was apparent in this case.

____________