JUDGMENT OF THE GENERAL COURT (Fifth Chamber)

11 July 2019 (*)⁽ⁱ⁾

[Text rectified by order of 18 December 2019]

(Non-contractual liability — Access to documents — Partial refusal of access — Sufficiently serious breach of a rule of law conferring rights on individuals — Regulations (EC) No 1049/2001 and No 45/2001 — Protection of personal data — Non-material damage — Material damage — Causal link)

In Case T‑838/16,

BP, represented by E. Lazar, lawyer,

applicant,

v

European Union Agency for Fundamental Rights (FRA), represented initially by C. Manolopoulos and M. O’Flaherty, then by M. O’Flaherty, acting as Agents, and by D. Waelbroeck, A. Duron and I. Antypas, lawyers,

defendant,

ACTION under Article 268 TFEU seeking compensation for the damage which the applicant allegedly suffered,

THE GENERAL COURT (Fifth Chamber),

composed of I. Labucka (Rapporteur), acting as President, A. Dittrich and I. Ulloa Rubio, Judges,

Registrar: E. Coulon,

gives the following

Judgment

I.      Background to the dispute

1        The applicant, BP, was recruited on 1 September 2007 by the European Union Agency for Fundamental Rights (FRA) as a member of the contract staff for a term of 2 years, as an assistant in the ‘Administration’ Department’s ‘Finance and Procurement’ team. Her contract was renewed for a period of 3 years, expiring on 31 August 2012.

2        By letter of 27 February 2012, the FRA Director in post at that time (‘the former FRA Director’) informed the applicant that he had taken a decision not to renew her contract on its expiry. That decision not to renew the contract was challenged by the applicant in Cases F‑38/12 and T‑658/13 P, BP v FRA. 

3        In 2013, the applicant submitted a complaint to the Court of Justice of the European Union against Mr T., in which she criticised him for a possible conflict of interests on account of the fact that he acted, in 2012 and 2013, in both the capacity of legal adviser to FRA and temporary judge of the European Union Civil Service Tribunal (‘the complaint submitted to the Court of Justice’).

4        In October 2013, FRA provided the Court of Justice of the European Union with information concerning the activities performed by Mr T. 

5        On 5 March 2014, a former colleague of the applicant (‘the former colleague’) forwarded to her, from his private email address, a number of emails received from another colleague.

6        Those emails referred, first, to an exchange of correspondence between that other colleague and Mr T.

7        The same emails also referred to an exchange between the Head of the ‘Human Resources and Planning’ Department (‘the Head of the Human Resources Department’) and that other colleague.

8        By email of 7 April 2014, the applicant informed the former FRA Director of the fact that certain emails threatening criminal proceedings against her were circulating within FRA, and requested access to those emails under Article 6 of Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ 2001 L 145, p. 43), read in conjunction with Article 13 of Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ 2001 L 8, p. 1).

9        By email of 16 April 2014, the former FRA Director rejected the allegations made by the applicant in her email of 7 April 2014, and provided clarifications concerning the context in which the statements were made by the Head of the Human Resources Department.

10      By separate emails of the same date, the applicant asked the former FRA Director and the Head of the Human Resources Department how Mr T. had become aware of her home address and whether FRA had given, to him or another person, a copy of her complaint to the Court of Justice of the European Union.

11      By email of 18 April 2014, the Head of the Human Resources Department enquired as to how the applicant had become aware of the fact that Mr T. knew her home address and why she believed that information had come from FRA. 

12      On the same day, the applicant asked the Head of the Human Resources Department to reply to her email of 16 April 2014.

13      On 7 May 2014, in response to the applicant’s emails of 16 and 18 April 2014, the Head of the Human Resources Department stated that FRA had neither disclosed her address to Mr T., nor received a copy of the complaint made to the Court.

14      By email of 9 October 2014, the former colleague sent to the applicant, from his private email address, a list of all the payments made by FRA to Mr T., in his capacity as legal adviser, between February and September 2013 (‘the list of payments’).

15      The list of payments had been sent beforehand by another colleague to the former colleague (‘the first leak’).

16      On 26 November 2014, the applicant submitted a request for access to documents, on the basis of Article 6 of Regulation No 1049/2001, seeking (i) the emails and documents disclosed by FRA to Mr T. over the period from 1 January 2014 until the date of the request; (ii) the ‘minutes of FRA meetings organised for this purpose in November 2014 (collecting emails from FRA staff in order to hand over to Mr T.)’; and (iii) information ‘revealing if the Requester asked access to FRA’s staff emails in his quality as private person, lawyer or Judge at Administrative Tribunal for Employment Matters (ESMAT)’.

17      By letter of 17 December 2014, FRA replied to the applicant’s request, identifying two documents, namely an email and the minutes of an internal meeting. The email, after consultation with third parties, was disclosed expunged of personal data. The minutes, however, were not disclosed pursuant to the exception under the second subparagraph of Article 4(3) of Regulation No 1049/2001. The same position was reiterated in response to the confirmatory application made by the applicant.

18      By email of 14 February 2015, sent to the former Director, the Head of Administration and the Chairperson of the Staff Committee, the applicant made a further request for access to documents, on the basis of Regulation No 2049/2001, seeking, in particular, disclosure of all payments made by FRA to Mr T.

19      The applicant annexed to her request the email which the former colleague had sent to her on 9 October 2014, together with the list of payments (‘the documents annexed to the request for access to documents’).

20      On 17 February 2015, the applicant made a further request for access to documents concerning the purchase orders relating to the services provided by Mr T., in particular those connected to her cases, and FRA’s response to the letter from the Registrar of the Court of Justice.

21      On 24 March 2015, FRA denied the applicant access to the documents requested, on the grounds that (i) those documents came within the exception referred to in Article 4(2) of Regulation No 1049/2001 and (ii) those documents contained personal data and a redacted version would be meaningless.

22      FRA also stated that Mr T. had never worked on the cases identified in the applicant’s request, and that the payments received by Mr T. did not relate to her cases.

23      As to the applicant’s additional request, FRA justified its refusal to grant access to documents by the fact that they related to ongoing proceedings.

24      On 13 April 2015, the applicant submitted a confirmatory application for access to the documents.

25      On 13 May 2015, the online newspaper Politico published an article in its ‘Brussels Influence’ section, in which reference was made to the complaint to the Court of Justice of the European Union.

26      On 29 May 2015, FRA rejected the applicant’s confirmatory application, noting that the applicant had made further requests for access in that application. In order to deal with those further requests appropriately, FRA invited her to a meeting.

27      On 1 June 2015, the applicant sent an email to FRA’s Interim Director and its Senior Legal Advisor, challenging FRA’s response to her confirmatory application.

28      On 16 July 2015, the European Ombudsman received a complaint from the applicant concerning FRA’s refusal to grant her full access to certain documents relating to Mr T., namely FRA’s response to the Court of Justice of the European Union. That response was ultimately disclosed by FRA in order to reach an amicable solution with the applicant.

29      By its judgment of 3 June 2015, BP v FRA (T‑658/13 P, EU:T:2015:356), the General Court annulled the decision of 27 February 2012 whereby the FRA Director in post at the relevant time had decided not to renew the applicant’s contract as a member of the contract staff.

30      The General Court, in essence, held that, contrary to the finding of the Civil Service Tribunal, the applicant’s right to be heard had not been respected, and dismissed the action as to the remainder.

31      By letter of 28 July 2015, FRA’s external legal counsel contacted the applicant in respect of the implementation of the judgment of 3 June 2015, BP v FRA (T‑658/13 P, EU:T:2015:356).

32      On 14 September 2015, in accordance with the provisions of Regulation No 1049/2001, FRA sought the applicant’s consent, in the context of a request for access to documents made by a third party on 6 August 2015 (‘the request for access to documents made by a third party’), to the disclosure of her personal data and documents originating from her.

33      The request for access to documents made by a third party concerned, in essence, any document received by FRA, in whatever form, mentioning the name of the applicant and sent by former FRA members of staff.

34      That request covered, inter alia, according to the documents identified by FRA, the documents annexed to the request for access to documents and FRA’s responses to the applicant’s emails.

35      On 15 September 2015, the applicant replied, requesting a copy of the request as well as the identity of the requestor.

36      By email of 30 September 2015, FRA (i) informed the applicant that the requestor was opposed to the disclosure of both their request and identity and (ii) asked the applicant for a response as to whether or not she consented to the disclosure of her personal data and documents originating from her, and, if that response were in the negative, to state the reasons for her refusal within 5 working days.

37      On 3 October 2015, the applicant opposed the disclosure of her personal data and the documents which she had provided, stating reasons for her refusal.

38      On 28 October 2015, FRA once again consulted the applicant. FRA informed her that, in accordance with her refusal of 3 October 2015, the documents had not been disclosed. However, given that the request for access to documents made by a third party had reached the confirmatory stage, FRA was required to reassess its initial decision.

39      FRA requested additional information from the applicant. FRA also informed her that four new documents had been identified and asked her to indicate whether she consented or opposed the disclosure of those new documents. In that same letter, FRA, referring to the confirmatory application, asked the applicant to specify more fully the reasons why she opposed the disclosure of the emails in order to enable it to reassess the request.

40      On 2 November 2015, the applicant again asked to be informed of the identity of the requestor, in order to reassess her position, and requested clarification as to the reasons why additional documents had been referred to in the confirmatory application. On the same date, the applicant opposed the disclosure of the documents.

41      On 18 December 2015, the new FRA Director heard the applicant at a meeting in Vienna (Austria).

42      On 26 February 2016, Mr T. [confidential] (1).

43      In support of his complaint, Mr T. produced, as incriminating evidence, the documents annexed to the request for access to documents.

44      On 4 April 2016, the new FRA Director adopted the decision not to renew the applicant’s contract.

45      On 19 April 2016, an article was published by the newspaper Politico, following an interview with the new FRA Director (‘the interview’).

46      On 11 May 2016, the applicant asked the new FRA Director whether the documents identified by FRA in the context of the consultations which took place on 14 September and 28 October 2015 had been disclosed and, if so, what the legal basis and the purpose of that disclosure were. She also requested access to the documents disclosed and, in particular, the documents containing a risk assessment conducted by FRA prior to the disclosure of her personal data, as well as information concerning the processing of her personal data.

47      On the same date, the applicant lodged a complaint with the European Data Protection Supervisor (EDPS), claiming that FRA had disclosed documents without her consent and without notifying her of its intention to disclose them.

48      On 18 May 2016, the applicant lodged a complaint, within the meaning of Article 90(2) of the Staff Regulations of Officials of the European Union, seeking (i) the withdrawal of the decision not to renew her contract; (ii) her reinstatement to her previous position; and (iii) compensation for non-material damage.

49      On 8 June 2016, the applicant was informed, in an email originating from [confidential] that [confidential]. Since the [confidential] had been notified that the applicant no longer resided in Spain, she was asked whether she agreed to the [confidential] sending her the documents by email.

50      On 13 June 2016, the applicant sent an email to the new FRA Director, in which she opposed, on the basis of Article 18 of Regulation No 45/2001, the use by FRA of her private correspondence, to which she appended emails from Mr T. which contained her name. She also requested that FRA immediately block the use of her data, inform her of the identity of third parties who had accessed her data thus far, grant her the right to rectify inaccurate or incomplete data, and delete all of her personal data which was not accurate or had been processed unlawfully.

51      On the same date, FRA replied to the applicant, stating that it had not disclosed her documents and that, in accordance with Regulation No 1049/2001, only FRA’s replies to her emails, expunged of personal data, had been disclosed (‘FRA’s replies to the applicant’).

52      FRA also informed the applicant that the requests relating to the processing of her personal data would be handled separately by FRA’s Data Protection Officer.

53      On 20 June 2016, the applicant asked FRA to block the use of her personal data.

54      By letter of 24 June 2016, first, FRA informed the applicant that her personal data had been processed as part of her request for access to documents and in the context of the administrative inquiry opened following the first leak. Secondly, FRA denied disclosing her personal data or her home address to [confidential]. Thirdly, FRA claimed that, except for the investigators in charge of the administrative inquiry, it had not transferred her personal data to any other party. Fourthly, FRA informed the applicant that it was not possible to block her personal data, as an inquiry was ongoing.

55      On 4 July 2016, the applicant sent a letter to the new FRA Director enquiring, first of all, as to why she had not been notified of the transmission of her personal data to the investigators, which documents FRA had redacted her personal data from, and which leak FRA was referring to.

56      By the same letter, first, the applicant requested that the relevant notices, information and documents be sent to her, in accordance with the provisions of Regulation No 45/2001. Secondly, she stated that her private email address had been disclosed by FRA, since the email contained FRA’s disclaimer.

57      She also asked whether FRA had communicated other documents containing her personal data and what legal basis allowed the disclosure of those documents.

58      Lastly, she asked which criminal offences FRA was referring to when it mentioned Article 20(1)(a) of Regulation No 45/2001.

59      By letter of 6 July 2016, the new FRA Director replied to the applicant, stating that FRA had acted in compliance with the relevant legislation and that she could submit her concerns to the Ombudsman, the EDPS and the Courts of the European Union.

60      On 10 July 2016, the applicant sent an email to the new FRA Director, in which she claimed that the reply which she had received from FRA’s Data Protection Officer was insufficient, given that only the Director could commit FRA. She also stated that the reply was incomplete, as it did not contain any reference to the disclosure by FRA of her request for access to documents to the European Anti-Fraud Office (OLAF), as the latter had informed her.

61      By letter of 15 July 2016, the new FRA Director endorsed the reply given by FRA’s Data Protection Officer and stated that (i) following the applicant’s email, FRA had double-checked certain details and established that her personal data had been sent to OLAF on 17 March 2015, in accordance with Article 2.2 of Executive Board Decision 2013/01 of 22 May 2013 and (ii) the disclosure related to her name, email address and emails concerning her request for access to documents.

62      By letter of 22 August 2016, FRA replied to a request for access to documents made by the applicant on 11 July 2016, informing her that FRA refused to disclose the emails requested, as they contained information of commercial interest and were part of court proceedings. It did, however, grant the applicant access to various documents expunged of personal data, namely award decisions, purchase orders and information relating to legal services.

63      On 24 August 2016, the applicant made a confirmatory application seeking access to the documents which FRA was refusing to disclose.

64      By email of 26 August 2016, the applicant explained to the new FRA Director why she required full disclosure of the documents.

65      On 8 September 2016, the applicant submitted a request for access to documents to the Internal Audit Service, seeking, in particular, access to the final audit report on human resources management within FRA, the final report of the limited review of contract management within FRA, and the Internal Audit Service’s follow-ups on outstanding recommendations from the audit of human resources management within FRA (2013) and on outstanding recommendations from the limited review of contract management.

66      On 12 September 2016, the applicant sent an email to the new FRA Director, in relation to the interview, asking him, inter alia, whether FRA had assisted [confidential].

67      On 13 September 2016, the applicant sent an email to the new FRA Director, asking for clarification concerning the criminal offences which precluded the blocking of her personal data.

68      On 28 September 2016, the applicant submitted a request for access to documents to the Internal Audit Service seeking, in particular, access to the final audit report on public procurement within FRA (2012), which was granted to her.

69      On 12 October 2016, the Ombudsman received a complaint from the applicant concerning FRA’s refusal to disclose fully the subject of several contracts relating to the provision of legal services.

II.    Procedure and forms of order sought

70      By application lodged at the Court Registry on 30 November 2016, the applicant brought the present action.

71      By letter lodged at the Court Registry on the same day, the applicant submitted an application for anonymity, which the Court granted by decision of 10 February 2017.

72      By letter lodged at the Court Registry on 30 November 2016, the applicant lodged a request for the examination of witnesses. FRA lodged its observations within the time limit prescribed and expressed the view that an examination of witnesses was not necessary.

73      By letter lodged at the Court Registry on 23 December 2016, the applicant requested that certain information be treated as confidential vis-a-vis the public.

74      On 30 March 2017, the President of the Fifth Chamber of the General Court decided, after hearing the parties, not to join the present case with Cases T‑888/16 and T‑917/16, BP v FRA.

75      As the President of the Fifth Chamber of the General Court was unable to sit, he designated another Judge to replace him and complete the Chamber, pursuant to Article 17(2) of the Rules of Procedure of the General Court.

76      As the Judge Rapporteur was unable to sit, the President of the General Court reallocated the case to another Judge Rapporteur and designated another Judge to complete the Chamber.

77      By letter lodged at the Court Registry on 15 June 2017, the applicant submitted further offers of evidence, pursuant to Article 85(3) of the Rules of Procedure. FRA submitted its observations on that evidence within the time limit prescribed and contended that that evidence was inadmissible and unfounded in its entirety.

78      By letter lodged at the Court Registry on 6 July 2017, the applicant requested measures of organisation of procedure and submitted further offers of evidence, pursuant to Article 85(3) of the Rules of Procedure. FRA submitted its observations on that request and that evidence within the time limit prescribed, and expressed the view that they were wholly inadmissible.

79      By letter lodged at the Court Registry on 11 July 2017, the applicant made an application to introduce a new plea in law. FRA lodged its observations within the time limit prescribed and took the view that the introduction of such a plea was inadmissible and, in any case, unfounded.

80      By letters lodged at the Court Registry on 4 and 28 September and 30 October 2017, and on 7 and 30 January 2018, the applicant submitted further offers of evidence, pursuant to Article 85(3) of the Rules of Procedure.

81      By letter lodged at the Court Registry on 5 February 2018, the applicant submitted further evidence. FRA submitted its observations on that evidence within the time limit prescribed and contended that that evidence was inadmissible and unfounded in its entirety.

82      By letter of 24 April 2018, the Court, by way of measures of organisation of procedure, asked the parties to produce certain documents. The parties complied with that request within the time limit prescribed.

83      By letter lodged at the Court Registry on 24 May 2018, the applicant submitted further offers of evidence, pursuant to Article 85(3) of the Rules of Procedure. FRA submitted its observations on that evidence within the time limit prescribed and contended that that evidence was inadmissible and unfounded in its entirety.

84      By letter of 6 June 2018, the Court, by way of measures of organisation of procedure, asked FRA to produce a document. FRA complied with that request within the time limit prescribed.

85      By letter lodged at the Court Registry on 12 June 2018, the applicant submitted further offers of evidence, pursuant to Article 85(3) of the Rules of Procedure. FRA submitted its observations on that evidence within the time limit prescribed and contended that that evidence was inadmissible and unfounded in its entirety.

86      By letter lodged at the Court Registry on 28 June 2018, the applicant submitted further offers of evidence, pursuant to Article 85(3) of the Rules of Procedure. On 7 August 2018, FRA submitted its observations on that offer of evidence, pleading that it was inadmissible.

87      By letter lodged at the Court Registry on 13 July 2018, the applicant requested the adoption of a measure of inquiry, pursuant to Article 88(1) of the Rules of Procedure. On 10 August 2018, FRA submitted its observations on that request and invited the Court to reject it as unfounded.

88      The Court (Fifth Chamber) decided, pursuant to Article 106(3) of the Rules of Procedure, to rule on the action without an oral part of the procedure.

89      The applicant claims that the Court should:

–        order FRA to pay compensation to the applicant for the damage suffered by awarding damages, together with default interest at the European Central Bank (ECB) reference rate, increased by two percentage points on the amount actually awarded, or to pay any other interest which the Court deems just and appropriate;

–        order FRA to pay the costs.

90      FRA contends that the Court should:

–        declare the action inadmissible in part;

–        dismiss the action in its entirety;

–        order the applicant to pay the costs, including those incurred in dealing with the applications seeking to submit additional evidence, to introduce a new plea in law and the adoption of measures of organisation of procedure.

III. Law

91      In its defence, FRA contends that the claim for compensation is inadmissible in part.

92      Moreover, in the proceedings before the General Court, the applicant has made applications seeking to introduce a new plea in law, the adoption of measures of organisation of procedure, and to submit offers of evidence, which FRA also claims are inadmissible.

A.      Admissibility

1.      The claim for compensation

93      FRA contends, first of all, that the form of order seeking compensation for the damage suffered on account of irregularities in the course of the implementation of the judgment of 3 June 2015, BP v FRA, (T‑658/13 P, EU:T:2015:356), is inadmissible, in that it is not related to the provisions on which the action is based, namely Article 268 TFEU read in conjunction with Article 32 of Regulation No 45/2001.

94      Secondly, FRA argues that the same contention justifies its claim that the form of order seeking compensation for the damage suffered on account of a breach of Article 11 of the Charter of Fundamental Rights of the European Union (‘the Charter’), read in conjunction with Article 22(a)(2) of the Staff Regulations and FRA rules on whistleblowing as well as the facts relating thereto, should be rejected as inadmissible.

95      Lastly, FRA points out that certain annexes to the application (i) are irrelevant to the present case, in that they concern [confidential], in respect of which the General Court does not have jurisdiction and (ii) do not comply with the provisions of the Rules of Procedure, in that they contain numerous observations and notes, whereby the applicant puts forward additional arguments.

96      For her part, the applicant maintains that the action is admissible in its entirety.

97      First, whilst the body of the application may be supported and supplemented on specific points by references to extracts from documents annexed to it, a general reference to other documents, even those annexed to the application, cannot compensate for the absence of the essential arguments in law, which must appear in the application. The annexes cannot therefore serve as a basis for developing a plea set out in summary form in the application by putting forward complaints or arguments which are not contained therein (see, to that effect, judgment of 5 December 2006, Angelidis v Parliament, T‑416/03, EU:T:2006:375, paragraphs 92 and 93).

98      The Court therefore cannot, in the present case, rule on the observations and notes that the applicant has submitted in most of the annexes to her written pleadings.

99      As regards, more specifically, the admissibility of the action, it should be recalled that, pursuant to the first paragraph of Article 21, of the Statute of the Court of Justice of the European Union, which applies to the proceedings before the General Court in accordance with the first paragraph of Article 53 of the Statute, and Article 76(d) of the Rules of Procedure, the application must, in particular, contain the subject matter of the dispute and a summary of the pleas in law relied on. Those particulars must be sufficiently clear and precise to enable the defendant to prepare its defence and the Court to rule on the action, if necessary without any other supporting information. In order to guarantee legal certainty and sound administration of justice, it is necessary, in order for an action to be admissible, that the basic legal and factual particulars relied on be indicated, at least in summary form, coherently and intelligibly, in the application itself (see order of 14 March 2017, Todorov v Court of Justice of the European Union, T‑839/16, not published, EU:T:2017:194, paragraph 5 and the case-law cited).

100    In order to satisfy those requirements, an application seeking compensation for damage allegedly caused by an EU institution must state the evidence from which the conduct alleged against the institution may be identified, the reasons why the applicant considers that a causal link exists between that conduct and the damage which he claims to have suffered, and the nature and extent of that damage. A claim for any unspecified form of damages, however, is not sufficiently precise and must therefore be regarded as inadmissible (see judgment of 12 April 2013, Du Pont de Nemours (France) and Others v Commission, T‑31/07, not published, EU:T:2013:167, paragraph 112 and the case-law cited).

101    In the present case, it is clear from the application that the applicant seeks compensation for the damage which she allegedly suffered as a result of FRA’s conduct, which she claims is unlawful, in the light of the rules of law conferring rights on an individual, including the provisions intended to ensure respect for the applicant’s personal data. She also sets out the reasons why she considers that there is a causal link between the allegedly unlawful conduct and the damage which she claims to have suffered, with the effect that the action must be found to be admissible.

102    FRA’s arguments cannot call that finding into question.

103    First, the action brought by the applicant does not contain multiple heads of claim, as FRA appears to contend, but rather a single head of claim seeking compensation for the damage suffered as a result of FRA’s allegedly unlawful conduct.

104    Secondly, the fact that any of the facts mentioned in the application or the annexes lodged in support of the action may not be relevant cannot entail the inadmissibility, even in part, of the action.

105    Thirdly, the bringing of the action under Article 268 TFEU, read in conjunction with Article 32(1) of Regulation No 45/2001, cannot confine the applicant to seeking compensation solely for damage arising from an infringement of the provisions of that regulation.

106    Article 32(1) of Regulation No 45/2001 pursues a single objective, namely that of confirming the jurisdiction of the Court of Justice of the European Union to hear actions for compensation brought in the event of infringement of the provisions of that regulation.

107    Accordingly, the action is admissible in its entirety.

2.      The application to introduce a new plea in law

108    By document lodged at the Court Registry on 11 July 2017, the applicant made an application, under Article 84(1) of the Rules of Procedure, to introduce a new plea in law.

109    The applicant criticises FRA for its ‘alleged complicity [confidential]’, in breach of Article 54 of the Charter, the FEU Treaty and Regulation Nos 45/2001 and 1049/2001.

110    FRA takes the view that the application to introduce a new plea in law is inadmissible.

111    Under Article 84(1) of the Rules of Procedure, no new plea in law may be introduced in the course of proceedings unless it is based on matters of law or of fact which have come to light in the course of the procedure.

112    In accordance with Article 84(2) of the same rules, where appropriate, new pleas in law are to be introduced in the second exchange of pleadings and identified as such. Where the matters of law or of fact justifying the introduction of new pleas in law are known after the second exchange of pleadings or after it has been decided not to authorise a second exchange of pleadings, the main party concerned is to introduce the new pleas in law as soon as those matters come to his knowledge.

113    In the present case, the applicant argues, in order to justify the delay in introducing that new plea, that the matter of fact which she considers to have given rise to her application was revealed only on 11 May and 30 June 2017 when she (i) obtained a copy of the file [confidential]; and (ii) received FRA’s rejoinder and annexes thereto.

114    In the first place, while the applicant admittedly refers to the disclosure of the file [confidential] on 11 May 2017, she has failed to submit any evidence that the file was disclosed on that date. At most, she confines herself to stating that the file was disclosed to her, on that date, by a [confidential] lawyer.

115    In the second place, first, it is apparent from the file in the present case that the applicant had been informed [confidential].

116    Second, the applicant had, at the very least, become aware, on 12 December 2016, [confidential].

117    Third, even assuming that the file [confidential] was, as the applicant claims, communicated to her on 11 May 2017, the application to introduce a new plea in law was lodged late, namely on 11 July 2017, more than 2 months after that disclosure. The notification of the rejoinder on 30 June 2017 cannot call that finding into question, as the new plea in law is based almost exclusively on the annexes to the file [confidential].

118    Accordingly, the application to introduce a new plea in law must be dismissed as inadmissible, as it was submitted late.

3.      The application for the adoption of a measure of organisation of procedure

119    By document lodged with the Court Registry on 6 July 2017, the applicant requested that the General Court adopt a measure of organisation of procedure, pursuant to Articles 88 to 90 of the Rules of Procedure.

120    She claims, first, that the facts justifying the adoption of a measure of organisation of procedure emerged only recently, namely on 11 May and 30 June 2017, with the effect that the present request cannot be regarded as late.

121    She states, secondly, that the adoption of a measure of organisation of procedure would serve to (i) check whether a fresh leak of her personal data is to be imputed to FRA; (ii) establish whether FRA officials acted in the performance of their duties or in a private capacity; and (iii) clarify FRA’s position with regard to an annex to the rejoinder.

122    FRA takes the view that the request for measures of organisation of procedure must be rejected as inadmissible.

123    In that connection, in accordance with Article 89 of the Rules of Procedure, the purpose of measures of organisation of procedure is to ensure that cases are prepared for hearing, procedures carried out and disputes resolved under the best possible conditions. Measures of inquiry under Article 91 of the Rules of Procedure are intended to allow proof of the truth of the factual allegations made by a party in support of its case to be adduced.

124    There is no need to order a measure of organisation of procedure or of inquiry suggested by an applicant where its purpose is not to clarify the plea the applicant raised or to prove that its factual submissions are accurate, but rather appears to be an attempt to obtain new evidence in support of its action, unless the applicant raises specific complaints which can be checked or clarified by a request for information or for specific documents (judgment of 8 November 2000, Bareyt and Others v Commission, T‑175/97, EU:T:2000:259, paragraphs 89 to 91).

125    If such a request is made at a stage in the procedure when the production of new evidence is, in principle, no longer allowed, it is necessary in particular for the party requesting those measures to set out the reasons why the request could not have been made earlier (judgment of 18 January 2005, Entorn v Commission, T‑141/01, EU:T:2005:10, paragraph 132).

126    In the present case, the request for measures of organisation of procedure is based on the same matters of facts which led the applicant to make an application to introduce a new plea in law.

127    Thus, for the reasons set out in paragraphs 114 to 118 of the present judgment, the application for the adoption of measures of organisation of procedure must also be rejected as inadmissible, as it was submitted late.

4.      The offers of evidence

128    The applicant submitted further offers of evidence, in accordance with Article 85(3) of the Rules of Procedure, on 12 occasions.

129    FRA contends, for its part, that the applications seeking to offer further evidence must be declared inadmissible.

(a)    Preliminary observations

130    It should be recalled that Article 85 of the Rules of Procedure governs the lodging of evidence and offers of evidence by the main parties during the judicial proceedings.

131    It provides for the stages at which evidence and offers of evidence are possible by distinguishing between the first exchange of pleadings, the second exchange of pleadings and the final stage, up to which point it is still possible for a main party to submit evidence or make offers of evidence, that being no longer permitted after the end of the oral part of the procedure, without prejudice to the possibility of requesting that the oral procedure be reopened, provided for in Article 113(2)(c) of the Rules of Procedure.

132    Whilst highlighting the exceptional nature of situations in which evidence or offers of evidence may be put forward, Article 85 of the Rules of Procedure makes them subject to an express obligation to state the reasons for the delay in offering that evidence, as required by settled case-law (judgments of 17 December 1998, Baustahlgewebe v Commission, C‑185/95 P, EU:C:1998:608, paragraph 71, and of 14 April 2005, Gaki-Kakouri v Court of Justice, C‑243/04 P, not published, EU:C:2005:238, paragraph 33).

133    Furthermore, while the action is admittedly admissible in its entirety, the fact remains that, in the application, the applicant supports her claim for compensation only in so far as concerns the damage suffered as a result of the unlawful processing of her personal data by FRA. 

134    The offers of evidence will therefore be assessed only in so far as the applicant claims that FRA was responsible for a personal data breach in that context.

(b)    The first offer of evidence

135    By submitting the first offer of evidence, on 15 June 2017, the applicant sought leave to add five documents to the case file, in respect of which she asserts that (i) they are part of ‘a new case file to which FRA transmitted and/or leaked several documents containing her personal data’, of which she became aware on 11 May 2017, and which had allegedly been ‘used before [confidential] in order to make harm on her’; and (ii) they establish alleged breaches of data protection rules by FRA:

–        the email sent by the applicant to FRA on 16 April 2014 [confidential];

–        the letter of 16 April 2015 from FRA to the applicant in response to her request for access to documents [confidential];

–        the email of 29 November 2013 obtained by the applicant under Regulation No 1049/2001;

–        the email of 25 November 2013 sent by FRA’s policy advisor to Mr T. [confidential];

–        the email of 2 December 2013 sent by FRA’s Director of Human Resources to Mr T. [confidential].

136    As a preliminary point, with regard to the email of 25 November 2013 sent by FRA’s policy advisor to Mr T., it is important to  observe that the document attached to that email was not legible and that, following a request for regularisation, the applicant failed to lodge a new, legible version of the document.

137    The application to submit that document must therefore be rejected as inadmissible.

138    As to the annexes to the file [confidential], they concern [confidential]. The applicant justifies the late lodging of those annexes by the fact that she received the file [confidential] on 11 May 2017.

139    In the same way as for the assessment of the admissibility of the application to introduce a new plea in law, the applicant merely submits that she came into possession of that file on 11 May 2017, without adducing any concrete evidence in support of her claim, even though the applicant was, at the very least, aware [confidential] in December 2016.

140    It must therefore be held that the offer of evidence relating to the letter of 16 April 2015 and the emails of 16 April 2014 and 2 December 2013 is inadmissible.

141    The same finding must be made with regard to the email of 29 November 2013. The applicant states that she is submitting an email dated 29 November 2013, obtained under Regulation No 1049/2001.

142    However, the annex including that email contains, in fact, two emails, dated 29 October 2013. Secondly, irrespective of whether or not that email is in the file [confidential], the applicant herself states that that document was obtained in the context of requests for access to documents, which are, as is apparent from the file in the present case, dated 26 November 2014 and 14 February 2015.

143    Consequently, in the circumstances of the case, the email of 29 November 2013 was submitted late.

(c)    The second offer of evidence

144    In her application for the adoption of measures of organisation of procedure dated 6 July 2017, which also comprises, in essence, the submission of a second offer of evidence, the applicant sought leave to add seven documents to the file, [confidential]:

–        the application of 11 December 2013;

–        the invoice of 28 November 2013 paid by FRA to Mr T. for services relating to ‘Strategies for defamatory acts’;

–        the letter of the Council of the European Union of 9 July 2014 and the email of the Court of Justice of the European Union of 31 October 2014;

–        the applicant’s appraisal report of 9 March 2017 for 2016 at [body X];

–        FRA’s letter of 4 October 2013 to the Registry of the Court of Justice;

–        the statement of FRA’s external legal counsel dated 28 October 2013 and an invoice relating to legal services provided by Mr T. in respect of the follow-up on the judgment of 18 September 2012, Allgeier v FRA (F‑58/10, EU:F:2012:130);

–        the document concerning legal services provided in 2012 in respect of a reassignment.

145    In that connection, in so far as concerns the evidence offered in relation to [confidential], that offer must be rejected as inadmissible for the reasons set out in paragraphs 138 to 140 of the present judgment. The same applies to FRA’s letter of 4 October 2013 to the Registry of the Court of Justice and the statement of FRA’s external legal counsel dated 28 October 2013, inasmuch as those documents are included, according to the applicant, in the file [confidential].

146    Moreover, the applicant merely submits, belatedly, documents which belong to her, namely the Council’s letter of 9 July 2014 and the email of the Court of Justice of the European Union dated 31 October 2014.

147    Similarly, she fails to offer any justification for the late submission of other documents, namely the document concerning legal services provided in 2012 in respect of a reassignment and the invoices of 28 November 2013 and 26 October 2012 paid by FRA to Mr T. in respect of services relating to ‘Strategies in defamatory acts’ and the study concerning the follow-up to the judgment of 18 September 2012, Allgeier v FRA (F‑58/10, EU:F:2012:130).

148    In any event, the late discovery of the alleged relevance of those documents cannot call that finding into question.

149    Consequently, the evidence offered in relation to those documents must be rejected as inadmissible.

150    In so far as concerns the applicant’s appraisal report at [body X] of 9 March 2017 for the year 2016, it should be noted that, while the latter document is admittedly contemporaneous with the offer of evidence, the fact remains that it was submitted nearly 5 months after the report was drawn up.

151    The applicant fails to provide any explanation as to the late submission of that report, except to claim that the relevance of the submission of that document emerged during the judicial proceedings.

152    Consequently, the application to produce that report must be rejected as inadmissible.

(d)    The third offer of evidence

153    By the submission of the third offer of evidence, on 4 September 2017, the applicant sought leave to add the following 4 documents to the case file:

–        the letter from OLAF dated 30 August 2017, disclosed to the applicant on 31 August 2017;

–        the email sent by the applicant on 6 January 2016 to the FRA Director and the attachment to that email;

–        the complaint lodged on 26 November 2009 by Mr F. (FRA Data Protection Officer, head of the IT Department and head of the team responsible for access to FRA documents);

–        FRA’s letter of 22 March 2017 to the Ombudsman, requesting that the applicant’s complaint concerning FRA’s refusal to grant her access to documents be rejected.

154    In that connection, it should be noted that both OLAF’s letter of 30 August 2017 and FRA’s letter of 22 March 2017 are irrelevant in the light of the claim for compensation made in the application. Those documents relate to (i) an OLAF investigation into alleged irregularities in the Agency’s public procurement; and (ii) FRA’s response to the Ombudsman regarding a complaint made by the applicant concerning FRA’s refusal to disclose the contracts concluded between FRA and its legal advisors. The same applies to the email of 6 January 2016 and the complaint of 26 November 2009, which relate to the alleged irregularities in public procurement at FRA. 

155    Consequently, that evidence will not be taken into account by the Court, inasmuch as the applicant cannot rely on it to any purposes in connection with her claim for compensation.

(e)    The fourth offer of evidence

156    By the submission of the fourth offer of evidence, on 28 September 2017, the applicant sought leave to add the following six documents to the case file:

–        Annex D.1 to FRA’s rejoinder in Case T‑888/16, relevant to Case T‑838/16 ‘HT list of contracts signed in the period 2012-2016’;

–        the invoice for legal services rendered further to purchase order (PO) 2013-68 ‘Strategies for defamatory acts’;

–        the email of 1 September 2017 concerning the undertaking given [confidential];

–        the documents concerning legal costs incurred by the applicant [confidential];

–        the Ombudsman’s Inspection Report of 17 December 2015 concerning purchase orders for Mr T.’s services;

–        FRA’s payments to Mr T. for work allegedly carried out on the reform of the Data Protection Regulation.

157    In that regard, account will not be taken of Annex D.1 to the rejoinder lodged by FRA in Case T‑888/16, BP v FRA; FRA’s invoice for legal services, which is, moreover, identical to the document submitted by the applicant as part of her second offer of evidence; the Ombudsman’s investigation report; and FRA’s payments to Mr T. in respect of a report on data protection, as those documents are not sufficiently directly connected to the claim for compensation made in the application.

158    However, whilst it is admittedly not a question, in the present case, of examining the dispute between the applicant and Mr T., or any of the claims connected thereto, the fact remains that, in her application, the applicant stated that she would have to set out at a later date the material damage suffered, which, at the time the application was lodged, resulted, inter alia, [confidential].

159    The Court therefore finds that the email of 1 September 2017 and the documents concerning the legal costs incurred by the applicant in [confidential] are admissible.

(f)    The fifth offer of evidence

160    By the submission of the fifth offer of evidence, on 30 October 2017, the applicant sought leave to add the following 3 documents to the case file:

–        medical documents for the period from 28 August 2017 to 12 October 2017;

–        FRA’s letters of 26 and 29 September 2017;

–        the email from the Court of Justice of the European Union of 6 October 2017 and the two annexes thereto.

161    In that connection, it should be noted that FRA’s letters of 26 and 29 September 2017 and the email from the Court of Justice of the European Union of 6 October 2017 are not sufficiently directly connected to the claim for compensation made in the application, with the effect that the application to submit those documents must be rejected.

162    However, the same does not apply to the medical documents, inasmuch as they are (i) contemporaneous with the fifth offer of evidence and (ii) intended, at the very least, to clarify the scale of the material and non-material damage suffered by the applicant.

163    Consequently, the application to submit the medical documents is admissible.

(g)    The sixth offer of evidence

164    By the submission of the sixth offer of evidence, on 7 January 2018, the applicant sought leave to add the following 5 documents to the case file:

–        [confidential];

–        the email from the applicant’s lawyer of 27 December 2017 concerning [confidential];

–        the correspondence from the European Commission of 23 May 2013;

–        documents to rebut the statement of FRA’s external legal counsel;

–        the email from the Court of Justice of the European Union of 4 January 2018 and the applicant’s email of 3 April 2018.

165    In that connection, the applications to submit the [confidential], the email of 27 December 2017 from the lawyer [confidential] and the email from the Court of Justice of the European Union of 4 January 2018 must be rejected as inadmissible, in so far as those documents are not sufficiently directly connected to the claim for compensation made in the application, irrespective of the determination of the date on which the applicant obtained a certified translation [confidential].

166    Moreover, it is clear that those documents are connected, in essence, to the application to introduce a new plea in law, which was rejected in paragraph 118 of the present judgment as inadmissible.

167    So far as concerns the other evidence submitted, while it is not intended, in essence, to support the written submissions made in the application to introduce a new plea in law, it is, nonetheless, not sufficiently directly connected to the claim for compensation made in the application, as the Commission’s letter relates to the alleged irregularities in public procurement at FRA and as the other documents relate solely to the legal services provided by FRA’s legal advisors.

168    Consequently, the application for production of those documents must be rejected.

(h)    The seventh offer of evidence

169    By the submission of the seventh offer of evidence, on 30 January 2018, the applicant sought leave to add to the case file the OLAF report of 16 December 2016, in cases OF/2014/0192 and OF/2015/0167, together with a selection of annexes to that report.

170    In order to justify the delay in submitting that offer of evidence, the applicant merely claims that she received the OLAF report only on 12 January 2018.

171    According to the applicant, the OLAF report and the annexes thereto demonstrate that FRA infringed rules on confidentiality, which interfered with the data protection rights of members and former members of FRA staff.

172    Moreover, the applicant requests that the Court assess the consequences of FRA’s defamatory statements against her and also quantify the defamatory statements made by Mr T. in his capacity as FRA’s legal advisor. The applicant requests that the Court order FRA to find a solution that will make it possible to restore her professional and personal reputation which, she claims, has been damaged as a result of the conduct of FRA and its legal advisor.

173    In that connection, the OLAF report in the joined cases relates, first, to allegations of possible conflicts of interest on the part of a deputy judge of the Civil Service Tribunal and possible irregular contracts, purchase orders and payments made by members of FRA staff to that former deputy judge for the period 2012-2014.

174    That report also relates, secondly, to allegations of breach of professional secrecy by officials of unspecified EU institutions between June 2013 and April 2014, in so far as concerns the disclosure and use of the applicant’s home address by an unauthorised third party.

175    While the part of the OLAF Report relating to the allegations of conflicts of interests is not sufficiently directly connected to the claim for compensation made in the application, the same cannot be said for that relating to the alleged disclosure, by members of FRA, of the applicant’s home address, inasmuch as she bases her claim for compensation, inter alia, on that alleged disclosure.

176    However, while the OLAF report and the annexes thereto may, in part, be connected to the claim for compensation made in the context of the present action, it should be noted that the applicant fails to demonstrate in any way that she came into possession of that report only on 12 January 2018, even though the report is dated 14 December 2016.

177    Consequently, the application to produce the OLAF Report must be rejected.

178    Moreover, the applicant sought leave to add to the case file a number of invoices issued for legal services which she sought.

179    Amongst those invoices, some are dated October and December 2017, so they cannot be disregarded as inadmissible. However, the same does not apply to an invoice dated 23 May 2016, relating to an amount of 13 600 Romanian lei (RON), to which the applicant had already referred in her application, the submission of that invoice is in the present case clearly very late.

180    Consequently, the application to produce the latter invoice must be rejected as inadmissible.

181    On the same grounds, the applicant’s expanded claim for compensation, reproduced in paragraph 172 of the present judgment, which is closely connected to the seventh offer of evidence and in particular the OLAF Report, must be dismissed.

182    In any event, even if it were found that that claim was severable from and independent of those offers of evidence, it is not based on any argument or plea in law additional to those put forward in support of the claim already made in the application.

183    Consequently, it is not necessary to rule separately on those heads of claim.

(i)    The eighth offer of evidence

184    On 5 February 2018, the applicant produced further evidence in addition to her previous offer, namely the full annexes to the OLAF Report in joined cases OF/2014/0192 and OF/2015/0167.

185    In that connection, it must be observed that the applicant merely makes a general reference to the evidence contained in those documents.

186    It must be recalled, in that regard, that, although the body of the application may be supported and supplemented on specific points by references to extracts from documents annexed to it, a general reference to all of the annexes to the application and, a fortiori, to annexes to applications in different cases, for the purposes of setting out essential elements of the legal argument, does not meet the requirements under the Rules of Procedure. Since the annexes have a purely evidential and instrumental function, it is not for the Court to seek and identify in the annexes the grounds on which it may consider the action to be based (see, to that effect and by analogy, order of 29 November 1993, Koelman v Commission, T‑56/92, EU:T:1993:105, paragraphs 21 and 23).

187    Moreover, since it has been held that the production of the OLAF Report is inadmissible, the same applies to all of the annexes to that report.

(j)    The ninth offer of evidence

188    On 30 April 2018, the applicant lodged a ninth offer of evidence, as part of her written response to a measure of organisation of procedure taken by the Court on 24 April 2018.

189    In essence, she sought leave to add to the case file a version of an email which she had sent to FRA together with a document as an attachment, which she claimed had been taken [confidential].

190    In support of her application, the applicant claims that those documents must be added to the case file, as an annex to the application connected to that case mentions those documents. She also claims that those documents were ‘retrieved recently from [confidential]’.

191    First, it should be noted that, while the applicant admittedly refers, in the application, to a [confidential] case [confidential] and the mention made of those documents in the originating application, neither the annexes nor the schedule of annexes to the application make reference to that case.

192    Secondly, it is apparent from the application that the action giving rise to that case [confidential]. It is also apparent from an examination of the contents of those documents that [confidential] was sent to [confidential], at the latest on 15 March 2017, that is, over a year before those documents were lodged with the Court Registry.

193    The applicant fails to justify the late submission of those documents in any way. At most, she confines herself to (i) claiming that those documents were ‘recently’ retrieved from the file [confidential] and (ii) pointing out that [confidential].

194    Consequently, the ninth offer of evidence must be rejected as inadmissible.

(k)    The tenth offer of evidence

195    On 24 May 2014, the applicant lodged a tenth offer of evidence, whereby she sought leave from the Court to add to the case file an email received from the magazine Stern, her reply to the journalist who had contacted her, FRA’s proposed amendments to the article, and miscellaneous emails between her and her lawyer, and also with the cabinet of the President of the Court of Justice, concerning [confidential].

196    In that regard, it is again clear that those documents are not sufficiently directly connected to the claim for compensation made in the application.

197    Consequently, the application to produce those documents must be rejected.

(l)    The eleventh offer of evidence

198    On 12 June 2018, the applicant sought leave to add to the Court’s case file an eleventh offer of evidence, namely a document concerning a settlement [confidential].

199    Furthermore, by her eleventh offer of evidence, the applicant requests that the Court order FRA to reimburse her for the costs incurred in [confidential], which total, on average, EUR 10 000.

200    In that connection, admittedly the applicant was not, first, in a position to inform the Court as to the outcome of [confidential] at an earlier stage in the proceedings in the present case.

201    Secondly, as regards her material damage, and on account of the uncertainty surrounding [confidential], the applicant pointed out, in her application, that she would have to quantify at a later stage the damage suffered on account of [confidential].

202    Therefore, although the present dispute cannot be extended to include [confidential], the fact remains that the document lodged on 12 June 2018 must be declared admissible, as it serves to delimit the material damage suffered by the application on account of the [confidential], in particular that suffered on account of [confidential].

(m)    The twelfth offer of evidence

203    On 28 June 2018, the applicant lodged a twelfth offer of evidence, whereby she sought leave from the Court to add to the file in the present case various bank statements setting out the costs which she claimed to have incurred on account [confidential], together with FRA’s replies of 26 September and 20 November 2017 to a request for access to documents of 16 August 2017.

204    In that connection, it should be observed that, in respect of the bank statements relating to the costs incurred [confidential], the applicant justifies the late submission thereof, with the result that they must be found to be admissible.

205    However, as regards the other documents, it should be observed, in the first place, that the applicant was in possession of those documents from 26 September and 20 November 2017.

206    In the second place, the applicant fails to give any justification whatsoever for the late submission thereof and confines herself to asserting, without further evidence, that those documents are connected to the subject matter of the dispute.

207    In the third place, the annexed documents contain numerous handwritten comments, which seek to circumvent the requirement as to the strictly probative value of annexes.

208    Consequently, it must be held that those documents are inadmissible.

B.      Substance

209    By her action, the applicant seeks, in essence, compensation in respect of damage which she claims to have suffered as a result of (i) an unlawful disclosure, following a request for access to documents made by a third party, of FRA’s replies to the applicant; (ii) the leak of documents annexed to her request for access to documents and of her residential addresses; (iii) a failure to adopt preventive measures; and (iv) an improper interview granted by the new FRA Director to the newspaper Politico.

210    Moreover, in the proceedings before the General Court, the applicant made applications seeking the adoption of a measure of inquiry and the examination of a witness, the validity of which is disputed by FRA. 

1.      The claim for damages

(a)    Preliminary observations

211    Pursuant to the second paragraph of Article 340 TFEU, in the case of non-contractual liability, the European Union is, in accordance with the general principles common to the laws of the Member States, to make good any damage caused by its institutions or by its servants in the performance of their duties.

212    It is settled case-law that in order for the Union to incur non-contractual liability, for the purposes of the abovementioned provision, for unlawful conduct of its institutions a number of conditions must be satisfied: the institution’s conduct must be unlawful, actual damage must have been suffered and there must be a causal link between the conduct alleged and the damage pleaded (see judgment of 16 October 2014, Evropaïki Dynamiki v Commission, T‑297/12, not published, EU:T:2014:888, paragraph 28 and the case-law cited).

213    As regards, first of all, the condition relating to the unlawfulness of the alleged conduct of the institution or body concerned, case-law requires there to be established a sufficiently serious breach of a rule of law intended to confer rights on individuals (see judgment of 16 October 2014, Evropaïki Dynamiki v Commission, T‑297/12, not published, EU:T:2014:888, paragraph 29 and the case-law cited).

214    In relation to the requirement for the breach to be sufficiently serious, the decisive criterion for establishing this is whether the Union institution or body in question manifestly and gravely disregarded the limits on its discretion. Where that institution or body has only very little discretion, or none at all, the mere infringement of Union law may be sufficient to establish the existence of a sufficiently serious breach (see judgment of 16 October 2014, Evropaïki Dynamiki v Commission, T‑297/12, not published, EU:T:2014:888, paragraph 29 and the case-law cited).

215    Secondly, as regards the requirement that there must be actual damage, it should be noted that the EU can incur liability only if the applicant has in fact suffered an ‘actual and certain’ harm. It is for the applicant to produce to the Court the evidence to establish the fact and the extent of such damage (see judgment of 16 October 2014, Evropaïki Dynamiki v Commission, T‑297/12, not published, EU:T:2014:888, paragraph 30 and the case-law cited).

216    In particular, in so far as concerns non-material damage, while the submission of evidence is not necessarily regarded as a requirement for the recognition of such harm, it is for the applicant to at least establish that the conduct alleged against the institution concerned was capable of causing him damage (see judgment of 16 October 2014, Evropaïki Dynamiki v Commission, T‑297/12, not published, EU:T:2014:888, paragraph 31 and the case-law cited).

217    Lastly, as regards the condition that there must be a causal link between the conduct alleged and the damage pleaded, that damage must be a sufficiently direct consequence of the conduct complained of, which must be the decisive cause of the damage, although there is no obligation to make good every harmful consequence, even a remote one, of an unlawful situation. It is for the applicant to adduce evidence of a causal link between the conduct complained of and the damage pleaded (see judgment of 16 October 2014, Evropaïki Dynamiki v Commission, T‑297/12, not published, EU:T:2014:888, paragraph 32 and the case-law cited).

218    Where any one of the three conditions required for the Union to incur non-contractual liability is not satisfied, the claims for compensation must be dismissed, without there being any need to consider whether the other two conditions are met. Moreover, the EU judicature is not required to examine those conditions in any particular order (see judgment of 16 October 2014, Evropaïki Dynamiki v Commission, T‑297/12, not published, EU:T:2014:888, paragraph 33 and the case-law cited).

219    In the light of the foregoing, it is therefore necessary to establish whether the applicant has demonstrated (i) unlawfulness vitiating FRA’s conduct; (ii) damage; and (iii) a causal link between the unlawful conduct and the damage pleaded.

220    That threefold assessment must be conducted for each incident in FRA’s conduct which, the applicant claims, is unlawful.

(b)    The complaint alleging irregular disclosure of FRA’s replies to the applicant

221    In the first place, the applicant claims that the emails exchanged between her and FRA, as mentioned in paragraphs 9 and 13 of the present judgment, are covered by private correspondence, with the result that they could not be disclosed without infringing the provisions of Regulation No 1049/2001 and Article 8 of the European Convention on Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950 (‘the ECHR’).

222    In the second place, the applicant argues that, in granting partial access to its replies, FRA transformed the existing format of those documents, in breach of Article 10(3) of Regulation No 1049/2001, in order to avoid the application of Regulation No 45/2001.

223    In the third place, the applicant stresses the fact that personal data remained in the documents disclosed, which could identify her directly or indirectly. In that connection, she also alleges breach of the provisions of Regulation No 45/2001.

224    In the fourth place, the applicant takes the view that, in order to disclose its replies, FRA mistakenly relied on the fact that those documents belonged to it, although even the ‘Subject’ line in those emails could not belong to it.

225    In the fifth place, the applicant takes the view that FRA should have informed her of the disclosure of its replies since she had already stated her opposition to the disclosure thereof.

226    In the sixth place, the applicant puts forward the argument that it is unusual that a person should seek information on another person’s request for access to documents.

227    In the seventh place, the applicant takes the view that the disclosure of FRA’s replies, against her will and without informing her of that disclosure, allowed her to be identified and deprived her of the possibility of bringing an application for interim measures before the General Court, in breach of her right to an effective remedy enshrined in Article 47 of the Charter.

228    FRA disputes the merits of the applicant’s arguments.

229    In the present case, the applicant criticises FRA, in essence, for having disclosed, in response to a request for access to documents made by a third party, FRA’s replies to the applicant.

230    In that connection, it should be recalled that Regulation No 1049/2001 lays down as a general rule that the public may have access to the documents of the institutions, but provides for exceptions based on certain public and private interests.

231    Recital 11 of that regulation states that, ‘in assessing the exceptions, the institutions should take account of the principles in EU legislation concerning the protection of personal data, in all areas of Union activities’.

232    In accordance with Article 2 of Regulation No 1049/2001, FRA is required to allow the public to access documents held, that is to say, documents drawn up or received by it and in its possession, subject to conditions laid down in that regulation.

233    In the present case, first, it should be noted that FRA’s replies did not contain any mention of the name, address or any other information which may have served to identify the applicant.

234    In other words, FRA did not disclose its replies in full, as the applicant’s personal data had been redacted.

235    Furthermore, the correspondence between the applicant and FRA cannot be categorised as private correspondence, the mere disclosure of which would have resulted in the disclosure of personal data.

236    FRA’s replies were in fact communicated to the applicant following her submission of a request for access to documents, namely in the context of FRA’s exercise of its competence to give a decision on such a request.

237    Consequently, no complaint may be made against FRA for having, with regard to its own replies, disclosed the applicant’s personal data.

238    Secondly, as regards arrangements for access to FRA’s replies, it should be recalled that Article 4(6) of Regulation No 1049/2001 permits the partial disclosure of a document.

239    That article provides that ‘if only parts of the requested document are covered by any of the exceptions, the remaining parts of the document shall be released’.

240    In the present case, FRA fully satisfied that requirement by redacting those parts of FRA’s replies which contained personal data allowing the applicant to be identified.

241    The applicant’s arguments cannot call that finding into question.

242    Article 10(3) of Regulation No 1049/2001 cannot impose on the intended recipient of a request for access to documents a specific method for documents to be partially disclosed, as that article imposes merely an obligation to supply documents in an existing version or format namely, inter alia, written or electronic.

243    Furthermore, access was not granted to the email chain between FRA and the applicant, but rather solely to FRA’s replies to the applicant, of which it was the author, from which the applicant’s personal data had been deleted.

244    Moreover, the act of extracting FRA’s replies from the email chain between FRA and the applicant and of redacting the applicant’s emails in that chain pursue the same objective and lead to exactly the same outcome.

245    Consequently, as regards the arrangements for access to the emails at issue, there can be no finding of irregularity.

246    Thirdly, the applicant takes the view that FRA was similarly required to inform her of the disclosure of documents, since she was opposed to the disclosure thereof, even though Regulation No 1049/2001 does not require it.

247    In that connection, it should be observed that the obligation to notify the third party consulted is laid down in Article 5(7) of FRA Decision 2007/07 of 23 October 2007 concerning the arrangements to be applied by the Agency for public access to documents.

248    That article, headed ‘Third-party documents’ states that ‘if [FRA] intends to give access to a document against the explicit opinion of the author, it shall inform the author of its intention to disclose the document after a 10-working day period and shall draw his or her attention to the remedies available to him or her to oppose disclosure’.

249    In the present case, FRA granted partial access to its replies, expunged of personal data, in accordance with Article 4(1)(b) and (6) of the Regulation No 1049/2001, and not to documents of which the applicant was the author.

250    Accordingly, FRA was not required to inform the applicant of the disclosure of the emails at issue.

251    Fourthly, the applicant takes the view that the ‘Subject’ line of the emails containing FRA’s replies, which were partially disclosed, is not FRA’s property.

252    In that respect, pursuant to Article 5(7) of FRA Decision 2007/07 of 23 October 2007, when FRA intends to give access to a document against the explicit opinion of the author, it is to inform the author of the disclosure of that document and the remedies available.

253    However, no complaint can be made, in the present case, against FRA for failing to inform the applicant of the partial disclosure of its replies, since the applicant cannot be the author of those replies.

254    The fact that the ‘Subject’ field of an email is filled in by the sender of that email does not mean that the ‘Subject’ line of an email sent in reply still belongs to the sender. That line can easily be changed by the recipient, with the result that, in the present case, the applicant cannot be categorised, in principle, as the author of only part of FRA’s replies.

255    Moreover, since the ‘Subject’ line of those emails does not contain any of the applicant’s personal data, the question of whether or not it is the ‘property’ of the applicant or FRA is, in the present case, irrelevant.

256    Consequently, no complaint can be made against FRA for maintaining the content of the ‘Subject’ line of the emails.

257    Fifthly, the applicant puts forward the argument that it is unusual that a person should seek information on another person’s request for access to documents.

258    The mere fact that such a request may, in some circumstances, be unusual does not lead to a finding of unlawfulness. In any event, in accordance with Article 6(1) of Regulation No 1049/2001, an applicant is not obliged to state reasons for the application for access, with the result that there cannot, in any event, be a finding of irregularity on this point.

259    Consequently, the applicant cannot criticise FRA for having partially disclosed the emails in response to her request for access to documents, since FRA complied with the provisions of Regulation No 1049/2001 and Article 8 ECHR.

260    Accordingly, as the first condition to be satisfied in order for FRA to incur non-contractual liability has not been met, the claim for compensation in respect of the harm suffered as a result of the disclosure of FRA’s replies to the applicant must be dismissed.

(c)    The complaint alleging that documents annexed to the request for access to documents and the applicant’s addresses were leaked

261    The applicant criticises FRA, in essence, for having disclosed the addresses of her residences in Barcelona (Spain) and Vienna, together with the documents annexed to the request for access to documents, as mentioned in paragraph 19 of the present judgment, which, it is claimed, were in the file [confidential] and in the file [confidential].

(1)    The finding of unlawful conduct

(i)    The disclosure of the applicant’s residential addresses

262    The applicant submits that FRA infringed the duty of confidentiality enshrined in Article 339 TFEU and Article 8 ECHR, on account of the disclosure to a third party of her residential addresses in Vienna and Barcelona.

263    First, the applicant claims that FRA disclosed her residential address in Vienna, as it was at that address that, on 2 May and 6 June 2016, she was served documents, by a court officer, [confidential]. The applicant therefore asserts that, in disclosing the documents annexed to her request for access to documents, FRA also disclosed her residential address.

264    Second, she maintains that, in 2014, FRA disclosed her residential address in Barcelona, the year in which a first ‘delivery attempt of judicial documents’ took place.

265    FRA disputes the merits of the applicant’s arguments.

266    In the first place, as regards the alleged disclosure of her residential address in Vienna, the applicant claims that that event was contemporaneous with the leak of the documents annexed to her request for access to documents.

267    It is clear that the applicant has provided neither proof nor prima facie evidence in support of her claim.

268    Moreover, the documents annexed to her request for access to documents do not make any mention of her home address.

269    Accordingly, it cannot be validly claimed, on that sole basis, that FRA disclosed the applicant’s residential address in Vienna.

270    In any event, first, it should be noted that FRA’s headquarters are in Vienna. Second, [confidential] was directed not only against the applicant but also against a person working for FRA at that time.

271    It therefore cannot be validly argued that [confidential] was the direct result of any disclosure of the applicant’s residential address in that city.

272    In the second place, the applicant claims that FRA disclosed the address of her domicile in Barcelona.

273    In support of that assertion, she points out at most that, in 2014, ‘a person who refused to identify himself came twice’ to her home in Barcelona ‘with some judicial documents’, some mentioning FRA, which were not, ultimately, served on the applicant.

274    In the light of that assertion alone, it cannot be held that FRA disclosed the applicant’s residential address in Barcelona.

275    Consequently, the applicant’s argument alleging breach of Article 399 TFEU and Article 8 ECHR must be rejected.

(ii) The disclosure of the documents annexed to the request for access to documents

276    First, the applicant maintains that FRA infringed Article 4(1)(b) and Article 6(1) of Regulation No 45/2001, in that her personal data, as set out in the email mentioned in paragraph 19 of the present judgment, was disclosed for a purpose other than that for which it had been collected.

277    Second, the applicant claims that FRA failed to obtain, prior to disclosing the documents annexed to the request for access to documents, her ‘unambiguous consent’, as required under Article 2(h) of Regulation No 45/2001.

278    Third, the applicant takes the view that the communication of her personal data to OLAF, FRA’s external investigators [confidential], through lawyers representing Mr T., constitutes an unlawful transfer of her personal data in breach of Article 5, 7 and 8 of Regulation No 45/2001.

279    Fourth, the applicant claims that she did not receive the information which, in accordance with Article 11 of Regulation No 45/2001, is to be provided to the data subject from whom the personal data were collected. She also argues, in essence, that, in the absence of such information, she was deprived of the possibility of bringing an action under Article 279 TFEU. 

280    Fifth, the applicant considers that FRA infringed her right of access, provided for in Article 13 of Regulation No 45/2001, in giving her incomplete replies.

281    Sixth, the applicant takes the view that her personal data ought to have been blocked by FRA, at her request, in accordance with Article 15(1)(c) of Regulation No 45/2001, since the processing of that data was unlawful. In the alternative, she argues that the data ought to have been erased in accordance with the provisions of Article 16 of that regulation. The applicant ought also to have been informed of any notification to third parties of the blocking of her data, in accordance with Article 17 of the regulation. The applicant requests, moreover, that the Court block ‘the use of her data until the matters [have been] clarified, thus trying to prevent accumulation of further damages in the future’.

282    Seventh, the applicant considers that, had FRA requested a prior check from the EDPS, in accordance with Article 27(1) of Regulation No 45/2001, her rights could have been protected.

283    Eighth, the applicant argues that the leak of the documents annexed to the request for access to documents constitutes unlawful processing of her personal data, in breach of Article 5 of Regulation No 45/2001 and the precautionary principle.

284    Ninth, the applicant claims that FRA infringed the principle of protection of legitimate expectations in disclosing her personal data against her wishes and without informing her of that disclosure, which, it is argued, may have had the effect of preventing her from exercising her right to an effective remedy under Article 47 of the Charter. She adds that FRA’s actions towards her were also contrary to the principles of legal certainty and natural justice.

285    Tenth, the applicant puts forward the argument that FRA infringed (i) the duty of confidentiality enshrined in Article 339 TFEU, in that the data annexed were covered by professional secrecy and (ii) her right to the protection of personal data.

286    Eleventh, the applicant claims that the Interim Director used his powers incorrectly. She alleges, first, that he used Regulations Nos 1049/2001 and 45/2001 to make public certain confidential documents for the purpose of using them as evidence in judicial proceedings against her and other FRA staff members. Secondly, she asserts that he added other emails to that in which her consent to disclosure was sought, in order to give the impression that the scope of the consultation was broader than it was, and that he was the person who was responsible for the second leak.

287    For its part, first, FRA claims never to have disclosed the documents annexed to the request for access to documents, be it directly or indirectly, though the intermediary of lawyers acting for Mr T., in accordance with the applicant’s refusal.

288    It points out, moreover, that, having become aware of the first leak, an internal administrative investigation was launched and the applicant’s personal data were sent to OLAF prior to the opening of that investigation, in accordance with Article 20(1) of Regulation No 45/2001.

289    In that context, it observes that Article 5(b) of Regulation No 45/2001 allows the processing of personal data for the purposes of internal disciplinary investigations, to which FRA was subject, pursuant to Article 7 of Regulation (EC) No 1073/1999 of the European Parliament and of the Council of 25 May 1999 concerning investigations conducted by [OLAF] (OJ 1999 L 136, p. 1).

290    FRA states, secondly, that it duly informed the applicant of the fact that her personal data had been processed in the context of an ongoing administrative investigation relating to the first leak, and confirmed to her that FRA had not disclosed her personal data to any other third party. Similarly, the applicant was informed of her right to have recourse to the EDPS if she deemed it appropriate.

291    Thirdly, the fact that an administrative investigation was being conducted also justified, according to FRA, the rejection of the applicant’s request that her personal data be blocked. Similarly, FRA observes that a third party could not be notified of a rectification, erasure or blocking of personal data that it had never received.

292    Fourthly, FRA takes the view that it cannot be held responsible for the leak of those documents, since it did what was within its powers to put an end to such reprehensible conduct on the part of its officials and agents.

293    Fifthly, FRA claims that any action brought would not have resulted in the grant of interim measures in the absence of fumus boni juris.

294    Sixth, it observes that the applicant merely claims — without, however, proving it — that the Interim Director misused his powers.

295    In that connection, it should be noted at the outset that, as regards requests for access to documents, the lawfulness of FRA’s actions cannot be assessed in the light of Article 339 TFEU, as the non-disclosure of certain documents is governed by specific provisions laid down by Regulations Nos 1049/2001 and 45/2001.

296    The applicant claims that, in the present case, FRA disclosed two documents that she had sent to it in support of her request for access to documents of 14 February 2015 — namely the email of 9 October 2014 and the list of payment annexed to it — to OLAF, the persons in charge of the administrative investigation and [confidential], through lawyers representing Mr T., who also used those documents, it is claimed, in [confidential], even though the applicant had formally opposed such disclosure.

297    The email of 9 October 2014 consists in an exchange between the applicant and the former colleague, in which the applicant’s surname and first name appear clearly in the addressee field. The list of payments, annexed to that email, concerns payments received by Mr T. from FRA. 

298    It is common ground, therefore, in the present case, that the email contains the applicant’s personal data, within the meaning of Article 2(a) of Regulation No 45/2001.

299    Accordingly, it is necessary to assess the applicant’s arguments concerning (i) the disclosure of those documents to OLAF and the external investigators; and (ii) the presence of those documents in the file [confidential].

–       The disclosure to OLAF and the external investigators

300    In that connection, first, it should be borne in mind that, under Article 5(b) of Regulation No 45/2001, personal data may only be processed if, inter alia, processing is necessary for compliance with a legal obligation to which the controller is subject.

301    Secondly, Article 8(1) of Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by [OLAF] and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999 (OJ 2013 L 248, p. 1), provides that ‘the institutions, bodies, offices and agencies shall transmit to the Office without delay any information relating to possible cases of fraud, corruption or any other illegal activity affecting the financial interests of the Union’.

302    Thirdly, Article 7(1) of Regulation No 45/2001 provides that ‘personal data shall only be transferred within or to other Community institutions or bodies if the data are necessary for the legitimate performance of tasks covered by the competence of the recipient’.

303    Fourthly, Article 20(1)(a) of Regulation No 45/2001 provides that the institutions may restrict the application of Article 4(1), Article 11, Article 12(1), Articles 13 to 17 and Article 37(1) of that regulation where such restriction constitutes a necessary measure ‘to safeguard the prevention, investigation, detection and prosecution of criminal offences’.

304    Fifthly, Article 20(3) of Regulation No 45/2001 provides, however, that ‘if a restriction provided for by paragraph 1 is imposed, the data subject shall be informed, in accordance with Community law, of the principal reasons on which the application of the restriction is based and of his or her right to have recourse to the European Data Protection Supervisor’.

305    In the present case, in its defence, FRA acknowledges that it sent the applicant’s personal data to OLAF after becoming aware of the first leak, that is, the disclosure to the applicant of the list of payments by an internal source at FRA. 

306    In that context, the applicant cannot criticise FRA for communicating her personal data to OLAF, since those data were disclosed in accordance with Article 5(b) and Article 7(1) of Regulation No 45/2001.

307    Furthermore, FRA was entitled, in accordance with Article 20(1) of Regulation No 45/2001, to derogate from its obligations to provide information or not to grant the applicant’s request that her personal data be blocked. Moreover, in accordance with paragraph 3 of that article, the applicant was informed of the existence of an investigation and of her right to have recourse to the EDPS. 

308    The same finding must be made as regards the communication of the personal data to the external investigators in connection with the administrative investigation.

309    Consequently, that complaint must be rejected.

–       The disclosure to Mr T. and [confidential]

310    The applicant claims FRA disclosed her personal data to [confidential], through lawyers for Mr T., who also used those documents [confidential].

311    On this point, FRA denies having made such a disclosure, which is corroborated, prima facie, by its replies to the request for access to documents made by a third party, whereby it formally opposed disclosure to that third party of the documents annexed to the request for access to documents.

312    Although FRA initially suspended the disclosure of those documents for the purposes of consulting the applicant, in accordance with Article 4(4) of Regulation No 1049/2001, it subsequently, in its replies of 16 October, 12 November and 9 December 2015, repeatedly refused to disclose them, as the applicant had opposed that disclosure and it would have undermined ongoing investigations, on the basis of Article 4(2) of Regulation No 1049/2001 and Article 20(1)(a) of Regulation No 45/2001.

313    However, it is also apparent from the file in the present case that those documents were used as incriminating evidence in [confidential].

314    It is therefore clear, in the light [confidential], that the documents annexed to the request for access to documents were leaked, with the result that it is necessary to determine whether that leak is to be imputed to FRA.

315    The applicant adds that the leak of those documents is not confined to [confidential], but extends to that [confidential].

316    It is clear, with regard to the file in the latter case, that the applicant merely refers to such a leak.

317    Admittedly, the applicant bases her argument, in the application, on an annex which, she claims, relates to [confidential] and seeks, in her written answer to a question put by the Court, to add to the file in the present case documents contained in the file [confidential].

318    The fact remains that (i) neither the annexes nor the schedule of annexes to the application refer to that case and (ii) the request to produce the documents contained in the file in that case was rejected in paragraph 194 of the present judgment.

319    The applicant cannot, therefore, have established, to the requisite legal standard, that the documents annexed to the request for access to documents in [confidential] were leaked.

320    [As rectified by order of 18 December 2019] Consequently, it is necessary to assess whether that leak may be imputed to FRA, in so far as it relates [confidential].

321    In the first place, it is clear from the case-law that, in a situation where the exact causes of a leak are, a priori, unknown and the institution concerned is best placed to adduce evidence in that regard, any uncertainty as to the circumstances in which the leak occurred must be construed against it (see, to that effect and by analogy, judgment of 12 September 2007, Nikolaou v Commission, T‑259/03, not published, EU:T:2007:254, paragraph 196).

322    Furthermore, the institution has, at the very least, to provide an explanation or credible hypothesis as to the circumstances in which the leak may have occurred (see, to that effect and by analogy, judgment of 12 September 2007, Nikolaou v Commission, T‑259/03, not published, EU:T:2007:254, paragraph 198).

323    In the present case, while FRA has, admittedly, demonstrated, by its replies to the request for access to documents made by a third party, that it did not approve the disclosure of the documents annexed to the request for access to documents, the fact remains that it is apparent from FRA’s written pleadings that it has failed to provide any credible hypothesis as to the circumstances in which the leak may have occurred.

324    The leak of those documents is therefore imputable to FRA.

325    That finding is not called into question by the latter’s arguments.

326    First, its arguments relate solely to the first leak, of which the applicant was admittedly the recipient, and not to the leak of the documents annexed to the request for access to documents.

327    Secondly, the fact that FRA conducted an administrative investigation, following the disclosure to the applicant of the list of payments is not sufficient to exonerate it of liability for the leak of the documents annexed to the request for access to documents.

328    Moreover, a comparison of the version of the email sent by the applicant to FRA on 14 February 2015 and that used in evidence in [confidential] shows a significant difference, which is a strong indication that the documents were disclosed by a FRA staff member.

329    Unlike the email sent by the applicant to FRA, the version which appears in the file [confidential] contains FRA’s disclaimer, which appears to be automatically generated in emails sent from a work-related mailbox, which is, moreover, not disputed by FRA. 

330    Consequently, the inclusion of that disclaimer indicates, at the very least, that the disclosure of the two documents originated at FRA.

331    While that disclosure is imputable to FRA, it is nonetheless necessary to verify whether it is contrary to the provisions of Regulation No 45/2001.

332    The disclosure of the two documents cannot be justified by any of the situations referred to in Article 5 of Regulation No 45/2001, in particular as it is apparent from FRA’s replies to the request for access to documents made by a third party that the applicant had, when she was consulted on this point, opposed the disclosure of the two documents. The same applies to the situations provided for in Articles 8 and 20 of Regulation No 45/2001.

333    Accordingly, it must be held that FRA infringed the provisions of Regulation No 45/2001.

334    In the second place, it must also be found that there was infringement of Articles 11, 13, 15 and 17 of Regulation No 45/2001 in that, in principle, the applicant ought to have been informed of the disclosure of her data and the possibility of, inter alia, having that data blocked or erased by FRA or any other third party to whom that data may have been communicated.

335    [As rectified by order of 18 December 2019] Consequently, the complaint must be upheld, without it being necessary to identify the person responsible for the leak at FRA.

336    Since FRA’s conduct in that regard is unlawful, it is necessary to determine whether it gave rise to damage and whether there is a causal link between the two.

(2)    Demonstration of damage suffered

337    The applicant claims, in the present case, that she suffered material and non-material damage as a result of the leak of her personal data.

(i)    Material damage

338    Although the applicant provisionally assessed her material damage at EUR 60 000 in her application, she refined that figure during the procedure before the General Court.

339    It is argued that her material damage is the result, in essence, of various fees that she had to incur in order to deal with the disclosure of her personal data and [confidential].

340    It is claimed that the applicant’s material damage comprises (i) the sum of RON 13 600, disbursed in engaging the services of a lawyer following the discovery of the leak of her personal data; (ii) the sum of EUR 3 780, disbursed in engaging the services of a lawyer at the pre-litigation stage in the cases pending before the Court; (iii) the sum of EUR 11 173.36 covering the applicant’s representation and translation costs in [confidential]; and (iv) expenses incurred in dealing with the deterioration of her health.

341    For its part, FRA observes, first, that the applicant has failed to adduce any evidence in support of her claim that she suffered genuine damage. Second, it observes that the costs incurred during the pre-litigation stage cannot be reimbursed by the award of damages.

342    In that connection, it should be recalled that (i) the damage in respect of which compensation is sought must be actual and certain; and (ii) the applicant must adduce evidence to demonstrate the existence and extent of the damage suffered.

343    In the present case, neither in her application nor her reply does the applicant refer to any annex which might prove the payment of RON 13 600 made in respect of legal services provided by a lawyer.

344    The same applies, first, to the costs which she claims to have incurred during the pre-litigation stages, inasmuch as those costs have not been proven in any way by reference to annexes, irrespective of the question whether it is possible to award damages in respect of costs incurred during the pre-litigation stage.

345    Secondly, the applicant has failed to adduce any evidence to demonstrate the existence and scale of the costs which she claims to have incurred in connection with [confidential].

346    In any event, it is apparent from her application for confidential treatment with regard to the public, lodged at the Court Registry on 23 December 2016, that [confidential].

347    On the other hand, the applicant submitted a set of documents to the Court, demonstrating, to the requisite legal standard, various bank transfers made to her lawyer and to the persons responsible for translations [confidential], totalling EUR 11 173.26.

348    Furthermore, while the applicant admittedly pleads material damage as a result of the increase in her health-related expenditure, the fact remains that she merely refers to various medical prescriptions, invoices and reimbursements, without also giving precise figures to indicate the scale of the damage suffered.

349    Thus, the applicant has failed to demonstrate in any way the existence and extent of the damage in respect of that health expenditure.

350    Consequently, the only actual material damage that has been demonstrated, together with the extent of that damage, is that resulting from the costs incurred [confidential].

(ii) Non-material damage

351    As regards the leak of her personal data, the applicant quantifies her non-material damage at EUR 112 500.

352    She claims that that damage resulted from FRA’s actions, which gave rise, so far as the applicant is concerned, to feelings of injustice, frustration and distress.

353    FRA disputes the claim that, even if its conduct were unlawful, that conduct could cause any non-material damage for the applicant.

354    In that regard, it should be recalled that, although evidence of non-material damage is not a precondition for it to be taken into account, the applicant must at the very least demonstrate that the conduct complained of was such as to cause him such damage (see, to that effect, judgments of 16 July 2009, SELEX Sistemi Integrati v Commission, C‑481/07 P, not published, EU:C:2009:461, paragraph 38, and of 16 October 2014, Evropaïki Dynamiki v Commission, T‑297/12, not published, EU:T:2014:888, paragraphs 31, 46 and 63).

355    In the present case, it is clear that the applicant has demonstrated, to the requisite legal standard, that FRA’s conduct was such as to cause her non-material damage, as is apparent from paragraph 352 of the present judgment.

356    Accordingly, that must be taken into account for the purposes of assessing her claim for compensation.

(3)    Whether there is a causal link

357    It is necessary to verify whether there is a sufficiently direct causal link between FRA’s unlawful conduct, as found in paragraph 336 of the present judgment, and the material and non-material damage on which the applicant relies in support of her claim for compensation.

358    In the first place, in so far as concerns the material damage, it should be noted that no sufficiently direct causal link can be ascertained between the costs incurred by the applicant in [confidential] and the unlawful act found in paragraph 336 of the present judgment, in that that unlawful act concerns the leak of documents containing personal data and the addition of those documents to the file [confidential].

359    In any event, the question of the reimbursement of costs incurred at national level comes within the exclusive jurisdiction of the national court, which, in the absence of relevant harmonising measures in that field, must settle such a question pursuant to the applicable national law (see, to that effect, judgment of 18 September 1995, Nölle v Council and Commission, T‑167/94, EU:T:1995:169, paragraph 37).

360    In the second place, in so far as concerns non-material damage, it cannot be disputed that there is a direct causal link, in that the documents which were the subject of the leak imputable to FRA were used in support, inter alia, of [confidential], which gave rise to feelings of injustice and distress for the applicant.

361    Accordingly, the causal link between the applicant’s non-material damage and FRA’s unlawful conduct is sufficiently immediate.

362    Consequently, in the light of the foregoing, it would be a fair assessment of the case to order FRA to pay the applicant the sum of EUR 5000 by way of compensation.

(d)    The complaint alleging failure to adopt preventive measures

363    The applicant claims, first, that the new FRA Director exceeded his powers and infringed his duty of care in failing to prevent the leak of her personal data.

364    She argues, secondly, that the new FRA Director infringed his duty of sound administration by the manner in which he replied to her requests.

365    More specifically, she criticises the new FRA Director for failing to provide her with sufficiently detailed and precise replies and for being excessively passive.

366    Thirdly, the applicant puts forward the argument that she acted in accordance with the provisions of the Staff Regulations of Officials of the European Union when she brought certain concerns regarding irregularities which vitiated public procurement rules to the attention of the former FRA Director, and that the decision not to renew her contract as a member of the contract staff of 4 April 2016 constituted a misuse of powers and an infringement of her freedom of expression and information.

367    The applicant therefore argues, in essence, that the damage which she suffered as a result of the leak of documents containing personal data could have been avoided had FRA complied with the provisions on whistleblowing.

368    FRA maintains that it did not disclose the applicant’s personal data in any way, with the result that it cannot be criticised for having acted in breach of its duty of care.

369    It adds that it asked the applicant on several occasions to avoid repetitive and abusive applications, as well as informing her of instances in which FRA did not have to reply to correspondence from citizens because of its nature.

370    As regards the alleged irregularities in public procurement, FRA points out that the breach claimed by the applicant bears no relation to the subject matter of the present dispute, with the effect that that claim must be declared inadmissible.

371    It should be observed that the applicant aims, in essence, to demonstrate that the leak of her personal data could have been avoided had the measures which she claims ought to have been applied had indeed been applied.

372    Irrespective of the merits of the arguments put forward in that regard by the applicant, it is clear, first, that, as is apparent from paragraph 336 of the present judgment, the leak of her personal data is imputable to FRA. 

373    Second, the Court has found that damage was suffered as a result of the leak of her personal data, and the claim for compensation in respect of that damage has been upheld in paragraph 362 of the present judgment.

374    Furthermore, even assuming that the preventive measures claimed by FRA were indeed adopted, those measures could, at the very most, only have limited the damage suffered by the applicant as a result of the leak of her personal data.

375    In other words, even if FRA acted unlawfully in failing to respond adequately, the Court has found that damage was suffered as a result of the leak of her personal data, and the claim for compensation in respect of that damage has been upheld in paragraph 362 of the present judgment.

376    Consequently, the complaint alleging failure to adopt measures which could have prevented the leak of the applicant’s personal data must be rejected.

(e)    The complaint alleging that an improper interview was granted by the new FRA Director to the newspaper Politico

377    First, the applicant claims that the interview given by the new FRA Director to the newspaper Politico, published on 16 April 2016, led, on account in particular of statements made regarding ‘BP’, to the leak of personal data, in breach of Article 5 of Regulation No 45/2001 and of the precautionary principle.

378    Secondly, she criticises FRA for having publicly supported Mr T.

379    FRA disputes the merits of the applicant’s arguments.

380    In the first place, the applicant claims that the new FRA Director disclosed her personal data during the interview that he granted to Politico.

381    In that connection, first, it should be borne in mind that, under Article 5 of Regulation No 45/2001, personal data may be processed only in the circumstances exhaustively listed in that article.

382    In the present case, it is apparent from a reading of the article published in Politico that the new FRA Director is, first, quoted as having stated that ‘the agency had acted quickly to implement EU court decisions in two recent cases involving disaffected employees’.

383    Secondly, in the case of an official who has claimed to have been dismissed from FRA as a result of racial discrimination, the new FRA Director stated that the employee, identified in the procedural documents as ‘DD’, ‘returned to work in March’ and that ‘his agency had “actively” implemented a judgment of the General Court of the EU referring to the case of a person identified in court documents as “BP”’.

384    As regards the applicant specifically, the new FRA Director stated, third, that, for reasons of confidentiality, he could not reveal whether the applicant had been re-employed: ‘I am limited in what I can say, other than assure you that this has been an important priority of mine to ensure that we act on this immediately, just as in the case of DD’.

385    The new FRA Director thus clearly refrained from revealing the identity of the other parties and making negative statements with regard to them. His statements related to the implementation of the judgments in cases before the EU courts which are now closed, in particular the cases which gave rise to the judgments of 3 June 2015, BP v FRA (T‑658/13 P, EU:T:2015:356), and of 8 October 2015, DD v FRA (F‑106/13 and F‑25/14, EU:F:2015:118).

386    Furthermore, as regards the statements made in relation to ‘BP’, the new FRA Director confined himself to referring to the anonymisation rules applied by the EU courts, with regard to which the applicant fails to give any reasons as to why those rules may be insufficient.

387    Secondly, the new FRA Director cannot be criticised for, or have imputed to him, those measures undertaken by other persons, including the applicant, which made her directly identifiable.

388    First, the same applies in particular to the use of the letters ‘BP’ in an article which appeared in the Austrian press, published on 25 January 2016, in which the applicant strongly criticised the atmosphere at FRA. Secondly, the applicant did not oppose the use of her first name and surname, which made her directly identifiable, in an article published in Politico on 21 March 2017, in its ‘Brussels Influence’ section, in which reference was made to her allegations.

389    Lastly, nor can the applicant rely on the judgment of 12 September 2007, Nikolaou v Commission (T‑259/03, not published, EU:T:2007:254), in support of her arguments as, in that case, the press articles — which in part contained negative comments — referred to Mrs Kalliopi Nikolaou by name and to information relating to investigations being carried out concerning her.

390    Consequently, the applicant cannot maintain that the new FRA Direction infringed Article 5 of Regulation No 45/2001 in his interview with Politico.

391    In the second place, the applicant claims that the new FRA Director publicly supported Mr T., in breach of obligations which, it is argued, are incumbent on authorities to ‘avoid giving to the press information which could damage the official’.

392    In that connection, it should be noted that the applicant cannot consider the content of the article in Politico as indisputable.

393    It is apparent from the extract from the verbatim transcription of the recording of the interview, annexed to the rejoinder, that the new FRA Director did not ‘defend the [FRA’s] 2014 decision to hire as a consultant a former judge of the Civil Service Tribunal even though [Mr T.] was on a stand-by list of temporary judges who could be called on to serve’. The new FRA Director simply confined himself to giving a summary of the circumstances, as he understood them, surrounding Mr T’s position when he was employed as external legal counsel to FRA.

394    Accordingly, the applicant cannot claim that the new FRA Director publicly supported Mr T.

395    In the third place, the applicant claims, in essence, that the new FRA Director failed to comply with the precautionary principle in the interview given to Politico.

396    In that connection, it should be observed that the precautionary principle can be defined as a general principle of EU law requiring the competent authorities to take appropriate measures to prevent specific potential risks to public health, safety and the environment, by giving precedence to the requirements related to the protection of those interests over economic interests. In so far as the EU institutions are responsible, in all their spheres of activity, for the protection of public health, safety and the environment, the precautionary principle can be regarded as an autonomous principle stemming from the Treaty provisions (judgment of 26 November 2002, Artegodan and Others v Commission, T‑74/00, T‑76/00, T‑83/00 to T‑85/00, T‑132/00, T‑137/00 and T‑141/00, EU:T:2002:283, paragraph 184).

397    It is clear that the precautionary principle cannot be applied with regard to statements made to Politico by the new FRA Director, as the prevention of specific potential risks to public health, safety and the environment is not at issue in the present case.

398    Accordingly, the complaint alleging that an improper interview was granted to Politico must be rejected.

399    Consequently, the claim for compensation in respect of the damage suffered by the applicant as a result of the leak of her personal data must be upheld in part, and the claim for compensation must be dismissed as to the remainder.

2.      The request for the examination of witnesses

400    On 30 November 2016, the applicant lodged a request for the examination of witnesses, namely FRA’s external legal counsel, the former FRA Director and the Interim Director.

401    FRA takes the view that the present request must be rejected as unfounded.

402    In that connection, it should be recalled that even where a request for the examination of a witness, made in the application, refers precisely to the facts on which and the reasons why a witness should be examined, it falls to the General Court to assess the relevance of the request to the subject matter of the dispute and the need to examine the witnesses named (see judgment of 19 December 2013, Siemens and Others v Commission, C‑239/11 P, C‑489/11 P and C‑498/11 P, not published, EU:C:2013:866, paragraph 323 and the case-law cited).

403    The Court of Justice has also stated that the General Court’s discretion in that regard is in line with the fundamental right to a fair hearing and, in particular, Article 6(3)(d) of the ECHR (see judgment of 19 December 2013, Siemens and Others v Commission, C‑239/11 P, C‑489/11 P and C‑498/11 P, not published, EU:C:2013:866, paragraph 324 and 325 and the case-law cited).

404    It is apparent from the case-law of the Court of Justice that that provision does not confer on the accused an absolute right to obtain the attendance of witnesses before a court and that it is in principle for the court hearing the case to determine whether it is necessary or appropriate to call a witness (see judgment of 19 December 2013, Siemens and Others v Commission, C‑239/11 P, C‑489/11 P and C‑498/11 P, not published, EU:C:2013:866, paragraphs 324 and 325 and the case-law cited).

405    In the present case, it is clear that, as is apparent from paragraphs 221 to 399 of the present judgments, the Court has been able to decide the matter on the basis of the forms of order sought, the pleas in law and arguments put forward, together with the evidence submitted by the parties.

406    Accordingly, the request for the examination of witnesses must be rejected.

3.      The request for the adoption of a measure of inquiry

407    By letter lodged at the Court Registry on 13 July 2018, the applicant requested that the Court adopt measures of inquiry, in accordance with Article 88 and Article 91(b) of the Rules of Procedure.

408    FRA takes the view that that request must be rejected as unfounded.

409    In that connection, pursuant to Article 88(1) of the Rules of Procedure, measures of inquiry may be taken or modified at any stage of the proceedings either of the General Court’s own motion or on the application of a main party.

410    Moreover, pursuant to Article 91(b) of the Rules of Procedure, measures of inquiry may seek to request a party to provide information or produce any material relating to the case.

411    However, there is no need to order a measure of inquiry sought by an applicant where its purpose is not to clarify the plea the applicant raised or to prove that its factual submissions are accurate, but rather appears to be an attempt to obtain new evidence in support of its action, unless the applicant raises specific complaints which can be checked or clarified by a request for information or for specific documents (see, to that effect, judgment of 8 November 2000, Bareyt and Others v Commission, T‑175/97, ET:T:2000:259, paragraphs 89 to 91).

412    In the present case, the applicant bases the request for a measure of inquiry, in essence, on FRA’s allegedly incomplete and imprecise reply to the measure of organisation of procedure adopted by the Court on 6 June 2018.

413    It should be noted that, by its reply, FRA complied with the wording of the Court’s measure of organisation of procedure of 6 June 2018, and that reply did not necessitate the adoption by the Court of a measure of inquiry.

414    Accordingly, the request for the adoption of a measure of inquiry must be rejected.

 Costs

415    Under Article 134(3) of the Rules of Procedure, where each party succeeds on some and fails on other heads, the parties are to bear their own costs. However, if it appears justified in the circumstances of the case, the Court may order that one party, in addition to bearing his own costs, pay a proportion of the costs of the other party.

416    In the present case, it is appropriate to order each party to bear their own costs.

417    That allocation takes account of the costs incurred for the purposes of dealing with requests for the adoption of measures of organisation of procedure and measures of inquiry, the examination of witnesses, the introduction of a new plea in law and the submission of offers of further evidence.

On those grounds,

THE GENERAL COURT (Fifth Chamber),

hereby:

1.      Orders the European Union Agency for Fundamental Rights (FRA) to pay BP the sum of EUR 5 000;

2.      Orders that the compensation awarded in paragraph 1 above be increased by default interest, to be calculated from the date of delivery of the present judgment until full payment, at the rate set by the European Central Bank (ECB) for its principal refinancing operations, plus two percentage points;

3.      Dismisses the action as to the remainder;

4.      Orders FRA and BP each to bear their own costs.

Labucka Dittrich Ulloa Rubio

Delivered in open court in Luxembourg on 11 July 2019.

E. Coulon

Registrar President

*Language of the case: English.

(i) The name appearing in the fourth indent of paragraph 144 and in paragraph 150 has been replaced in accordance with a decision of the Committee provided for in Article 2 of the decision of the General Court of 16 October 2019 establishing an internal supervision mechanism regarding the processing of personal data by the General Court when acting in its judicial capacity.

1 Confidential information omitted.