Action brought on 8 March 2024 – CW v Europol and Eurojust
(Case T-148/24)
Language of the case: Dutch
Parties
Applicant: CW (represented by: J. Reisinger, lawyer)
Defendants: European Union Agency for Law Enforcement Cooperation (Europol) and European Union Agency for Judicial Cooperation in Criminal Matters (Eurojust)
Form of order sought
The applicant claims that the Court should:
under Article 268 TFEU, read in conjunction with Article 340 TFEU, award compensation in the amount of EUR 10 000 for the damage suffered as a result of the Agreement establishing a France-Netherlands Joint Investigation Team signed on 10 April 2020 and related acts of Europol and Eurojust;
order the defendants to pay the costs.
Pleas in law and main arguments
The applicant bases his claims against the actions of Europol and Eurojust, as regards Operation EncroChat, on three pleas in law.
First plea in law, alleging that personal data was collected and processed unlawfully and disproportionately.
During the collection and processing (in particular the storage, analysis and dissemination) of EncroChat data, fundamental human rights of users, including those of the applicant were breached. In particular, Articles 18, 28 and 38 of Regulation 2016/794, 1 Articles 9, 26 and 27 of Regulation 2018/1727 2 and Articles 71 and 72 of Regulation 2018/1725 3 were infringed.
Articles 7, 8 and 10 to 12 of the Charter of Fundamental Rights of the European Union (‘the Charter’), read in conjunction with Articles 51 and 52 thereof, as well as Article 8 of the European Union Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR) and Article 17 of the International Covenant on Civil and Political Rights (ICCPR) were infringed.
The applicant argues that he has suffered damage because it was neither necessary nor proportionate to hack all EncroChat users instead of taking targeted and individualised action. Furthermore, this was neither justified in advance nor retrospectively.
Second plea in law, alleging the lack of opportunity to test the usefulness of the evidence in criminal cases or, in any event, the lack of formal and material guarantees.
The applicant argues that the EncroChat data, including the applicant’s personal data, has not been adequately collected and processed, given the purpose of using that data in criminal cases. This infringed the provisions mentioned in the first plea in law as well as Article 28 of Regulation 2016/794, Articles 71 and 74 of Regulation 2018/1725, Articles 47 and 48 of the Charter, Article 6 of the ECHR and Articles 14 and 15 of the ICCPR.
Third plea in law, alleging the absence of adequate protection in the collection and processing of the EncroChat data.
The applicant argues that there cannot reasonably be adequate protection as defined by the abovementioned regulations, given the nature, size and complexity of the data collected. Furthermore, the applicant argues that the controller must assess the impact of the intended processing. It is unclear whether that has happened. If this is not the case, then that may have caused additional damage.
____________
1 Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (OJ 2016 L 135, p. 53).
1 Regulation (EU) 2018/1727 of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing Council Decision 2002/187/JHA (OJ 2018 L 295, p. 138).
1 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ 2018 L 295, p. 39).