JUDGMENT OF THE GENERAL COURT (First Chamber)
6 September 2023 (*)
(Law governing the institutions – Protection of personal data – Regulation (EU) 2018/1725 – Rejection of the complaint to the EDPS concerning the storage and processing of personal data by the SRB – Refusal of the request for review – Right to erasure – Right to object – Right to restriction of processing – Article 26 of the Staff Regulations – Principle of sound administration)
In Case T‑200/21,
JS, represented by L. Levi and A. Champetier, lawyers,
applicant,
v
European Data Protection Supervisor (EDPS), represented by U. Kallenberger and A. Pouliou, acting as Agents,
defendant,
THE GENERAL COURT (First Chamber),
composed of D. Spielmann, President, V. Valančius (Rapporteur) and R. Mastroianni, Judges,
Registrar: V. Di Bucci,
having regard to the written part of the procedure,
having regard to the fact that no request for a hearing was submitted by the parties within three weeks after service of notification of the close of the written part of the procedure, and having decided to rule on the action without an oral part of the procedure, pursuant to Article 106(3) of the Rules of Procedure of the General Court,
gives the following
Judgment
1 By his action, the applicant seeks, first, on the basis of Article 263 TFEU, annulment of the decision of the European Data Protection Supervisor (EDPS) of 18 January 2021 rejecting his complaint (‘the first contested decision’) and of the decision of the EDPS of 9 March 2021 refusing his request for review of the first contested decision (‘the second contested decision’) (together, ‘the contested decisions’) and, secondly, on the basis of Article 268 TFEU, compensation for the damage which he claims to have suffered as a result of the contested decisions.
Background to the dispute and contested decisions
2 The applicant took up his duties, as a member of the temporary staff, at the Single Resolution Board (SRB) on 1 November 2017. On 4 September 2019, he resigned with effect from 30 September 2019.
The applicant’s requests to the SRB
3 By an email of 29 September 2019, the applicant, citing Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ 2018 L 295, p. 39), requested from the SRB a copy of all his personal data and all data referring to his person stored at the SRB.
4 By a supplementary email of the same date sent to the SRB’s Data Protection Officer (‘the DPO’), the applicant requested the latter to inform him of the purposes of the two instances of access to his personal data stored in the European Commission’s personnel management IT system, Sysper 2, on 12 June 2019, and to investigate whether those instances of access could have constituted a breach of his personal data. He also requested that measures be taken to prevent any unauthorised access, modification, processing or disclosure of his personal data stored at the SRB.
5 By an email of 17 February 2020 sent to the DPO, the applicant reiterated his request to the SRB ‘to confirm [to him] whether or not personal (in part[ic]ular, HR-related) data concerning [him] [was] being processed’, ‘to provide [to him] a copy of [his] personal data’ and ‘to restrict the processing of [his] personal data’, while ‘object[ing to the] processing of [his] personal data’.
6 On 28 February 2020, the DPO provided the applicant with certain data concerning him, stating that, ‘following the Common Commission-level retention list for European Commission files [(SEC(2012)713)] that SRB applies by analogy, and in view of the relevant articles 11, 26, 81 and 127 of the applicable Staff Regulations [of Officials of the European Union] and [Conditions of Employment of Other Servants of the European Union], the SRB ha[d] the legal obligation to store [his] personal file in accordance with the retention list’ and that his ‘personal file [wa]s now archived and w[ould] be stored up to 8 years after the extinction of all [his] rights, and for at least 120 years after [his] birth date’.
7 In response to that email, the applicant, by an email of 8 March 2020, requested the SRB to delete his personal data processed by the latter and reiterated his request for restriction of the processing of his personal data and for objection to the processing of such of his personal data which are not to be deleted (‘the request for erasure’).
8 The request for erasure is worded as follows:
‘Thank you very much for your message and sending the copy of my personal (in particular, HR-related) data stored by the SRB. Also thanks for the opportunity to request my personal data (e.g. administrative certificates) from sysper[.] I would let you know in case any further of my personal data was needed.
In exercise of my rights enshrined in Regulation [2018/1725], regarding my personal data sent by the SRB below, I kindly request its deletion from SRB systems (by SRB HR and any other SRB data controller) as no purpose for processing by the SRB looks necessary and justified to me.
For any of my personal data potentially retained …, I kindly request to be informed about the purpose of that retention of my personal data by the SRB.
For any of my personal data which are not [to] be deleted, if such longer retention was indeed necessary and just, I request the restriction of and object [to] its processing by the SRB. My request for restriction of and objection against any processing by the SRB applies in particular to those of my personal data whose accuracy I have repeatedly disputed by my appeals and complaints under Art. 90(2) EU Staff Regs (e.g. my personal data contained in the documents which the SRB has called [“]appraisal reports”).’
9 By emails of 20 March and 17 and 20 April 2020, the applicant reiterated his ‘request for erasure’, withdrawing his consent to the processing of those data by the SRB.
10 The DPO replied to those emails by an email of 30 April 2020, refusing the request for erasure.
11 In that email, first, the DPO confirmed to the applicant that the SRB had a legal obligation to store his personal file in accordance with the Common Commission-level retention list for European Commission files (SEC(2012)713) and under Articles 11, 26, 81 and 127 of the Staff Regulations of Officials of the European Union (‘the Staff Regulations’) and the Conditions of Employment of Other Servants of the European Union, with that legal obligation precluding, under Article 19(3)(b) of Regulation 2018/1725, the application of the right to erasure provided for in Article 19(1) of that regulation.
12 In the same email, secondly, the DPO stated that Article 10(5) of the Staff Regulations required the SRB to store those data in a single personal file, with the SRB being required to transfer that personal file to any EU institution as a potential new employer, and some of the data in the personal file were also kept in the context of a further and/or future financial obligation for its staff or their family members (that is to say, survivors’ or orphans’ pensions). Those considerations justify the application by analogy of the retention period for personal data, provided for in the Common Commission-level retention list for European Commission files (SEC(2012)713), namely 120 years after the date of birth of the official or other servant. The DPO inferred from this, also on the basis of Articles 11, 81 and 127 of the Staff Regulations, that the SRB was not allowed to delete data from the applicant’s personal file.
13 Thirdly, the DPO stated that that officer’s legal obligation to retain personal data in the applicant’s personal file precluded, pursuant to Article 5(1)(b) of Regulation 2018/1725, the application of the right to object provided for in Article 23(1) of Regulation 2018/1725.
14 Fourthly, as regards the request for restriction of processing of his personal data, pursuant to Article 20(1)(a) and (b) of Regulation 2018/1725, the DPO invited the applicant to specify the data whose accuracy he disputed.
Procedure before the EDPS and contested decisions
15 On 20 March 2020, the applicant lodged a complaint with the EDPS against the SRB, pursuant to Article 63(1) of Regulation 2018/1725 (‘the complaint’).
16 In the complaint, first of all, the applicant stated that, following his resignation, he had asked the SRB to erase his personal data, in particular the data referring to his name contained in the ‘appraisal reports’, since:
‘(a) th[ose] personal data [we]re no longer necessary in relation to the purposes for which they [had been] collected or otherwise processed;
(b) [he had] withdrawn [all] consent on which the processing is based according to point (d) of Article 5(1), or […] Article 10(2) [of Regulation 2018/1725], and where there [wa]s no other legal ground for the processing;
(c) [he had] objected to the processing pursuant to Article 23(1) [of Regulation 2018/1725] and there [we]re no overriding legitimate grounds for the processing;
(d) [his] personal data ha[d], in [his] view, been unlawfully processed;
(e) [his] personal data ha[d] to be erased for compliance with a legal obligation to which the controller [of the personal data] is subject.’
17 In the complaint, the applicant also stated that ‘the [SRB] on the contrary claim[ed] to be allowed to store all [his] personal data “for at least 120 years after [his] birth”’, the ‘processing and storage’ for such a duration ‘in [his] view, infring[ing] [his] rights entitled by [Regulation 2018/1725], in particular [his] rights in accordance with Art. 19 [of Regulation 2018/1725, namely the] Right to erasure (“right to be forgotten”) and Article 20 [of Regulation [2018/1725, namely the] Right to restriction of processing and Article 23 [of Regulation 2018/1725, namely the] Right to object’.
18 In the complaint, the applicant then asked the EDPS ‘to instruct the SRB to comply with [his] requests in exercise of [his] rights (in particular the requested erasure of [his] personal data [concerned]) without undue delay’.
19 By emails of 3 and 8 April 2020, the applicant submitted additional observations to the EDPS, alleging that the infringements of his rights were aggravated by certain elements, and in particular by unauthorised disclosures of his personal data.
20 By an email of 8 April 2020, however, the applicant asked the EDPS not to pursue his allegations at that stage.
21 By letter of 14 April 2020, the EDPS invited the SRB to submit its observations on the applicant’s allegations, attaching the complaint and its annexes.
22 On 17 April 2020, the DPO provided preliminary remarks on the allegations at issue, and on 25 May 2020, the SRB replied to the EDPS’s letter of 14 April 2020.
23 On 29 May 2020, the EDPS invited the applicant to submit observations on the SRB’s reply, and the applicant did so on 31 July 2020.
24 By letter of 6 August 2020, the EDPS invited the SRB to submit its observations on the applicant’s observations of 31 July 2020, which the SRB did on 17 September 2020.
25 On 8 October 2020, the EDPS invited the applicant to submit his observations on the SRB’s reply of 17 September 2020, which the applicant did on 4 November 2020.
26 On 18 January 2021, the EDPS rejected the applicant’s complaint by the first contested decision.
27 First, that decision concludes, in essence, that, as regards the right to erasure of the applicant’s personal data, provided for in Article 19 of Regulation 2018/1725, read in the light of Article 26 of the Staff Regulations, the SRB was under a legal obligation, within the meaning of Article 19(3)(b) of Regulation 2018/1725, to keep the content of the applicant’s personal file. The applicant consequently had no right to obtain from the SRB, as controller of the personal data, the erasure of personal data concerning him, under Article 19(1) of Regulation 2018/1725.
28 Secondly, as regards the right to object to the processing of personal data, provided for in Article 23(1) of Regulation 2018/1725, the EDPS recalled that, under Article 5(1)(b) of Regulation 2018/1725, processing of those data was lawful if it was necessary for compliance with a legal obligation to which the controller of the personal data was subject. Since that was indeed the case here, according to the EDPS, the applicant had no right to object, under Article 23(1) of Regulation 2018/1725, to the processing of his personal data.
29 Thirdly, as regards the applicant’s request for restriction of the processing of his personal data, based on Article 20(1) of Regulation 2018/1725, the EDPS also considered that it should be refused. First of all, the EDPS rejected the applicant’s argument based on the assumption that his personal data held by the SRB were incomplete or inaccurate. He then noted that the processing was lawful within the meaning of Article 5(1)(b) of Regulation 2018/1725, since it was necessary for compliance with a legal obligation to which the SRB was subject pursuant to Article 26 of the Staff Regulations. Lastly, he recalled that the applicant had no right to object under Article 23 of Regulation 2018/1725, as previously established. The EDPS concluded therefrom that the applicant had no ground, in terms of Article 20(1) of that regulation, to obtain from the SRB a restriction of the processing of his personal data.
30 In conclusion, the EDPS rejected the applicant’s complaint, stating as follows:
‘The attention of the SRB is drawn to the Common Commission-level retention list of the European Commission files in its second updated version (SEC(2019)900) as well as the EDPS Guidelines [of 10 October 2008] concerning the processing operations in the field of staff recruitment. Whilst not applicable in the case of the [applicant], who has been working for the SRB until September 2019, these recommend a retention period for personal data stored in personal files under Article 26 of the Staff Regulations of ten years as of the termination of employment or as of the last pension payment as reasonable.’
31 On 17 February 2021, the applicant, pursuant to Article 18(1) of the Decision of the EDPS of 15 May 2020 adopting the Rules of Procedure of the EDPS (OJ 2020 L 204, p. 49) (‘the EDPS Rules of Procedure’), submitted to the EDPS a request for review of the first contested decision (‘the request for review’).
32 In the request for review, which included, in annex, several documents relating to the personal-data protection policies of various EU agencies, the applicant argued as follows:
‘[The first contested] decision did not [either] assess the necessity for the SRB to store and process [the applicant’s] personal data beyond the […] duration [recommended in the EDPS guidelines] i.e. 10 years as of the termination of employment [footnote: “The other hypothesis of the last pension payment is not relevant here as [the applicant] has no pension entitlements”] or even a shorter period as requested nor the lawfulness of the SRB’s claimed purposes.
Indeed, if according to Article 26 [of the Staff Regulations] …, [the applicant] would not be entitled to ask for erasure, to object or to have a right to the restriction of processing [of his personal data], it still remains instrumental for him to know and understand when timewise these rights can be exercised.
Indeed, none of the other EU agencies … under Regulation [2018/1725] seem to store their former staffs’ personal data, in particular appraisal reports, as long as the SRB claims to be “legally obliged” to store [the applicant’s]. In that respect the maximum retention period for former staffs’ personal data seems to be 10 years … Indeed, not even the [Common Commission-level retention list for European Commission files] applies a 120 years [retention] period for any of the personal data of staff exiting without pension entitlements.
Obviously, the lifelong retention period was originally intended by the EU institutions for the purpose of retired staffs’ pension entitlements, which is however not applicable in the present case, as [the applicant] left the EU service without such entitlements. Furthermore, the contested data whose erasure [the applicant] has specifically requested (data relating to his person, which the SRB names “appraisal reports”) are not necessary and [are] irrelevant for financial obligations in the sense of the Staff and Financial Regulations and can thus be erased before the standard 10 years period.
Contrary, the SRB applies a retention period for [the applicant’s] entire personal file of 120 years after his birth date.
We argue that this duration is not only in breach of the [common retention list of 2012] but not necessary in order for the SRB to comply with its obligations.
Likewise, it prevents [the applicant] from exercising his fundamental rights as enshrined by Regulation [2018/1725] and the EU Charter of Fundamental Rights.
… [In the present case] a duration of 120 years … deprives from any effectiveness the fundamental rights of [the applicant to the protection of his personal data].
In that regard, it is respectfully submitted that [the EDPS] should have assessed also the proportionality of the duration of the SRB’s intended retention period and purposes in order to assess the validity/ground of [the applicant’s] request and complaint – which [he] did not.
…’
33 On 27 February 2021, the SRB was invited by the EDPS to submit its observations on the request for review, which the SRB did on 5 March 2021, reiterating its observations which it had sent to the EDPS on 17 September 2020 for the purposes of submitting that the request for review should be refused.
34 On 9 March 2021, the EDPS refused the applicant’s request for review by the second contested decision.
35 The second contested decision is worded as follows:
‘We have carefully analysed the request for review and have concluded that you have not provided any new factual evidence or legal arguments, which would justify a review of the [first contested d]ecision.
We take note that, in the request for review, you also raise the issue as to the exact time when the [applicant] will be entitled to exercise his right to erasure, right to object and right to restriction of processing [of his personal data], since “it still remains instrumental for him to know and understand when time-wise these rights can be exercised”.
Similarly, we note that you contest the 120 years retention period applied by the SRB to the [applicant]’s personal data contained in his personal file.
However, please note that the subject matter of the complaint investigated under case 2020-0342 was limited to the [applicant]’s request for erasure of his personal data submitted to the SRB on 8 March 2020.
Future exercise of the right to erasure and exercise of other rights, such as the right to object and right to restriction of the processing [of personal data], as well as any arguments relating to the lawfulness of the 120 years retention period applied by SRB to personal files have, therefore, not been subject to the EDPS investigation in the context of the present complaint case.
Consequently, these elements cannot be addressed within the framework of the review procedure. Should the [applicant] wish to contest those, he may lodge a new complaint to the EDPS in this regard.’
Forms of order sought
36 The applicant claims that the Court should:
– annul the first contested decision and, so far as necessary, the second contested decision;
– order the EDPS to pay him the sum of EUR 20 000 in respect of the damage suffered;
– order the EDPS to pay the costs.
37 The EDPS contends that the Court should:
– dismiss the action as unfounded;
– order the applicant to pay the costs.
Law
38 By the present action, the applicant seeks the annulment of the contested decisions and compensation for the damage allegedly suffered.
The new evidence submitted by the parties
39 In the first place, the applicant submitted to the Court, by document lodged at the Court Registry on 31 August 2021, three new items of evidence.
40 According to the EDPS, that new evidence must be dismissed as in part inadmissible and in part irrelevant and unfounded.
41 In the present case, first of all, the applicant submitted an exchange of emails between himself, the Human Resources Directorate of the Commission and the SRB.
42 Irrespective of the question of their admissibility, those items must be dismissed.
43 Indeed, they are not relevant for the purposes of ruling in the present case, since their content relates not to a refusal to erase or to allow objection to, or restriction of, the processing of the applicant’s personal data, but to a right of access to certain data, that right being unrelated to the subject matter of the present dispute.
44 Next, the applicant submitted a decision of the EDPS of 3 March 2020 in a case involving the European Court of Auditors.
45 Irrespective of the question of its admissibility, that new item of evidence must be dismissed.
46 Indeed, that new evidence is in no way relevant for the purposes of ruling in the present dispute, in that a decision of the EDPS in another case cannot be relied upon as against him in the present case.
47 Lastly, the applicant submitted an exchange of emails with the European Central Bank (ECB) Data Protection Officer relating to the ECB’s practice as regards the periods for the retention and processing of personal data of ECB staff.
48 Irrespective of the question of their admissibility, those items must be dismissed.
49 The practice of other EU institutions, agencies or bodies, as regards the periods for the retention and processing of personal data, cannot be relevant in the present case and, in any event, can in no way be relied upon as against the EDPS in the present case.
50 The new items of evidence submitted by the applicant must, therefore, be dismissed.
51 In the second place, by document lodged at the Court Registry on 5 October 2021, the EDPS submitted a new item of evidence, namely the complaint lodged by the applicant on 7 August 2021 regarding the SRB’s retention period for personal data, which expressly refers to the complaint in the present case.
52 According to the applicant, that new item of evidence must be dismissed as irrelevant.
53 However, that item of evidence is relevant in the present case, since that other complaint concerns the period for the retention and processing of personal data by the SRB.
54 Moreover, its lateness is justified by the date on which the defence was lodged, namely 8 July 2021, which was before the date on which that other complaint was lodged, in accordance with Article 85(3) of the Rules of Procedure of the General Court.
55 That item of evidence must, therefore, be admitted.
The claims for annulment
56 The applicant seeks annulment of the first contested decision, by which the complaint was rejected, and, in so far as necessary, annulment of the second contested decision, by which the request for review of the first contested decision was refused.
The claim directed against the first contested decision
57 In support of his claim for annulment, the applicant relies on a single plea in law, alleging infringements of Article 4(1) and Articles 5, 19, 20 and 23 of Regulation 2018/1725, as well as infringement of the principles of necessity and proportionality and of Articles 7, 8 and 41 and Article 52(1) of the Charter of Fundamental Rights of the European Union (‘the Charter’).
58 The applicant submits that the EDPS failed to assess whether it was necessary for the SRB to provide for a minimum period of 120 years for the storage and processing of the personal data at issue, in particular as regards the appraisal reports, in order to comply with its obligations under Article 26 of the Staff Regulations.
59 To that end, the applicant recalls that, pursuant to Article 4(1)(e) of Regulation 2018/1725, the retention period for personal data must be no longer than is necessary for the purposes for which those data are processed and that, in the first contested decision, the EDPS drew the SRB’s attention to the EDPS Guidelines and the Common Commission-level retention list of the European Commission files in its second updated version (SEC(2019)900); attention was drawn to those documents notwithstanding that, according to the EDPS, those texts were not applicable in the present case, those guidelines having provided for a maximum duration of 10 years and the EDPS having constantly stated beforehand that a duration of 120 years was excessive.
60 The applicant complains that the EDPS failed to check either the necessity or the purpose of such a retention period and relies in that regard on the practice of other EU agencies and institutions, as well as the EDPS’s own opinions.
61 As the EDPS himself stated, the lifelong retention period was originally intended by the EU institutions for the purpose of their retired officials’ pension entitlements, which is however not applicable in the present case, as the applicant, a former temporary agent, left the EU service without such pension entitlements and had no spouse or children.
62 In the applicant’s view, the contested data relating to his name, which the SRB claims to be ‘appraisal reports’, are neither necessary nor relevant to the financial obligations within the meaning of the Staff Regulations and Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules applicable to the general budget of the Union, amending Regulations (EU) No 1296/2013, (EU) No 1301/2013, (EU) No 1303/2013, (EU) No 1304/2013, (EU) No 1309/2013, (EU) No 1316/2013, (EU) No 223/2014, (EU) No 283/2014, and Decision No 541/2014/EU and repealing Regulation (EU, Euratom) No 966/2012 (OJ 2018 L 193, p. 1), whereas the SRB applies a retention period for the applicant’s entire personal file of at least 120 years after his date of birth.
63 A retention period, as regards personal data, of at least 120 years after the applicant’s birth is, in itself or in any event in the present case, not necessary in order for the SRB to comply with its obligations deriving from Article 26 of the Staff Regulations.
64 The applicant submits that such a retention period is also disproportionate, as previously constantly stated by the EDPS himself, in that it introduces an undue limitation and unlawful breach of the fundamental rights enshrined in Articles 7 and 8 of the Charter in the light of Article 52(1) thereof.
65 Such a retention period also deprives of any effectiveness the applicant’s fundamental rights to erasure, to the restriction of the processing of his personal data and to object, as provided by Regulation 2018/1725.
66 Thus, the fact that the EDPS does not assess the lawfulness of the 120-year retention period for personal data constitutes a failure to fulfil his obligations as regards the effectiveness of the applicant’s fundamental rights enshrined in the Charter and in Regulation 2018/1725 and as regards his duty to act diligently enshrined in Article 41 of the Charter.
67 The EDPS disputes those arguments.
68 In the first place, it is for the Court to ascertain whether the EDPS wrongly rejected the applicant’s complaint, in breach of the right to erasure, enshrined in Article 19 of Regulation 2018/1725, the right to object, enshrined in Article 23 of that regulation, and the right to the restriction of the processing of personal data, enshrined in Article 20 of the regulation.
69 It should be noted that Article 4 of Regulation 2018/1725, entitled ‘Principles relating to processing of personal data’, provides in paragraph (1)(a) and (b) thereof, inter alia, that personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject and that they must be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
70 Article 5 of Regulation 2018/1725, entitled ‘Lawfulness of processing’, provides in paragraph (1)(b) thereof that processing is to be lawful, in particular if it is necessary for compliance with a legal obligation to which the controller is subject.
71 Article 19(1) of Regulation 2018/1725 provides for the right to obtain from the controller of the personal data the erasure of those data. Article 19(3)(b) of that regulation contains an exception to that principle where the processing of the personal data is necessary for compliance with a legal obligation to which the data controller is subject. In other words, the erasure of personal data may not be obtained if the processing of those data, and thus their retention, is necessary for compliance with a legal obligation to which the controller of those data is subject.
72 Article 20 of Regulation 2018/1725 provides that the data subject must have the right to obtain from the controller of personal data restriction of processing, in particular where the accuracy of the data is contested, where the processing is unlawful or where the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims.
73 Article 23(1) of Regulation 2018/1725 allows the data subject to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (a) of Article 5(1), that is, where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the EU institution or body. In that case, the controller of the personal data must no longer process those data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
74 In the present case, the SRB’s legal obligation justifying the refusal of the requests seeking erasure and to object to processing arises from Article 26 of the Staff Regulations, which requires the SRB to keep all documents concerning the administrative status of the official or servant concerned and all reports relating to his or her ability, efficiency and conduct. Article 26 also provides that an official must have the right, even after leaving the service, to acquaint himself or herself with all the documents in his or her file and to take copies of them.
75 In so far as the applicant alleges infringement of Articles 19, 20 and 23 of Regulation 2018/1725, it must be found that, in the light of the complaint brought before him, the EDPS was right to refuse the applicant’s requests.
76 First, as regards the right to erasure of personal data, it follows from reading Article 19(3)(b) of Regulation 2018/1725 in conjunction with Article 26 of the Staff Regulations, that the SRB could consider itself legally obliged to keep the applicant’s file and not to grant his request for erasure.
77 As the EDPS stated in reply to a question from the Court, the retention of those data meets the need to establish pension rights or to determine rights of a surviving spouse or orphans and must, therefore, cover a sufficient period for the staff member (or his or her beneficiaries) to have exhausted all channels of appeal after termination of his or her service within the meaning of Article 47 of the Staff Regulations.
78 Furthermore, even if the applicant is not concerned by pension rights, the SRB’s refusal is consistent with the purpose of Article 26 of the Staff Regulations, which is, inter alia, to enable any official, even after leaving the service, to acquaint himself or herself with all the documents in his or her file and to take copies of them. It may indeed be noted that that access to his file was requested by the applicant and was granted to him on 28 February 2020. Similarly, as is apparent, in particular, from the first contested decision, the applicant brought actions against the SRB before the Court in May 2020, which, as at the date of the first contested decision, were still pending.
79 Accordingly, without prejudice to the question of how long the personal file may be retained, it follows from the applicable provisions that, as at the date of the first contested decision, the EDPS was right to uphold the SRB’s refusal of the applicant’s request seeking the erasure of his personal data present in his file.
80 Secondly, as regards the applicant’s request that the processing of his personal data be restricted, apart from the fact that he does not appear to have specified what specific form of restriction he wished, such a restriction must meet certain conditions laid down in Article 20 of Regulation 2018/1725, which the applicant has not established were satisfied in the present case. In particular, he has not established how the data in his file are inaccurate or incomplete, or that the first contested decision is erroneous in that regard.
81 Thirdly, as regards the request seeking to object to the processing of the applicant’s personal data, within the meaning of Article 23(1) of Regulation 2018/1725, the EDPS correctly notes that the SRB relied on the legal obligation deriving from Article 5(1)(b) of Regulation 2018/1725, according to which the processing of personal data is lawful if it is necessary for compliance with a legal obligation to which the controller is subject, which is the case here. The applicant fails to substantiate his challenge further in that regard.
82 Accordingly, the applicant’s argument concerning a lack of purpose or necessity in order to refuse his right to erasure or his right to object to the processing of his personal data contained in his personal file and retained by the SRB on that basis must be rejected. Consequently, the first contested decision, by which the EDPS rejected the applicant’s complaint in that regard, is not vitiated by unlawfulness.
83 In the second place, the applicant submits before the Court that the EDPS erred in failing to assess the proportionality of the retention period for his personal data.
84 In that regard, it should be recalled that, pursuant to Article 57(1)(e) of Regulation 2018/1725, relating to the tasks of the EDPS, the latter is to ‘handle complaints lodged by a data subject, or by a body, organisation or association … and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary’.
85 However, in the present case, the subject matter of the complaint was limited to the request seeking erasure, the exercise of the right to object, and the exercise of the right to restrict the processing of the applicant’s personal data.
86 It is true that, in the complaint, the applicant referred to the 120-year retention period for personal data that was applied by the SRB.
87 Nonetheless, the fact remains that the applicant’s objective was to obtain the erasure of his personal data, in particular his appraisal reports, as is apparent from the material in the file relating, in particular, to the procedure before the SRB.
88 It is also apparent from the file that the applicant did not, in the complaint, develop any legal argument concerning the examination of the retention period for personal data in the light of the principle of proportionality.
89 In the complaint, the applicant argued that the 120-year retention period for personal data that was applied by the SRB infringed his rights enshrined in Articles 19, 20 and 23 of Regulation 2018/1725, without in any way substantiating his arguments, even though those provisions do not relate to the retention period for personal data.
90 Furthermore, the proportionality of the retention period for personal data that was applied by the SRB was not advanced by the applicant as such, but in the context of invoking a breach of his individual rights as a data subject under Articles 19, 20 and 23 of Regulation 2018/1725.
91 Therefore, the EDPS did not make an error of assessment in finding that the subject matter of the applicant’s complaint was limited to the request seeking erasure, the right to object, and the right to restrict the processing of the applicant’s personal data.
92 It follows that, in the present case, the EDPS did not err in law in not examining the future exercise of the right to erasure, of the right to object or of the right to restrict the processing of personal data, or any arguments relating to the lawfulness of the 120-year retention period for personal data that was applied by the SRB to personal files.
93 In addition, as the EDPS indeed rightly noted in the second contested decision, if the applicant wished to contest those elements, he could lodge a new complaint with the EDPS, in order to enable the issue of the proportionality of the retention period for personal data that was applied by the SRB to be examined in relation to the purposes for which the data were processed, in compliance with the adversarial principle and the rights of defence of all the parties to the dispute.
94 Moreover, it is clear from the documents in the file that the applicant lodged such a request with the EDPS on 7 August 2021, concerning the retention period for personal data that was applied by the SRB, which expressly refers to the complaint in the present case.
95 Consequently, without prejudice to the merits of that request, the objections alleging infringement of Article 4(1)(e) of Regulation 2018/1725, in relation to the retention period for the applicant’s personal data, and of Article 8 and Article 52(1) of the Charter, relating to the protection of personal data and the principle of proportionality, which in essence accord with the arguments previously examined, must also be rejected.
96 Similarly, it must be found that the alleged infringement of Article 7 of the Charter, relating to the protection of private and family life, has not been substantiated in any way before the Court and must be rejected.
97 In the third place, the applicant alleges infringement of the right to good administration, guaranteed by Article 41 of the Charter, in the context of the claim for annulment and submits in that regard that the EDPS failed to act diligently in the conduct of his investigation of the complaint.
98 It must be borne in mind that the duty to act diligently which is inherent in the principle of sound administration and applies generally to the actions of the EU administration in its relations with the public requires that that administration act with care and caution (judgment of 4 April 2017, Ombudsman v Staelen, C‑337/15 P, EU:C:2017:256, paragraph 34; see also, to that effect, judgment of 16 December 2008, Masdar (UK) v Commission, C‑47/07 P, EU:C:2008:726, paragraphs 92 and 93).
99 In the present case, in so far as the applicant complains of the time taken to deal with his requests, that argument must be rejected. The applicant lodged his complaint on 20 March 2020, was invited, as was the SRB, to submit observations and he himself requested an extension of the time limit for responding on 14 June 2020. Accordingly, in the light of the material in the file, the first contested decision cannot be regarded as having been adopted within an unreasonable period of time.
100 In so far as the applicant maintains that the EDPS ought to have examined the complaint in a more ‘open-minded manner’ and that he ought to have taken into consideration all the elements of the file, that argument must be rejected.
101 In the circumstances of the present case and in the light of the complaint before the EDPS, the principle of sound administration did not require him to exercise his powers of investigation. Moreover, as the EDPS states, this would not have had any impact on the conclusion that the applicant was not entitled to erasure of his personal data held by the SRB as at the date of the first contested decision, namely 18 January 2021, since the applicant’s personal data had been stored only since the date of his resignation, namely 30 September 2019.
102 In addition, in the first contested decision, the EDPS drew the SRB’s attention to the Common Commission-level retention list of the European Commission files in its second updated version (SEC(2019)900), as well as the EDPS Guidelines concerning the processing operations in the field of staff recruitment, even though those texts were not applicable to the applicant’s case, who worked for the SRB until September 2019. The EDPS thus observed that they recommended a retention period for personal data stored in personal files under Article 26 of the Staff Regulations of 10 years as from the termination of employment or as from the last pension payment and it is apparent from its answer to the Court’s question, sent on 10 March 2022, that the SRB took that statement into account.
103 In that context, the EDPS did not infringe the right to good administration.
104 It follows that the claim for annulment directed against the first contested decision must be dismissed.
The claim against the second contested decision
105 By the second contested decision, the EDPS refused the request for review of the first contested decision, submitted by the applicant on the basis of Article 18(1) of the EDPS Rules of Procedure. In essence, first, he found that the applicant had not provided any new evidence or arguments which would justify a review of the first contested decision. Secondly, he found, in the subsequent paragraphs of his decision, that the future exercise of the right to erasure and of other rights, such as the right to object and right to restriction of the processing of personal data, as well as any arguments relating to the lawfulness of the 120-year retention period applied by SRB to personal files, had not been subject to the EDPS investigation in the context of the complaint case and that those elements could not, therefore, be addressed within the framework of the review procedure.
106 It must be borne in mind that, under Article 18 of the EDPS Rules of Procedure, the ‘EDPS shall review its decision where the complainant or institution advances new factual evidence or legal arguments’, which must logically relate to the subject matter of the complaint and to the content of the decision relating to it.
107 In the present case, in the complaint of 20 March 2020, the wording of which is reproduced in paragraphs 16 to 18 above, the applicant requested the erasure of his personal data. He also asserted his right to object and his right to the restriction of the processing of those data.
108 Those requests were refused by the first contested decision, from which it is apparent that all those requests were indeed dealt with by the EDPS. It is not apparent from the applicant’s request for review that, as regards his request seeking erasure, to object and for restriction of the processing of his personal data, he advanced new evidence which was not taken into account by the EDPS.
109 It follows that the EDPS was right to find, in the context of the request for review, that no new evidence had been produced by the applicant as regards his requests already examined in the context of the first contested decision.
110 In addition, in the context of the challenge to the retention period for his personal data, the applicant produced, inter alia, several documents relating to the personal-data protection policies of various EU agencies, arguing that it was instrumental for him to know and understand when time-wise his rights could be exercised. The applicant submitted that the EDPS should have assessed the proportionality of the duration of the SRB’s retention period for personal data and the purposes thereof.
111 However, it must be stated that, in that respect, the subject matter of the request for review differed from that of the complaint and from that of the first contested decision, with the result that the evidence produced in the request for review could not be accepted, pursuant to Article 18 of the EDPS Rules of Procedure, for the purposes of a review by the EDPS of the first contested decision.
112 The EDPS was, therefore, fully entitled to find that the future exercise of the rights relied upon by the applicant, as well as any arguments relating to the lawfulness of the 120-year retention period for personal data that was applied by the SRB, had not been subject of the complaint of 8 March 2020 before the SRB and that of 20 March 2020 before the EDPS, that they had not, therefore, been subject to an EDPS investigation and that they could not be addressed within the framework of the review procedure.
113 The applicant’s argument that his complaint related not only to erasure, but also to objection and to the restriction of the processing of personal data and that the EDPS wrongly failed to take into account that objection and that request for restriction of the processing of personal data, in refusing his request for review, must be rejected. The EDPS took into account all the applicant’s requests. In addition, that argument is based upon a misreading of the second contested decision, since it was in the context of his analysis relating to the request for review concerning the future exercise of the rights relied upon and the proportionality of the duration that the EDPS referred to the request for erasure submitted on 8 March 2020 to the SRB.
114 Consequently, the EDPS was fully entitled to find that those arguments could not be dealt with in the context of the review procedure. The arguments based upon infringement of the principle of good administration must be rejected for the same reasons as those set out in paragraphs 101 to 103 above.
115 Accordingly, the claim for annulment directed against the second contested decision and, therefore, the claim for annulment in its entirety must be dismissed.
The claim for compensation
116 In support of his claim for compensation, the applicant submits that all the conditions for liability on the part of the EDPS are met in the present case.
117 First of all, the applicant submits that Article 8 of the Charter, the duty to act diligently and the principle of good administration, including the principle that procedures must be conducted within a reasonable time, enshrined in Article 41 of the Charter, and Regulation 2018/1725 confer rights on individuals.
118 Secondly, in the present case, there is a sufficiently serious breach by the EDPS of the duty to act diligently and of the principle of good administration, because, by failing to act with all the requisite care and caution, the EDPS gravely and manifestly disregarded the limits on his discretion in the exercise of his power to investigate complaints and requests for revision.
119 Next, the applicant submits that the infringement of the principle of good administration, in particular of the reasonable time principle, allowed the SRB to repeat ongoing infringements of his personal data, thereby causing him damage, assessed ex aequo et bono at EUR 20 000.
120 Lastly, the applicant submits that the damage sustained is a sufficiently direct consequence of the seriously unlawful conduct of the EDPS, which is the determinant cause of the damage sustained.
121 The EDPS contends that the claim for compensation should be dismissed, since none of the conditions for him to incur liability are met.
122 In that regard, it must be borne in mind that in order for the European Union to incur non-contractual liability under the second paragraph of Article 340 TFEU and for the right to compensation to be enforceable, a number of conditions must be satisfied: the conduct alleged against the institutions must be unlawful, actual damage must have been suffered and there must be a causal link between that conduct and the damage complained of. That liability cannot be regarded as having been incurred without satisfaction of all the conditions to which the duty to make good any damage, as defined in the second paragraph of Article 340 TFEU, is thus subject (see judgment of 3 July 2018, Transtec v Commission, T‑616/15, EU:T:2018:399, paragraph 164 and the case-law cited).
123 In the present case, it is apparent from the Court’s findings that no unlawfulness vitiating the first contested decision or the second contested decision has been established.
124 Accordingly, the applicant’s claim for compensation must be dismissed and, therefore, the action must be dismissed in its entirety.
Costs
125 Under Article 134(1) of the Rules of Procedure, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings.
126 Since the applicant has been unsuccessful, he must be ordered to bear his own costs and to pay those incurred by the EDPS, in accordance with the form of order sought by the EDPS.
On those grounds,
THE GENERAL COURT (First Chamber)
hereby:
1. Dismisses the action;
2. Orders JS to pay the costs.
Spielmann | Valančius | Mastroianni |
Delivered in open court in Luxembourg on 6 September 2023.
[Signatures]