ORDER OF THE GENERAL COURT (Tenth Chamber)
17 June 2024 (*)
(Action for annulment and for damages – Law governing the institutions – Protection of personal data – Regulation (EU) 2018/1725 – Rejection of the complaint to the EDPS concerning the processing of the applicant’s personal data – Revision of the contested decision – Partial disappearance of the subject matter of the dispute – No need to adjudicate in part – Action in part manifestly lacking any foundation in law)
In Case T‑546/23,
WS, represented by H. Tettenborn, lawyer,
applicant,
v
European Data Protection Supervisor (EDPS), represented by D. Nardi, T. Zerdick and X. Kapsosideri, acting as Agents,
defendant,
THE GENERAL COURT (Tenth Chamber),
composed of O. Porchia, President, P. Nihoul and S. Verschuur (Rapporteur), Judges,
Registrar: V. Di Bucci,
having regard to the written part of the procedure,
makes the following
Order
1 By his action, the applicant, WS, seeks, first, on the basis of Article 263 TFEU, the annulment of point (iii) of the decision of the European Data Protection Supervisor (EDPS) of 16 June 2023 not to act on the applicant’s complaint of 16 November 2022 concerning the request for access to his personal data which he had submitted to the European Personnel Selection Office (EPSO) on 18 June 2022 (‘the contested decision’) and, secondly, on the basis of Article 268 TFEU, compensation for the damage which he claims to have suffered as a result of the EDPS’ conduct towards him.
Background to the dispute
2 On 18 June 2022, the applicant submitted, pursuant to Article 17 of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ 2018 L 295, p. 39), a request to EPSO concerning four applications which were listed in his EPSO account following their transmission in connection with selection procedures concerning positions as a member of the contract staff with EPSO and the European Union Intellectual Property Office (EUIPO).
3 By his request, the applicant sought (i) to ascertain whether his personal data were still being processed, (ii) to identify the recipients to whom those data had been disclosed and (iii) to obtain a detailed report stating when and by whom his personal data had been accessed.
4 In its reply of 5 August 2022, EPSO disclosed information to the applicant concerning, first, the status of the processing of his personal data by EPSO and, secondly, information concerning the categories of recipients of his personal data and their function.
5 On 16 November 2022, the applicant filed a complaint with the EDPS against EPSO in which he clarified that he sought, in particular, access to the log files of his EPSO account. The applicant also stated that he did not find the information provided by EPSO ‘useful’.
6 On 16 June 2023, the EDPS adopted the contested decision, by which it found, first, that EPSO’s employees could not be regarded as recipients, since they were under the authority of the controller (point (i)); secondly, that EPSO had not infringed Regulation 2018/1725 by providing the applicant, in its reply of 5 August 2022, with the categories and functions of the employees who consulted his EPSO account (point (ii)), and, thirdly, that the log files did not contain the applicant’s personal data and that, therefore, he was not entitled to access that information pursuant to Article 17(1)(c) of Regulation 2018/1725 (point (iii)). Consequently, according to the EDPS, the fact that EPSO has not provided the applicant with the log files, including the identity of the EPSO employees who consulted his data under EPSO’s authority and in accordance with its instructions, or the time when they consulted his data, does not constitute an infringement of Article 17(1)(c) of Regulation 2018/1725.
7 On 4 July 2023, the applicant submitted a request for revision of the contested decision within the meaning of Article 18(1) of the Decision of the EDPS of 15 May 2020 adopting the Rules of Procedure of the EDPS (OJ 2020 L 204, p. 49), in which, by referring to the judgment of 22 June 23, Pankki S (C‑579/21, EU:C:2023:501), he requested the EDPS to reconsider its position in respect of his request for access to the log files concerning his EPSO account.
8 On 28 August 2023, pending the abovementioned review, the applicant brought the present action before the Court.
Facts subsequent to the bringing of the action
9 On 18 September 2023, the EDPS adopted a decision, notified to the applicant on 31 October 2023 (‘the revised decision’), in which, on the basis of the judgment of 22 June 2023, Pankki S (C‑579/21, EU:C:2023:501), it reconsidered its position as regards point (iii) of the contested decision, finding, inter alia, that the applicant had the right, in accordance with Article 17(1) and Article 58(2)(d) of Regulation 2018/1725, to obtain from EPSO the log files concerning his EPSO account, as well as clarifications on the time and purpose of each access generated by consultation operations relating to his EPSO account in connection with the four EPSO and EUIPO selection procedures in which he participated. Accordingly, the EDPS ordered EPSO to disclose those data to the applicant.
Forms of order sought
10 The applicant claims, in essence, that the Court should:
– annul point (iii) of the contested decision;
– order the EDPS to pay him compensation, in the discretion of the Court, for the non-material damage suffered by him as a result of the contested decision;
– order the EDPS to pay the costs.
11 In its plea of inadmissibility, the EDPS contends that the Court should:
– dismiss the action for annulment as inadmissible;
– dismiss the claim for compensation as manifestly unfounded;
– order the applicant to pay the costs.
Law
The claim for annulment
12 Pursuant to Article 130(2) and (7) of the Rules of Procedure of the General Court, on application by a party, the Court may declare that the action has become devoid of purpose and that there is no longer any need to adjudicate on it.
13 The EDPS, in its plea of inadmissibility, argues, in essence, that, on account of the adoption of the revised decision, the claim for annulment has become devoid of purpose. That finding is, in essence, shared by the applicant in his observations on the plea of inadmissibility.
14 In that regard, it should be noted that it follows from settled case-law that the subject matter of the dispute must continue, like the interest in bringing proceedings, until the final decision, failing which there will be no need to adjudicate, which presupposes that the action must be liable, if successful, to procure an advantage to the party bringing it (see, to that effect, judgment of 7 June 2007, Wunenburger v Commission, C‑362/05 P, EU:C:2007:322, paragraphs 42 and 43 and the case-law cited).
15 The disappearance of the subject matter of the proceedings can, inter alia, result from the withdrawal or replacement of the contested act in the course of the proceedings (order of 12 January 2011, Terezakis v Commission, T‑411/09, EU:T:2011:4, paragraph 15).
16 In the present case, as the parties agree, it must be held that the claim for annulment has become devoid of purpose. By the revised decision, the EDPS deleted point (iii) of the contested decision and ordered EPSO to give the applicant access to his log files in order to assess the lawfulness of EPSO’s processing activities in accordance with the judgment of 22 June 2023, Pankki S (C‑579/21, EU:C:2023:501).
17 Accordingly, it is undisputed that the applicant, by the revised decision, obtained the outcome that he sought by the present claim for annulment. The Court thus takes the view that the claim for annulment of point (iii) of the contested decision is now devoid of purpose and that there is no longer any need to adjudicate on it.
The claim for compensation
18 Under Article 126 of the Rules of Procedure, where it is clear that the Court has no jurisdiction to hear and determine an action or where the action is manifestly inadmissible or manifestly lacking any foundation in law, the Court may, on a proposal from the Judge-Rapporteur, at any time decide to give a decision by reasoned order without taking further steps in the proceedings.
19 In the present case, the Court considers that it has sufficient information from the documents in the file and decides, pursuant to Article 126 of the Rules of Procedure, to give its decision without taking further steps in the proceedings.
20 The applicant claims to have suffered non-material damage because the EDPS placed him in a state of permanent insecurity as to how his personal data were managed by the Commission and EUIPO. Moreover, according to the applicant, his position in any action against the Commission and EUIPO is weakened, since he would be unaware of the personal data concerned and he was not provided with any information as regards the date and purpose of the disclosure and consultation operations that would have allowed him to assess the lawfulness of the processing activities in respect of those data.
21 In his observations on the plea of inadmissibility, the applicant adds that he suffered from a number of medical conditions in the months preceding the adoption of the revised decision and that he had to give up his work in October 2022 due to a lack of time to cope with the EDPS’ conduct towards him. Accordingly, the applicant requests that the Court order the EDPS to pay him compensation of EUR 15 000 for the non-material damage he claims to have suffered.
22 The EDPS disputes those arguments.
23 In that respect, it must be recalled that, according to the case-law, the European Union’s non-contractual liability under the second paragraph of Article 340 TFEU for the unlawful conduct of its institutions or bodies is subject to the satisfaction of a set of conditions of a cumulative nature, namely the unlawfulness of the conduct alleged against the EU institution or body, the fact of damage and the existence of a causal link between the alleged conduct and the damage complained of (see judgment of 7 October 2015, Accorinti and Others v ECB, T‑79/13, EU:T:2015:756, paragraph 65 and the case-law cited).
24 If any one of the conditions referred to in paragraph 23 above is not satisfied, the action must be dismissed in its entirety and it is unnecessary to consider the other conditions (judgment of 10 December 2009, Antwerpse Bouwwerken v Commission, T‑195/08, EU:T:2009:491, paragraph 91).
25 In the present case, it must be held that, in his written pleadings, the applicant has not established that the conditions relating to the damage and to the causal link were satisfied. Accordingly, he has adduced no evidence making it possible to determine that damage had in fact been suffered as he claims. In addition, the applicant has not established in the application or in the claims made by him at the stage of the observations on the plea of inadmissibility that there is a causal link between the EDPS’ conduct and the damage he claims to have suffered.
26 It follows that the claim for compensation must be dismissed as manifestly lacking any foundation in law.
Costs
27 Under Article 137 of the Rules of Procedure, where a case does not proceed to judgment, the costs are to be in the discretion of the Court.
28 In the present case, it must be noted that the disappearance of the subject matter of the claim for annulment is the consequence of the adoption by the EDPS, after the present action was brought, of the revised decision, which, inter alia, ordered EPSO to give the applicant access to his log files.
29 Accordingly, the Court takes the view that, in the circumstances of the case, there are sufficient grounds to order the EDPS to bear its own costs and to pay those incurred by the applicant in connection with the claim for annulment.
30 Furthermore, it must be recalled that Article 134(1) of the Rules of Procedure provides that the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings. Since the applicant has been unsuccessful, he must be ordered to bear his own costs and to pay those incurred by the EDPS in relation to the claim for compensation, in accordance with the form of order sought by the EDPS.
31 In the light of the foregoing, the Court considers it fair in the circumstances of the case to order the applicant to bear half of his costs and to pay half of the costs incurred by the EDPS, and the EDPS to bear the other half of its own costs and to pay half of the costs incurred by the applicant.
On those grounds,
THE GENERAL COURT (Tenth Chamber)
hereby orders:
1. There is no longer any need to adjudicate on the claim for annulment.
2. The claim for compensation is dismissed as manifestly lacking any foundation in law.
3. WS shall bear half of his own costs and pay half of the costs incurred by the European Data Protection Supervisor (EDPS).
4. The EDPS shall bear half of its own costs and pay half of the costs incurred by WS.
Luxembourg, 17 June 2024.