Order — ECLI:EU:T:2026:86
Date: 2026-02-02
Language of the case: English
Court formation: Fourth Chamber
Procedure: Action for damages

summary form, coherently and intelligibly in the application itself. Whilst the body of the application may be supported and supplemented on specific points by references to extracts from documents annexed thereto, a general reference to other documents, even those annexed to the application, cannot make up for the absence of the essential arguments in law which, in accordance with those provisions, must appear in the application (see judgment of 13 February 2025, Commission and Others v Carpatair, C‑244/23 P to C‑246/23 P, EU:C:2025:87, paragraph 76 and the case-law cited; judgment of 23 July 2025, UBS Group and Others v Commission, T‑84/22, EU:T:2025:752, paragraph 66). 30 Thus, it is not for the General Court to supplement the line of argument put forward by the applicant in his application, by searching for and identifying, in the annexes thereto, evidence capable of supporting that line of argument (see, to that effect, judgment of 13 February 2025, Commission and Others v Carpatair, C‑244/23 P to C‑246/23 P, EU:C:2025:87, paragraph 77). 31 In the present case, it must be stated that most of the references to the annexes in the application are not to a specific page of one of those annexes but to the first page of the annex in question, even where that annex consists of several pages. 32 That is in particular the case with the references made in footnotes 3, 4, 8, 17 to 22, 24, 27, 32, 34 and 57, which, moreover, do not use any alternative method of identifying the relevant passages of the annexes to which they refer. 33 In addition, some references are made by pointing to pages that clearly do not correspond to the annex in question (footnotes 7, 11, 12, 26, 29 and 64) or use unintelligible syntagmas (footnotes 26 and 27). 34 Furthermore, the applicant refers on numerous occasions to documents, scientific or press articles, and judgments, in particular of the European Court of Human Rights, by merely citing references to those documents, without specifying the relevant paragraph(s) supporting his claim, or without producing them in an annex (footnotes 33, 35, 42 to 44, 46 to 49, 51, 52, 55, 60, 61, and 66 to 69). 35 It follows that the references listed in paragraphs 32 to 34 above cannot be taken into consideration for the purpose of examining the present action, in particular for the purpose of identifying the acts that the applicant has alleged on the part of Eurojust and Europol. The scope of the alleged joint and several liability of Eurojust and Europol and the jurisdiction of the General Court to hear and determine that matter 36 It must be borne in mind that the EU judicature has jurisdiction over an action for damages based on Articles 268 and 340 TFEU only if the unlawful conduct alleged in support of the claim for compensation is truly the responsibility of an EU institution, body, office or agency, and cannot be regarded as attributable to a national authority (see, to that effect, judgment of 16 December 2020, Council v K. Chrysostomides Co. and Others, C‑597/18 P, C‑598/18 P, C‑603/18 P and C‑604/18 P, EU:C:2020:1028, paragraphs 80, 106 and 107). 37 Furthermore, where liability on the part of the European Union is involved on account of an act or conduct of one of its institutions or of one of its bodies, offices or agencies, the European Union is represented before the General Court by the institution(s), body or bodies, office(s) or agency or agencies against which the matter giving rise to liability is alleged (judgment of 13 November 1973, Werhahn Hansamühle and Others v Council and Commission, 63/72 to 69/72, EU:C:1973:121, paragraph 7). 38 Thus, the liability of the European Union on the basis of Articles 268 and 340 TFEU cannot be sought from an EU institution, body, office or agency other than that against which the matter giving rise to liability is alleged, unless the EU legislature has expressly provided for a derogating system of joint and several liability either between one of those EU institutions, bodies, offices or agencies and one or more Member States or one or more third countries, or between several EU institutions, bodies, offices or agencies (see, by analogy, judgment of 5 March 2024, Kočner v Europol, C‑755/21 P, EU:C:2024:202, paragraphs 62 and 63). 39 In the present case, the applicant claims that the Court of Justice established, in the judgment of 5 March 2024, Kočner v Europol (C‑755/21 P, EU:C:2024:202), that ‘Europol and Eurojust can be (jointly and severally) held responsible and liable for damages suffered by an individual as a result of actions for which there is joint responsibility’. The applicant has inferred from that that those two agencies may be held jointly and severally liable for all of the heads of damage on which he relies. 40 It must be stated, however, that the applicant’s assertion is based on a manifestly incorrect reading of the judgment of 5 March 2024, Kočner v Europol (C‑755/21 P, EU:C:2024:202), and of the rules on liability applicable to Europol and Eurojust. 41 First, it is true that, in the judgment of 5 March 2024, Kočner v Europol (C‑755/21 P, EU:C:2024:202, paragraphs 62 and 63), the Court of Justice recognised the existence of joint and several liability on the part of Europol on the basis of a combined reading of Article 49(3) and Article 50 of Regulation 2016/794, read in the light of recital 57 of that regulation. 42 Nevertheless, the joint and several liability recognised in the judgment of 5 March 2024, Kočner v Europol (C‑755/21 P, EU:C:2024:202, paragraphs 62 and 63), applies only between Europol and the Member States and, furthermore, is limited solely to damage arising from unlawful processing of personal data in the context of cooperation under Regulation 2016/794 between that agency and one or more Member States. 43 Second, it is true that it is clear from Article 55(2) of Regulation 2018/1727 and from Article 38(6) of Regulation 2016/794 that Eurojust and Europol may be held jointly and severally liable for an illegal transfer of personal data by Europol to Eurojust at Eurojust’s request or for an illegitimate transfer of operational personal data by Eurojust to Europol at Europol’s request. 44 Nevertheless, the applicant has not relied on the provisions of Article 38(6) of Regulation 2016/794 or of Article 55(2) of Regulation 2018/1727. 45 On the contrary, the applicant has expressly based his claims for compensation on Article 50 of Regulation 2016/794, the scope of which has been recalled in paragraph 42 above, and on Article 46 of Regulation 2018/1727, paragraph 1 of which provides that Eurojust is liable, in accordance with Article 340 TFEU, for any damage caused to an individual which results from the unauthorised or incorrect processing of data carried out by that agency, and paragraph 3 of which provides that each Member State is liable, in accordance with its national law, for any damage caused to an individual which results from the unauthorised or incorrect processing carried out by it of data which were communicated to Eurojust. 46 Furthermore, it is not apparent from the application that the applicant is relying on illegal or illegitimate exchanges of personal data between the defendants. 47 It follows from that that, in the context of the present action, the applicant may seek to establish only, first, liability on the part of Eurojust for its own actions and, second, liability on the part of Europol for damage caused by its departments or by its staff in the performance of their duties, pursuant to Article 49(3) of Regulation 2016/794, and for damage caused by unlawful processing of his personal data that occurred in one of the Member States concerned in the context of cooperation between Europol and those States, pursuant to Article 50 of Regulation 2016/794. 48 Thus, the Court manifestly lacks jurisdiction to hear and determine the present action in so far as that action is seeking a finding, first, that Eurojust is jointly and severally liable for acts on the part of the Member States, of Europol or of third countries, and, second, that Europol is jointly and severally liable for acts other than unlawful processing of personal data or for the acts of Eurojust or of third countries. 49 In the context of the heads of claim for compensation, the Court must therefore reject as having been brought before a court which has no jurisdiction to hear and determine it the part of the first plea in law, as well as the third plea in law in its entirety, alleging a breach of the right to a fair trial by the Italian criminal courts on account of alleged impossibility of becoming acquainted with the evidence adduced against the applicant by those courts and, therefore, of verifying the legality, reliability, authenticity, integrity or admissibility thereof. 50 Such criticisms, even though they have a link with the personal data alleged to have been processed by Eurojust and Europol, do not concern the possibly unlawful processing of those data but rather the procedural rules – and more specifically, the evidentiary rules – applied to those data by the Italian criminal courts. Given that the damage is not the result of unlawful data processing occurring in the context of cooperation involving Europol and a Member State, joint and several liability under Article 50(1) of Regulation 2016/794 is not applicable. 51 The same is true of the criticisms, also set out in the first plea in law, alleging a breach of the right to a fair trial on account of the French authorities’ refusal to authorise officers of the French police to appear before the Italian courts. The jurisdiction of the General Court to hear and determine the matter of the collection by the Member States concerned of data from the ‘Sky ECC’ service 52 In the context of his second plea in law, the applicant seeks to establish liability on the part of Europol on account, in particular, of the interception of personal data from the ‘Sky ECC’ service by the French and Netherlands police authorities. 53 Nevertheless, it is clear from Article 276 TFEU that, in exercising its powers regarding the provisions of Chapters 4 and 5 of Title V of Part Three of the FEU Treaty, relating to the area of freedom, security and justice, the EU judicature has no jurisdiction to review the validity or proportionality of operations carried out by the police or other law enforcement services of a Member State. 54 Thus, despite the system of joint and several liability laid down in Article 50(1) of Regulation 2016/794, Europol cannot be held jointly and severally liable for any damage resulting from unlawful processing of personal data of a natural person occurring in the course of operations carried out by the police or other law enforcement services of a Member State, even if that processing took place in the context of cooperation based on that regulation (see, by analogy with Article 275 TFEU, judgment of 10 September 2024, KS and Others v Council and Others, C‑29/22 P and C‑44/22 P, EU:C:2024:725, paragraph 91). 55 Therefore, the Court does not have jurisdiction to hear and determine the applicant’s claims alleging damage caused to him as a result of the interception of his personal data in the course of police operations carried out by the French or the Netherlands authorities. The action in so far as it concerns Eurojust Admissibility 56 Eurojust disputes the admissibility of the action in so far as it is directed against it. In particular, according to Eurojust, the applicant has failed to identify the allegedly unlawful conduct of which that agency is accused. 57 In that regard, Eurojust disputes that it contributed to the acquisition of all the data from the ‘Sky ECC’ service, that it was one of the recipients of those data, that it participated in their decryption, that it had access to them or that it was involved in the storage or further processing thereof. 58 By contrast, Eurojust acknowledges that it intervened in November 2021 to facilitate the transmission and execution by the French authorities of a European Investigation Order issued by the Italian authorities with a view to obtaining the data linked to the applicant’s Sky ECC identifiers. Eurojust states that, to that end, in particular, it transmitted by email to the Italian authorities a web link provided by the French authorities, which allowed the Italian authorities to download those data for a week. However, Eurojust states that it never accessed the applicant’s chats transmitted in that manner. 59 Furthermore, Eurojust contends that the applicant has not substantiated any of the heads of damage on which he relies. 60 In order to satisfy the requirements recalled in paragraph 29 above, an application seeking compensation for damage alleged to have been caused by an EU agency must state the evidence from which the conduct which the applicant alleges against the agency can be identified, the reasons why the applicant considers there is a causal link between the conduct and the damage he, she or it claims to have suffered, and the nature and extent of that damage (see judgment of 20 July 2017, ADR Center v Commission, T‑644/14, EU:T:2017:533, paragraph 66 and the case-law cited). 61 In the present case, even though the application is not structured around the three cumulative conditions for establishing non-contractual liability on the part of the European Union, it makes it possible to understand that the applicant seeks, in essence, to establish non-contractual liability on the part of Eurojust for a proportion of EUR 50 000, in respect of non-material damage resulting from various types of conduct on the part of that agency. 62 In that regard, the applicant has referred to a refusal by Eurojust to allow former members of staff to appear before an Italian court, to repeated refusals by that agency to act on his requests for access to his personal data held by it, and to a failure on the part of that agency to comply with the obligations laid down in Articles 89 and 92 of Regulation 2018/1725. 63 Such unlawful conduct alleged on the part of Eurojust must be considered sufficiently identifiable. 64 The applicant has further referred to unauthorised or incorrect processing of data carried out by Eurojust, within the meaning of Article 46(1) of Regulation 2018/1727. 65 It is therefore necessary to examine whether the applicant has identified the processing of his personal data for which he criticises Eurojust. 66 In that regard, Eurojust has acknowledged that, in November 2021, it transmitted to the Italian authorities the applicant’s personal data that it had previously received from the French authorities, in the context of a European Investigation Order. 67 That transmission of November 2021 must therefore be considered to be identified and established. 68 By contrast, as regards the applicant’s claims that Eurojust was involved in the processing of data from the ‘Sky ECC’ service other than the transmission of November 2021, the applicant has not indicated the basic matters of fact making it possible to identify conduct on the part of Eurojust capable of giving rise to non-contractual liability on that agency’s part (see paragraph 60 above), in accordance with Articles 268 and 340 TFEU, read in conjunction with Article 46(1) of Regulation 2018/1727. 69 First of all, it must be noted that the applicant claims that the personal data concerning him alleged to have been processed by Eurojust ‘form the core evidence in the charges against him’, which implies that that evidence is available to him. However, he has not disclosed any such evidence in the context of the application. 70 Next, it is true that the applicant has provided evidence in support of his claims. Nevertheless, the general nature of that evidence does not make it possible to identify any processing of his personal data by Eurojust other than the transmission of November 2021. 71 More specifically, the testimony given by a member of Eurojust’s staff in an Italian criminal trial which does not relate to the applicant and in which that member of staff refers, inter alia, to the ‘Sky ECC’ service is not such as to identify processing of the applicant’s personal data by Eurojust, especially where that member of staff has himself acknowledged that he ‘does not know the precise details of the investigations into … Sky ECC’. 72 The same is true of the minutes of a witness hearing in an Italian criminal case which also does not relate to the applicant, and of the applicant’s assertions, supported by a reference to a judgment of the European Court of Human Rights, that ‘Eurojust [had] supported unlawful investigative actions’. 73 Lastly, the mere fact that Eurojust organised coordination meetings between the parties to the JIT does not permit the inference that Eurojust collected, received, stored, transmitted or analysed the applicant’s personal data, or, a fortiori, the identification of any unauthorised or incorrect processing of those personal data, within the meaning of Article 46(1) of Regulation 2018/1727. 74 Consequently, the second plea in law, in so far as it concerns Eurojust, must be rejected as manifestly inadmissible as regards the applicant’s claims that Eurojust was involved in the processing of data from the ‘Sky ECC’ service, except inasmuch as that plea concerns unlawful processing of data resulting from the transmission of November 2021. 75 By contrast, the action against Eurojust is admissible inasmuch as it concerns Eurojust’s alleged refusal to allow former members of staff to appear before an Italian court and that agency’s alleged repeated refusals to act on the applicant’s requests for access to his personal data held by it (first plea in law), the allegedly unlawful processing of the applicant’s data resulting from the transmission of November 2021 (second plea in law), and the alleged failures on the part of that agency to comply with the obligations laid down in Articles 89 and 92 of Regulation 2018/1725 (fourth plea in law). Substance 76 In the light of the foregoing observations concerning the Court’s lack of jurisdiction to hear and determine a part of the first plea in law and the third plea in law in its entirety and the partial inadmissibility of the second plea in law, the view must be taken that, by his action, the applicant seeks to establish liability on the part of Eurojust on the basis of the following three pleas in law. 77 In the context of his first plea in law, the applicant relies on a breach of his right to a fair trial and of the principles of equality of arms, fairness and legality, on account of a refusal by Eurojust to allow former members of its staff to respond to a summons from the Italian courts and on account of a refusal by agency to act on ‘numerous, insistent requests by [the applicant] for disclosure of documents critical to his … defense’. According to the applicant, that refusal has deprived him of the possibility of obtaining full access to his personal data held by Eurojust and thus of verifying the legality, reliability, authenticity and integrity of the data concerning him held by that agency. Furthermore, the applicant alleges disregard on the part of Eurojust for the refusal of the French authorities to allow two of its members of staff to appear (see paragraph 51 above) and, more generally, for his situation. 78 In his second plea in law, the applicant claims that the processing of his personal data was unlawful and disproportionate. He asserts that Eurojust ‘orchestrated the Sky ECC … operation’, aimed at an indiscriminately targeted group of persons, including lawyers, thereby infringing the obligation of professional secrecy. 79 In his fourth plea in law, the applicant refers to concerns relating to, first, the adoption of appropriate security measures in the processing of his personal data, second, the actual conduct of an impact assessment prior to the processing of those data and, in essence, third, the absence of a notification to the European Data Protection Supervisor (EDPS) of a breach of those data. 80 As regards the first plea in law, it must be stated, as, moreover, Eurojust has asserted, that the applicant has not provided any evidence capable of establishing that he made any request for access to personal data concerning him held by that agency. 81 The applicant cannot therefore legitimately criticise that agency for failing to act on such a request. 82 The applicant has not provided any further evidence capable of establishing that Eurojust refused to allow former staff members to appear in the criminal proceedings to which he claims to be subject in Italy. 83 As Eurojust states, it appears that the summons, to which the applicant refers in Annex A.27 to the application and which, in his submission, was refused by Eurojust, was made in Italian criminal proceedings unrelated to the applicant, as is evident from the list of persons appearing on page 250 of Annex A.15. 84 Lastly, the applicant has not substantiated either the actual existence of the disregard which he alleges on the part of Eurojust or the grounds of its unlawfulness. 85 As regards the second plea in law, the applicant has not established that the transmission of November 2021 gave rise to unlawful processing of his personal data. 86 In the first place, Article 45(2)(b) of Regulation 2018/1727 provides that responsibility for the accuracy of operational personal data lies with the Member State which provided the data to Eurojust where, as in the present case, the data provided have not been altered in the course of processing by that agency, which has not been disputed by the applicant. 87 In the second place, it must be stated that, as regards the making available by the French authorities of the applicant’s data to the Italian authorities via Eurojust, there is nothing to indicate that that processing of personal data was not fair, lawful and carried out for specified, explicit and legitimate purposes, within the meaning of Article 71(1)(a) and (b) of Regulation 2018/1725, applicable to Eurojust by reference to Article 26 of Regulation 2018/1727. 88 First, that processing came within the scope of tasks of Eurojust and was necessary for the performance thereof. Second, it is not apparent from any of the documents in the file that the applicant’s personal data were processed for purposes other than those tasks, as provided also in Article 72 of Regulation 2018/1725, applicable to Eurojust by reference to Article 26 of Regulation 2018/1727. Third, that processing was carried out at the request of the French authorities and in execution of a European Investigation Order issued by the Italian authorities. 89 Furthermore, the making available of the applicant’s chats to the Italian authorities by the French authorities via Eurojust was also proportionate and sufficiently secure, for the purposes of Article 71(1)(c), (d) and (f) of Regulation 2018/1725, applicable to Eurojust by reference to Article 26 of Regulation 2018/1727. That making available took the form of the provision of a web link, by the French authorities, to a password-protected download website, and there is nothing to call into question the assertion that Eurojust refrained from accessing the data in question and did not download, store or copy those data in its IT systems. 90 As regards the fourth plea in law, it must be stated that the applicant’s assertions that Eurojust failed to comply with its obligation to adopt appropriate technical and organisational measures in order to ensure a level of security appropriate to the risk are not supported by any evidence or prima facie evidence. 91 The applicant has not established that, as a result of such a failure, his personal data have been the subject, in particular, of unauthorised disclosure, alteration or access or of any other unauthorised form of processing. 92 The applicant’s mere unsubstantiated concern that a breach of his personal data might have occurred cannot suffice to establish that Eurojust failed to fulfil its obligations. 93 Similarly, the applicant has not explained in what way Eurojust failed to fulfil its obligation to carry out an impact assessment prior to the transmission to the Italian authorities of the web link provided by the French authorities to a secure website containing his chats from the ‘Sky ECC’ service. 94 That transmission, in respect of which there is nothing to indicate that it posed a particular risk to the applicant’s rights and freedoms or at least a higher risk than other means of transmission, did not warrant the conduct of the prior impact assessment provided for in Article 89 of Regulation 2018/1725, applicable to Eurojust by reference to Article 26 of Regulation 2018/1727. 95 Furthermore, having failed to demonstrate, on one ground or other, that Eurojust committed a breach of his personal data, the applicant cannot complain that that agency failed to fulfil its obligation, laid down in Article 92 of Regulation 2018/1725, to notify the EDPS of such a breach, applicable to that agency by reference to Article 26 of Regulation 2018/1727. 96 Since the applicant has failed to demonstrate any infringement of EU law attributable to Eurojust and since the conditions for establishing non-contractual liability on the part of the European Union are cumulative (see judgment of 30 November 2022, KN v Parliament, T‑401/21, EU:T:2022:736, paragraph 34 and the case-law cited), there is no need to examine whether the other conditions laid down by the case-law are satisfied. 97 In the light of the foregoing, the action, in so far as it is directed against Eurojust, must be dismissed, in part on the ground of manifest lack of jurisdiction, in part as manifestly inadmissible, and in part as manifestly unfounded. The action in so far as it concerns Europol Admissibility 98 Europol disputes the admissibility of the action in so far as it is directed against it. According to Europol, the applicant has failed to identify the allegedly unlawful conduct of which that agency is accused, nor the damage on which he relies or the link between that conduct and that damage. 99 In the present case, the applicant seeks, in essence, to establish non-contractual liability on the part of Europol for a proportion of EUR 50 000, in respect of non-material damage resulting from various types of conduct on the part of that agency. 100 As regards the acts complained of, the applicant has sufficiently identified a refusal by Europol to allow former members of staff to appear before an Italian court, repeated refusals by that agency to act on his requests for access to his personal data held by it, and a failure on the part of that agency to comply with the obligation laid down in Article 32 of Regulation 2016/794 (see, by analogy, paragraph 63 above). 101 By contrast, as regards the applicant’s claims relating to unlawful processing of his personal data by Europol or by Member States in respect of which Europol could be held jointly and severally liable, it must be stated that the applicant has indeed referred to personal data processing in the context of the investigation relating to the ‘Sky ECC’ service. However, he has not identified any such processing concerning him personally, even though he has evidence of such processing (see, by analogy, paragraphs 68 to 73 above). 102 Consequently, in accordance with the case-law recalled in paragraphs 29 and 60 above, the second plea in law, in so far as it concerns Europol, must be rejected as manifestly inadmissible. 103 By contrast, the action, in so far as it concerns Europol, is admissible inasmuch as it concerns Europol’s alleged refusal to allow former members of staff to appear before an Italian court and that agency’s alleged repeated refusals to act on the applicant’s requests for access to his personal data held by it (first plea in law) as well as the alleged failure on the part of that agency to comply with the obligations laid down by Article 32 of Regulation 2016/794 and Articles 89 and 92 of Regulation 2018/1725 (fourth plea in law). Substance 104 In the light of the foregoing remarks concerning the Court’s lack of jurisdiction to hear and determine a part of the first plea in law and the third plea in law in its entirety and the inadmissibility of the second plea in law, it must be stated that, by his action, the applicant seeks to establish liability on the part of Europol on the basis of two pleas in law. 105 By his first plea, the applicant relies, as in the case of Eurojust, on a breach of his right to a fair trial and of the principles of equality of arms, fairness and legality, on account of a refusal by that agency to allow former members of its staff to respond to a summons from the Italian courts, a refusal by that agency to act on ‘numerous, insistent requests by [the applicant] for disclosure of documents critical to his … defense’, and disregard on the part of that agency for the applicant’s situation. 106 By his fourth plea in law, the applicant refers to concerns relating to, first, the adoption of appropriate security measures in the processing of his data, second, the actual conduct of an impact assessment prior to that processing, and, in essence, third, the absence of a notification to the EDPS of a breach of those data. 107 As regards the first plea in law, it has already been found that the document on which the applicant relies in order to establish that Europol refused to allow former members of its staff to respond to a summons from the Italian courts concerns Italian criminal proceedings unrelated to him (see paragraphs 82 and 83 above), and that that document does not substantiate either the actual existence of the disregard which he alleges on the part of Europol or the grounds of its unlawfulness (see, by analogy, paragraph 84 above), ruling out the possibility that those criticisms may succeed. 108 As regards Europol’s refusal to act on the applicant’s two requests of 22 March and 2 September 2022, seeking to obtain the personal data concerning him that were in the possession of that agency, it must, first of all, be noted that the applicant has not disputed, inter alia on the basis of Article 47(2) of Regulation 2016/794, at the very least, the negative response provided by that agency on 21 April 2022, to which he refers in his second request. 109 Next, the applicant has neither provided, in the application, Europol’s response to his first request nor claimed that Europol failed to respond to his second request. 110 Lastly, the applicant has not explained why the refusals on which he relies infringe, in particular, Article 36(6) of Regulation 2016/794, according to which the provision of information in response to a request may be refused or restricted if such refusal or restriction constitutes a measure that is necessary in order to enable Europol to fulfil its tasks properly, protect security and public order or prevent crime, guarantee that any national investigation will not be jeopardised, or protect the rights and freedoms of third parties. 111 In those circumstances, the General Court is not in a position to assess the merits of the applicant’s criticisms, with the result that no infringement of EU law by Europol can be found. 112 As regards the fourth plea in law, it should be noted that Article 32 of Regulation 2016/794 imposes on Europol obligations in terms of data security similar to those imposed, in particular, on Eurojust by Article 91 of Regulation 2018/1725. 113 In those circumstances, the applicant’s criticisms relating to the security of his personal data must be rejected on the same grounds as those set out in paragraphs 90 to 92 above. 114 Furthermore, in so far as the applicant has relied on an infringement of provisions of Regulation 2018/1725, it must be stated, first, that that regulation was not applicable to Europol, prior to the amendment of Regulation 2016/794 by Regulation (EU) 2022/991 of the European Parliament and of the Council of 8 June 2022 amending Regulation (EU) 2016/794, as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role in research and innovation (OJ 2022 L 169, p. 1), which entered into force on 28 June 2022, and, second, that the applicant has not criticised that agency for any acts after that date. 115 Since the applicant has failed to demonstrate any infringement of EU law attributable to Europol and since the conditions for establishing non-contractual liability on the part of the European Union are cumulative, there is no need to examine whether the other conditions laid down by the case-law are satisfied. 116 In the light of the foregoing, the action, in so far as it is directed against Europol, must be dismissed, in part on the ground of manifest lack of jurisdiction, in part as manifestly inadmissible, and in part as manifestly unfounded. Costs 117 Under Article 134(1) of the Rules of Procedure, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings. Since the applicant has been unsuccessful, he must be ordered to pay the costs, in accordance with the forms of order sought by Eurojust and by Europol. In addition, in accordance with Article 138(1) of the Rules of Procedure, the Kingdom of the Netherlands is to bear its own costs. On those grounds, THE GENERAL COURT (Fourth Chamber) hereby orders: 1. The action is dismissed in so far as it is directed against the European Union Agency for Criminal Justice Cooperation (Eurojust). 2. The action is dismissed in so far as it is directed against the European Union Agency for Law Enforcement Cooperation (Europol). 3. GE shall bear his own costs and shall pay those incurred by Eurojust and by Europol. 4. The Kingdom of the Netherlands shall bear its own costs. Luxembourg, 2 February 2026. V. Di Bucci G. De Baere Registrar President * Language of the case: English.