Judgment;Information — ECLI:EU:T:2019:494
Date: 2019-07-11
Language of the case: English
Court formation: Fifth Chamber
Subject matter: Provisions governing the Institutions;Access to documents
Procedure: Action for damages - successful;Action for damages - unfounded;Application for measures of inquiry - unfounded

summary form in the application by putting forward complaints or arguments which are not contained therein (see, to that effect, judgment of 5 December 2006, Angelidis v Parliament, T‑416/03, EU:T:2006:375, paragraphs 92 and 93). 98 The Court therefore cannot, in the present case, rule on the observations and notes that the applicant has submitted in most of the annexes to her written pleadings. 99 As regards, more specifically, the admissibility of the action, it should be recalled that, pursuant to the first paragraph of Article 21, of the Statute of the Court of Justice of the European Union, which applies to the proceedings before the General Court in accordance with the first paragraph of Article 53 of the Statute, and Article 76(d) of the Rules of Procedure, the application must, in particular, contain the subject matter of the dispute and a summary of the pleas in law relied on. Those particulars must be sufficiently clear and precise to enable the defendant to prepare its defence and the Court to rule on the action, if necessary without any other supporting information. In order to guarantee legal certainty and sound administration of justice, it is necessary, in order for an action to be admissible, that the basic legal and factual particulars relied on be indicated, at least in summary form, coherently and intelligibly, in the application itself (see order of 14 March 2017, Todorov v Court of Justice of the European Union, T‑839/16, not published, EU:T:2017:194, paragraph 5 and the case-law cited). 100 In order to satisfy those requirements, an application seeking compensation for damage allegedly caused by an EU institution must state the evidence from which the conduct alleged against the institution may be identified, the reasons why the applicant considers that a causal link exists between that conduct and the damage which he claims to have suffered, and the nature and extent of that damage. A claim for any unspecified form of damages, however, is not sufficiently precise and must therefore be regarded as inadmissible (see judgment of 12 April 2013, Du Pont de Nemours (France) and Others v Commission, T‑31/07, not published, EU:T:2013:167, paragraph 112 and the case-law cited). 101 In the present case, it is clear from the application that the applicant seeks compensation for the damage which she allegedly suffered as a result of FRA’s conduct, which she claims is unlawful, in the light of the rules of law conferring rights on an individual, including the provisions intended to ensure respect for the applicant’s personal data. She also sets out the reasons why she considers that there is a causal link between the allegedly unlawful conduct and the damage which she claims to have suffered, with the effect that the action must be found to be admissible. 102 FRA’s arguments cannot call that finding into question. 103 First, the action brought by the applicant does not contain multiple heads of claim, as FRA appears to contend, but rather a single head of claim seeking compensation for the damage suffered as a result of FRA’s allegedly unlawful conduct. 104 Secondly, the fact that any of the facts mentioned in the application or the annexes lodged in support of the action may not be relevant cannot entail the inadmissibility, even in part, of the action. 105 Thirdly, the bringing of the action under Article 268 TFEU, read in conjunction with Article 32(1) of Regulation No 45/2001, cannot confine the applicant to seeking compensation solely for damage arising from an infringement of the provisions of that regulation. 106 Article 32(1) of Regulation No 45/2001 pursues a single objective, namely that of confirming the jurisdiction of the Court of Justice of the European Union to hear actions for compensation brought in the event of infringement of the provisions of that regulation. 107 Accordingly, the action is admissible in its entirety. 2. The application to introduce a new plea in law 108 By document lodged at the Court Registry on 11 July 2017, the applicant made an application, under Article 84(1) of the Rules of Procedure, to introduce a new plea in law. 109 The applicant criticises FRA for its ‘alleged complicity [confidential]’, in breach of Article 54 of the Charter, the FEU Treaty and Regulation Nos 45/2001 and 1049/2001. 110 FRA takes the view that the application to introduce a new plea in law is inadmissible. 111 Under Article 84(1) of the Rules of Procedure, no new plea in law may be introduced in the course of proceedings unless it is based on matters of law or of fact which have come to light in the course of the procedure. 112 In accordance with Article 84(2) of the same rules, where appropriate, new pleas in law are to be introduced in the second exchange of pleadings and identified as such. Where the matters of law or of fact justifying the introduction of new pleas in law are known after the second exchange of pleadings or after it has been decided not to authorise a second exchange of pleadings, the main party concerned is to introduce the new pleas in law as soon as those matters come to his knowledge. 113 In the present case, the applicant argues, in order to justify the delay in introducing that new plea, that the matter of fact which she considers to have given rise to her application was revealed only on 11 May and 30 June 2017 when she (i) obtained a copy of the file [confidential]; and (ii) received FRA’s rejoinder and annexes thereto. 114 In the first place, while the applicant admittedly refers to the disclosure of the file [confidential] on 11 May 2017, she has failed to submit any evidence that the file was disclosed on that date. At most, she confines herself to stating that the file was disclosed to her, on that date, by a [confidential] lawyer. 115 In the second place, first, it is apparent from the file in the present case that the applicant had been informed [confidential]. 116 Second, the applicant had, at the very least, become aware, on 12 December 2016, [confidential]. 117 Third, even assuming that the file [confidential] was, as the applicant claims, communicated to her on 11 May 2017, the application to introduce a new plea in law was lodged late, namely on 11 July 2017, more than 2 months after that disclosure. The notification of the rejoinder on 30 June 2017 cannot call that finding into question, as the new plea in law is based almost exclusively on the annexes to the file [confidential]. 118 Accordingly, the application to introduce a new plea in law must be dismissed as inadmissible, as it was submitted late. 3. The application for the adoption of a measure of organisation of procedure 119 By document lodged with the Court Registry on 6 July 2017, the applicant requested that the General Court adopt a measure of organisation of procedure, pursuant to Articles 88 to 90 of the Rules of Procedure. 120 She claims, first, that the facts justifying the adoption of a measure of organisation of procedure emerged only recently, namely on 11 May and 30 June 2017, with the effect that the present request cannot be regarded as late. 121 She states, secondly, that the adoption of a measure of organisation of procedure would serve to (i) check whether a fresh leak of her personal data is to be imputed to FRA; (ii) establish whether FRA officials acted in the performance of their duties or in a private capacity; and (iii) clarify FRA’s position with regard to an annex to the rejoinder. 122 FRA takes the view that the request for measures of organisation of procedure must be rejected as inadmissible. 123 In that connection, in accordance with Article 89 of the Rules of Procedure, the purpose of measures of organisation of procedure is to ensure that cases are prepared for hearing, procedures carried out and disputes resolved under the best possible conditions. Measures of inquiry under Article 91 of the Rules of Procedure are intended to allow proof of the truth of the factual allegations made by a party in support of its case to be adduced. 124 There is no need to order a measure of organisation of procedure or of inquiry suggested by an applicant where its purpose is not to clarify the plea the applicant raised or to prove that its factual submissions are accurate, but rather appears to be an attempt to obtain new evidence in support of its action, unless the applicant raises specific complaints which can be checked or clarified by a request for information or for specific documents (judgment of 8 November 2000, Bareyt and Others v Commission, T‑175/97, EU:T:2000:259, paragraphs 89 to 91). 125 If such a request is made at a stage in the procedure when the production of new evidence is, in principle, no longer allowed, it is necessary in particular for the party requesting those measures to set out the reasons why the request could not have been made earlier (judgment of 18 January 2005, Entorn v Commission, T‑141/01, EU:T:2005:10, paragraph 132). 126 In the present case, the request for measures of organisation of procedure is based on the same matters of facts which led the applicant to make an application to introduce a new plea in law. 127 Thus, for the reasons set out in paragraphs 114 to 118 of the present judgment, the application for the adoption of measures of organisation of procedure must also be rejected as inadmissible, as it was submitted late. 4. The offers of evidence 128 The applicant submitted further offers of evidence, in accordance with Article 85(3) of the Rules of Procedure, on 12 occasions. 129 FRA contends, for its part, that the applications seeking to offer further evidence must be declared inadmissible. (a) Preliminary observations 130 It should be recalled that Article 85 of the Rules of Procedure governs the lodging of evidence and offers of evidence by the main parties during the judicial proceedings. 131 It provides for the stages at which evidence and offers of evidence are possible by distinguishing between the first exchange of pleadings, the second exchange of pleadings and the final stage, up to which point it is still possible for a main party to submit evidence or make offers of evidence, that being no longer permitted after the end of the oral part of the procedure, without prejudice to the possibility of requesting that the oral procedure be reopened, provided for in Article 113(2)(c) of the Rules of Procedure. 132 Whilst highlighting the exceptional nature of situations in which evidence or offers of evidence may be put forward, Article 85 of the Rules of Procedure makes them subject to an express obligation to state the reasons for the delay in offering that evidence, as required by settled case-law (judgments of 17 December 1998, Baustahlgewebe v Commission, C‑185/95 P, EU:C:1998:608, paragraph 71, and of 14 April 2005, Gaki-Kakouri v Court of Justice, C‑243/04 P, not published, EU:C:2005:238, paragraph 33). 133 Furthermore, while the action is admittedly admissible in its entirety, the fact remains that, in the application, the applicant supports her claim for compensation only in so far as concerns the damage suffered as a result of the unlawful processing of her personal data by FRA. 134 The offers of evidence will therefore be assessed only in so far as the applicant claims that FRA was responsible for a personal data breach in that context. (b) The first offer of evidence 135 By submitting the first offer of evidence, on 15 June 2017, the applicant sought leave to add five documents to the case file, in respect of which she asserts that (i) they are part of ‘a new case file to which FRA transmitted and/or leaked several documents containing her personal data’, of which she became aware on 11 May 2017, and which had allegedly been ‘used before [confidential] in order to make harm on her’; and (ii) they establish alleged breaches of data protection rules by FRA: – the email sent by the applicant to FRA on 16 April 2014 [confidential]; – the letter of 16 April 2015 from FRA to the applicant in response to her request for access to documents [confidential]; – the email of 29 November 2013 obtained by the applicant under Regulation No 1049/2001; – the email of 25 November 2013 sent by FRA’s policy advisor to Mr T. [confidential]; – the email of 2 December 2013 sent by FRA’s Director of Human Resources to Mr T. [confidential]. 136 As a preliminary point, with regard to the email of 25 November 2013 sent by FRA’s policy advisor to Mr T., it is important to observe that the document attached to that email was not legible and that, following a request for regularisation, the applicant failed to lodge a new, legible version of the document. 137 The application to submit that document must therefore be rejected as inadmissible. 138 As to the annexes to the file [confidential], they concern [confidential]. The applicant justifies the late lodging of those annexes by the fact that she received the file [confidential] on 11 May 2017. 139 In the same way as for the assessment of the admissibility of the application to introduce a new plea in law, the applicant merely submits that she came into possession of that file on 11 May 2017, without adducing any concrete evidence in support of her claim, even though the applicant was, at the very least, aware [confidential] in December 2016. 140 It must therefore be held that the offer of evidence relating to the letter of 16 April 2015 and the emails of 16 April 2014 and 2 December 2013 is inadmissible. 141 The same finding must be made with regard to the email of 29 November 2013. The applicant states that she is submitting an email dated 29 November 2013, obtained under Regulation No 1049/2001. 142 However, the annex including that email contains, in fact, two emails, dated 29 October 2013. Secondly, irrespective of whether or not that email is in the file [confidential], the applicant herself states that that document was obtained in the context of requests for access to documents, which are, as is apparent from the file in the present case, dated 26 November 2014 and 14 February 2015. 143 Consequently, in the circumstances of the case, the email of 29 November 2013 was submitted late. (c) The second offer of evidence 144 In her application for the adoption of measures of organisation of procedure dated 6 July 2017, which also comprises, in essence, the submission of a second offer of evidence, the applicant sought leave to add seven documents to the file, [confidential]: – the application of 11 December 2013; – the invoice of 28 November 2013 paid by FRA to Mr T. for services relating to ‘Strategies for defamatory acts’; – the letter of the Council of the European Union of 9 July 2014 and the email of the Court of Justice of the European Union of 31 October 2014; – the applicant’s appraisal report of 9 March 2017 for 2016 at [body X]; – FRA’s letter of 4 October 2013 to the Registry of the Court of Justice; – the statement of FRA’s external legal counsel dated 28 October 2013 and an invoice relating to legal services provided by Mr T. in respect of the follow-up on the judgment of 18 September 2012, Allgeier v FRA (F‑58/10, EU:F:2012:130); – the document concerning legal services provided in 2012 in respect of a reassignment. 145 In that connection, in so far as concerns the evidence offered in relation to [confidential], that offer must be rejected as inadmissible for the reasons set out in paragraphs 138 to 140 of the present judgment. The same applies to FRA’s letter of 4 October 2013 to the Registry of the Court of Justice and the statement of FRA’s external legal counsel dated 28 October 2013, inasmuch as those documents are included, according to the applicant, in the file [confidential]. 146 Moreover, the applicant merely submits, belatedly, documents which belong to her, namely the Council’s letter of 9 July 2014 and the email of the Court of Justice of the European Union dated 31 October 2014. 147 Similarly, she fails to offer any justification for the late submission of other documents, namely the document concerning legal services provided in 2012 in respect of a reassignment and the invoices of 28 November 2013 and 26 October 2012 paid by FRA to Mr T. in respect of services relating to ‘Strategies in defamatory acts’ and the study concerning the follow-up to the judgment of 18 September 2012, Allgeier v FRA (F‑58/10, EU:F:2012:130). 148 In any event, the late discovery of the alleged relevance of those documents cannot call that finding into question. 149 Consequently, the evidence offered in relation to those documents must be rejected as inadmissible. 150 In so far as concerns the applicant’s appraisal report at [body X] of 9 March 2017 for the year 2016, it should be noted that, while the latter document is admittedly contemporaneous with the offer of evidence, the fact remains that it was submitted nearly 5 months after the report was drawn up. 151 The applicant fails to provide any explanation as to the late submission of that report, except to claim that the relevance of the submission of that document emerged during the judicial proceedings. 152 Consequently, the application to produce that report must be rejected as inadmissible. (d) The third offer of evidence 153 By the submission of the third offer of evidence, on 4 September 2017, the applicant sought leave to add the following 4 documents to the case file: – the letter from OLAF dated 30 August 2017, disclosed to the applicant on 31 August 2017; – the email sent by the applicant on 6 January 2016 to the FRA Director and the attachment to that email; – the complaint lodged on 26 November 2009 by Mr F. (FRA Data Protection Officer, head of the IT Department and head of the team responsible for access to FRA documents); – FRA’s letter of 22 March 2017 to the Ombudsman, requesting that the applicant’s complaint concerning FRA’s refusal to grant her access to documents be rejected. 154 In that connection, it should be noted that both OLAF’s letter of 30 August 2017 and FRA’s letter of 22 March 2017 are irrelevant in the light of the claim for compensation made in the application. Those documents relate to (i) an OLAF investigation into alleged irregularities in the Agency’s public procurement; and (ii) FRA’s response to the Ombudsman regarding a complaint made by the applicant concerning FRA’s refusal to disclose the contracts concluded between FRA and its legal advisors. The same applies to the email of 6 January 2016 and the complaint of 26 November 2009, which relate to the alleged irregularities in public procurement at FRA. 155 Consequently, that evidence will not be taken into account by the Court, inasmuch as the applicant cannot rely on it to any purposes in connection with her claim for compensation. (e) The fourth offer of evidence 156 By the submission of the fourth offer of evidence, on 28 September 2017, the applicant sought leave to add the following six documents to the case file: – Annex D.1 to FRA’s rejoinder in Case T‑888/16, relevant to Case T‑838/16 ‘HT list of contracts signed in the period 2012-2016’; – the invoice for legal services rendered further to purchase order (PO) 2013-68 ‘Strategies for defamatory acts’; – the email of 1 September 2017 concerning the undertaking given [confidential]; – the documents concerning legal costs incurred by the applicant [confidential]; – the Ombudsman’s Inspection Report of 17 December 2015 concerning purchase orders for Mr T.’s services; – FRA’s payments to Mr T. for work allegedly carried out on the reform of the Data Protection Regulation. 157 In that regard, account will not be taken of Annex D.1 to the rejoinder lodged by FRA in Case T‑888/16, BP v FRA; FRA’s invoice for legal services, which is, moreover, identical to the document submitted by the applicant as part of her second offer of evidence; the Ombudsman’s investigation report; and FRA’s payments to Mr T. in respect of a report on data protection, as those documents are not sufficiently directly connected to the claim for compensation made in the application. 158 However, whilst it is admittedly not a question, in the present case, of examining the dispute between the applicant and Mr T., or any of the claims connected thereto, the fact remains that, in her application, the applicant stated that she would have to set out at a later date the material damage suffered, which, at the time the application was lodged, resulted, inter alia, [confidential]. 159 The Court therefore finds that the email of 1 September 2017 and the documents concerning the legal costs incurred by the applicant in [confidential] are admissible. (f) The fifth offer of evidence 160 By the submission of the fifth offer of evidence, on 30 October 2017, the applicant sought leave to add the following 3 documents to the case file: – medical documents for the period from 28 August 2017 to 12 October 2017; – FRA’s letters of 26 and 29 September 2017; – the email from the Court of Justice of the European Union of 6 October 2017 and the two annexes thereto. 161 In that connection, it should be noted that FRA’s letters of 26 and 29 September 2017 and the email from the Court of Justice of the European Union of 6 October 2017 are not sufficiently directly connected to the claim for compensation made in the application, with the effect that the application to submit those documents must be rejected. 162 However, the same does not apply to the medical documents, inasmuch as they are (i) contemporaneous with the fifth offer of evidence and (ii) intended, at the very least, to clarify the scale of the material and non-material damage suffered by the applicant. 163 Consequently, the application to submit the medical documents is admissible. (g) The sixth offer of evidence 164 By the submission of the sixth offer of evidence, on 7 January 2018, the applicant sought leave to add the following 5 documents to the case file: – [confidential]; – the email from the applicant’s lawyer of 27 December 2017 concerning [confidential]; – the correspondence from the European Commission of 23 May 2013; – documents to rebut the statement of FRA’s external legal counsel; – the email from the Court of Justice of the European Union of 4 January 2018 and the applicant’s email of 3 April 2018. 165 In that connection, the applications to submit the [confidential], the email of 27 December 2017 from the lawyer [confidential] and the email from the Court of Justice of the European Union of 4 January 2018 must be rejected as inadmissible, in so far as those documents are not sufficiently directly connected to the claim for compensation made in the application, irrespective of the determination of the date on which the applicant obtained a certified translation [confidential]. 166 Moreover, it is clear that those documents are connected, in essence, to the application to introduce a new plea in law, which was rejected in paragraph 118 of the present judgment as inadmissible. 167 So far as concerns the other evidence submitted, while it is not intended, in essence, to support the written submissions made in the application to introduce a new plea in law, it is, nonetheless, not sufficiently directly connected to the claim for compensation made in the application, as the Commission’s letter relates to the alleged irregularities in public procurement at FRA and as the other documents relate solely to the legal services provided by FRA’s legal advisors. 168 Consequently, the application for production of those documents must be rejected. (h) The seventh offer of evidence 169 By the submission of the seventh offer of evidence, on 30 January 2018, the applicant sought leave to add to the case file the OLAF report of 16 December 2016, in cases OF/2014/0192 and OF/2015/0167, together with a selection of annexes to that report. 170 In order to justify the delay in submitting that offer of evidence, the applicant merely claims that she received the OLAF report only on 12 January 2018. 171 According to the applicant, the OLAF report and the annexes thereto demonstrate that FRA infringed rules on confidentiality, which interfered with the data protection rights of members and former members of FRA staff. 172 Moreover, the applicant requests that the Court assess the consequences of FRA’s defamatory statements against her and also quantify the defamatory statements made by Mr T. in his capacity as FRA’s legal advisor. The applicant requests that the Court order FRA to find a solution that will make it possible to restore her professional and personal reputation which, she claims, has been damaged as a result of the conduct of FRA and its legal advisor. 173 In that connection, the OLAF report in the joined cases relates, first, to allegations of possible conflicts of interest on the part of a deputy judge of the Civil Service Tribunal and possible irregular contracts, purchase orders and payments made by members of FRA staff to that former deputy judge for the period 2012-2014. 174 That report also relates, secondly, to allegations of breach of professional secrecy by officials of unspecified EU institutions between June 2013 and April 2014, in so far as concerns the disclosure and use of the applicant’s home address by an unauthorised third party. 175 While the part of the OLAF Report relating to the allegations of conflicts of interests is not sufficiently directly connected to the claim for compensation made in the application, the same cannot be said for that relating to the alleged disclosure, by members of FRA, of the applicant’s home address, inasmuch as she bases her claim for compensation, inter alia, on that alleged disclosure. 176 However, while the OLAF report and the annexes thereto may, in part, be connected to the claim for compensation made in the context of the present action, it should be noted that the applicant fails to demonstrate in any way that she came into possession of that report only on 12 January 2018, even though the report is dated 14 December 2016. 177 Consequently, the application to produce the OLAF Report must be rejected. 178 Moreover, the applicant sought leave to add to the case file a number of invoices issued for legal services which she sought. 179 Amongst those invoices, some are dated October and December 2017, so they cannot be disregarded as inadmissible. However, the same does not apply to an invoice dated 23 May 2016, relating to an amount of 13 600 Romanian lei (RON), to which the applicant had already referred in her application, the submission of that invoice is in the present case clearly very late. 180 Consequently, the application to produce the latter invoice must be rejected as inadmissible. 181 On the same grounds, the applicant’s expanded claim for compensation, reproduced in paragraph 172 of the present judgment, which is closely connected to the seventh offer of evidence and in particular the OLAF Report, must be dismissed. 182 In any event, even if it were found that that claim was severable from and independent of those offers of evidence, it is not based on any argument or plea in law additional to those put forward in support of the claim already made in the application. 183 Consequently, it is not necessary to rule separately on those heads of claim. (i) The eighth offer of evidence 184 On 5 February 2018, the applicant produced further evidence in addition to her previous offer, namely the full annexes to the OLAF Report in joined cases OF/2014/0192 and OF/2015/0167. 185 In that connection, it must be observed that the applicant merely makes a general reference to the evidence contained in those documents. 186 It must be recalled, in that regard, that, although the body of the application may be supported and supplemented on specific points by references to extracts from documents annexed to it, a general reference to all of the annexes to the application and, a fortiori, to annexes to applications in different cases, for the purposes of setting out essential elements of the legal argument, does not meet the requirements under the Rules of Procedure. Since the annexes have a purely evidential and instrumental function, it is not for the Court to seek and identify in the annexes the grounds on which it may consider the action to be based (see, to that effect and by analogy, order of 29 November 1993, Koelman v Commission, T‑56/92, EU:T:1993:105, paragraphs 21 and 23). 187 Moreover, since it has been held that the production of the OLAF Report is inadmissible, the same applies to all of the annexes to that report. (j) The ninth offer of evidence 188 On 30 April 2018, the applicant lodged a ninth offer of evidence, as part of her written response to a measure of organisation of procedure taken by the Court on 24 April 2018. 189 In essence, she sought leave to add to the case file a version of an email which she had sent to FRA together with a document as an attachment, which she claimed had been taken [confidential]. 190 In support of her application, the applicant claims that those documents must be added to the case file, as an annex to the application connected to that case mentions those documents. She also claims that those documents were ‘retrieved recently from [confidential]’. 191 First, it should be noted that, while the applicant admittedly refers, in the application, to a [confidential] case [confidential] and the mention made of those documents in the originating application, neither the annexes nor the schedule of annexes to the application make reference to that case. 192 Secondly, it is apparent from the application that the action giving rise to that case [confidential]. It is also apparent from an examination of the contents of those documents that [confidential] was sent to [confidential], at the latest on 15 March 2017, that is, over a year before those documents were lodged with the Court Registry. 193 The applicant fails to justify the late submission of those documents in any way. At most, she confines herself to (i) claiming that those documents were ‘recently’ retrieved from the file [confidential] and (ii) pointing out that [confidential]. 194 Consequently, the ninth offer of evidence must be rejected as inadmissible. (k) The tenth offer of evidence 195 On 24 May 2014, the applicant lodged a tenth offer of evidence, whereby she sought leave from the Court to add to the case file an email received from the magazine Stern, her reply to the journalist who had contacted her, FRA’s proposed amendments to the article, and miscellaneous emails between her and her lawyer, and also with the cabinet of the President of the Court of Justice, concerning [confidential]. 196 In that regard, it is again clear that those documents are not sufficiently directly connected to the claim for compensation made in the application. 197 Consequently, the application to produce those documents must be rejected. (l) The eleventh offer of evidence 198 On 12 June 2018, the applicant sought leave to add to the Court’s case file an eleventh offer of evidence, namely a document concerning a settlement [confidential]. 199 Furthermore, by her eleventh offer of evidence, the applicant requests that the Court order FRA to reimburse her for the costs incurred in [confidential], which total, on average, EUR 10 000. 200 In that connection, admittedly the applicant was not, first, in a position to inform the Court as to the outcome of [confidential] at an earlier stage in the proceedings in the present case. 201 Secondly, as regards her material damage, and on account of the uncertainty surrounding [confidential], the applicant pointed out, in her application, that she would have to quantify at a later stage the damage suffered on account of [confidential]. 202 Therefore, although the present dispute cannot be extended to include [confidential], the fact remains that the document lodged on 12 June 2018 must be declared admissible, as it serves to delimit the material damage suffered by the application on account of the [confidential], in particular that suffered on account of [confidential]. (m) The twelfth offer of evidence 203 On 28 June 2018, the applicant lodged a twelfth offer of evidence, whereby she sought leave from the Court to add to the file in the present case various bank statements setting out the costs which she claimed to have incurred on account [confidential], together with FRA’s replies of 26 September and 20 November 2017 to a request for access to documents of 16 August 2017. 204 In that connection, it should be observed that, in respect of the bank statements relating to the costs incurred [confidential], the applicant justifies the late submission thereof, with the result that they must be found to be admissible. 205 However, as regards the other documents, it should be observed, in the first place, that the applicant was in possession of those documents from 26 September and 20 November 2017. 206 In the second place, the applicant fails to give any justification whatsoever for the late submission thereof and confines herself to asserting, without further evidence, that those documents are connected to the subject matter of the dispute. 207 In the third place, the annexed documents contain numerous handwritten comments, which seek to circumvent the requirement as to the strictly probative value of annexes. 208 Consequently, it must be held that those documents are inadmissible. B. Substance 209 By her action, the applicant seeks, in essence, compensation in respect of damage which she claims to have suffered as a result of (i) an unlawful disclosure, following a request for access to documents made by a third party, of FRA’s replies to the applicant; (ii) the leak of documents annexed to her request for access to documents and of her residential addresses; (iii) a failure to adopt preventive measures; and (iv) an improper interview granted by the new FRA Director to the newspaper Politico. 210 Moreover, in the proceedings before the General Court, the applicant made applications seeking the adoption of a measure of inquiry and the examination of a witness, the validity of which is disputed by FRA. 1. The claim for damages (a) Preliminary observations 211 Pursuant to the second paragraph of Article 340 TFEU, in the case of non-contractual liability, the European Union is, in accordance with the general principles common to the laws of the Member States, to make good any damage caused by its institutions or by its servants in the performance of their duties. 212 It is settled case-law that in order for the Union to incur non-contractual liability, for the purposes of the abovementioned provision, for unlawful conduct of its institutions a number of conditions must be satisfied: the institution’s conduct must be unlawful, actual damage must have been suffered and there must be a causal link between the conduct alleged and the damage pleaded (see judgment of 16 October 2014, Evropaïki Dynamiki v Commission, T‑297/12, not published, EU:T:2014:888, paragraph 28 and the case-law cited). 213 As regards, first of all, the condition relating to the unlawfulness of the alleged conduct of the institution or body concerned, case-law requires there to be established a sufficiently serious breach of a rule of law intended to confer rights on individuals (see judgment of 16 October 2014, Evropaïki Dynamiki v Commission, T‑297/12, not published, EU:T:2014:888, paragraph 29 and the case-law cited). 214 In relation to the requirement for the breach to be sufficiently serious, the decisive criterion for establishing this is whether the Union institution or body in question manifestly and gravely disregarded the limits on its discretion. Where that institution or body has only very little discretion, or none at all, the mere infringement of Union law may be sufficient to establish the existence of a sufficiently serious breach (see judgment of 16 October 2014, Evropaïki Dynamiki v Commission, T‑297/12, not published, EU:T:2014:888, paragraph 29 and the case-law cited). 215 Secondly, as regards the requirement that there must be actual damage, it should be noted that the EU can incur liability only if the applicant has in fact suffered an ‘actual and certain’ harm. It is for the applicant to produce to the Court the evidence to establish the fact and the extent of such damage (see judgment of 16 October 2014, Evropaïki Dynamiki v Commission, T‑297/12, not published, EU:T:2014:888, paragraph 30 and the case-law cited). 216 In particular, in so far as concerns non-material damage, while the submission of evidence is not necessarily regarded as a requirement for the recognition of such harm, it is for the applicant to at least establish that the conduct alleged against the institution concerned was capable of causing him damage (see judgment of 16 October 2014, Evropaïki Dynamiki v Commission, T‑297/12, not published, EU:T:2014:888, paragraph 31 and the case-law cited). 217 Lastly, as regards the condition that there must be a causal link between the conduct alleged and the damage pleaded, that damage must be a sufficiently direct consequence of the conduct complained of, which must be the decisive cause of the damage, although there is no obligation to make good every harmful consequence, even a remote one, of an unlawful situation. It is for the applicant to adduce evidence of a causal link between the conduct complained of and the damage pleaded (see judgment of 16 October 2014, Evropaïki Dynamiki v Commission, T‑297/12, not published, EU:T:2014:888, paragraph 32 and the case-law cited). 218 Where any one of the three conditions required for the Union to incur non-contractual liability is not satisfied, the claims for compensation must be dismissed, without there being any need to consider whether the other two conditions are met. Moreover, the EU judicature is not required to examine those conditions in any particular order (see judgment of 16 October 2014, Evropaïki Dynamiki v Commission, T‑297/12, not published, EU:T:2014:888, paragraph 33 and the case-law cited). 219 In the light of the foregoing, it is therefore necessary to establish whether the applicant has demonstrated (i) unlawfulness vitiating FRA’s conduct; (ii) damage; and (iii) a causal link between the unlawful conduct and the damage pleaded. 220 That threefold assessment must be conducted for each incident in FRA’s conduct which, the applicant claims, is unlawful. (b) The complaint alleging irregular disclosure of FRA’s replies to the applicant 221 In the first place, the applicant claims that the emails exchanged between her and FRA, as mentioned in paragraphs 9 and 13 of the present judgment, are covered by private correspondence, with the result that they could not be disclosed without infringing the provisions of Regulation No 1049/2001 and Article 8 of the European Convention on Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950 (‘the ECHR’). 222 In the second place, the applicant argues that, in granting partial access to its replies, FRA transformed the existing format of those documents, in breach of Article 10(3) of Regulation No 1049/2001, in order to avoid the application of Regulation No 45/2001. 223 In the third place, the applicant stresses the fact that personal data remained in the documents disclosed, which could identify her directly or indirectly. In that connection, she also alleges breach of the provisions of Regulation No 45/2001. 224 In the fourth place, the applicant takes the view that, in order to disclose its replies, FRA mistakenly relied on the fact that those documents belonged to it, although even the ‘Subject’ line in those emails could not belong to it. 225 In the fifth place, the applicant takes the view that FRA should have informed her of the disclosure of its replies since she had already stated her opposition to the disclosure thereof. 226 In the sixth place, the applicant puts forward the argument that it is unusual that a person should seek information on another person’s request for access to documents. 227 In the seventh place, the applicant takes the view that the disclosure of FRA’s replies, against her will and without informing her of that disclosure, allowed her to be identified and deprived her of the possibility of bringing an application for interim measures before the General Court, in breach of her right to an effective remedy enshrined in Article 47 of the Charter. 228 FRA disputes the merits of the applicant’s arguments. 229 In the present case, the applicant criticises FRA, in essence, for having disclosed, in response to a request for access to documents made by a third party, FRA’s replies to the applicant. 230 In that connection, it should be recalled that Regulation No 1049/2001 lays down as a general rule that the public may have access to the documents of the institutions, but provides for exceptions based on certain public and private interests. 231 Recital 11 of that regulation states that, ‘in assessing the exceptions, the institutions should take account of the principles in EU legislation concerning the protection of personal data, in all areas of Union activities’. 232 In accordance with Article 2 of Regulation No 1049/2001, FRA is required to allow the public to access documents held, that is to say, documents drawn up or received by it and in its possession, subject to conditions laid down in that regulation. 233 In the present case, first, it should be noted that FRA’s replies did not contain any mention of the name, address or any other information which may have served to identify the applicant. 234 In other words, FRA did not disclose its replies in full, as the applicant’s personal data had been redacted. 235 Furthermore, the correspondence between the applicant and FRA cannot be categorised as private correspondence, the mere disclosure of which would have resulted in the disclosure of personal data. 236 FRA’s replies were in fact communicated to the applicant following her submission of a request for access to documents, namely in the context of FRA’s exercise of its competence to give a decision on such a request. 237 Consequently, no complaint may be made against FRA for having, with regard to its own replies, disclosed the applicant’s personal data. 238 Secondly, as regards arrangements for access to FRA’s replies, it should be recalled that Article 4(6) of Regulation No 1049/2001 permits the partial disclosure of a document. 239 That article provides that ‘if only parts of the requested document are covered by any of the exceptions, the remaining parts of the document shall be released’. 240 In the present case, FRA fully satisfied that requirement by redacting those parts of FRA’s replies which contained personal data allowing the applicant to be identified. 241 The applicant’s arguments cannot call that finding into question. 242 Article 10(3) of Regulation No 1049/2001 cannot impose on the intended recipient of a request for access to documents a specific method for documents to be partially disclosed, as that article imposes merely an obligation to supply documents in an existing version or format namely, inter alia, written or electronic. 243 Furthermore, access was not granted to the email chain between FRA and the applicant, but rather solely to FRA’s replies to the applicant, of which it was the author, from which the applicant’s personal data had been deleted. 244 Moreover, the act of extracting FRA’s replies from the email chain between FRA and the applicant and of redacting the applicant’s emails in that chain pursue the same objective and lead to exactly the same outcome. 245 Consequently, as regards the arrangements for access to the emails at issue, there can be no finding of irregularity. 246 Thirdly, the applicant takes the view that FRA was similarly required to inform her of the disclosure of documents, since she was opposed to the disclosure thereof, even though Regulation No 1049/2001 does not require it. 247 In that connection, it should be observed that the obligation to notify the third party consulted is laid down in Article 5(7) of FRA Decision 2007/07 of 23 October 2007 concerning the arrangements to be applied by the Agency for public access to documents. 248 That article, headed ‘Third-party documents’ states that ‘if [FRA] intends to give access to a document against the explicit opinion of the author, it shall inform the author of its intention to disclose the document after a 10-working day period and shall draw his or her attention to the remedies available to him or her to oppose disclosure’. 249 In the present case, FRA granted partial access to its replies, expunged of personal data, in accordance with Article 4(1)(b) and (6) of the Regulation No 1049/2001, and not to documents of which the applicant was the author. 250 Accordingly, FRA was not required to inform the applicant of the disclosure of the emails at issue. 251 Fourthly, the applicant takes the view that the ‘Subject’ line of the emails containing FRA’s replies, which were partially disclosed, is not FRA’s property. 252 In that respect, pursuant to Article 5(7) of FRA Decision 2007/07 of 23 October 2007, when FRA intends to give access to a document against the explicit opinion of the author, it is to inform the author of the disclosure of that document and the remedies available. 253 However, no complaint can be made, in the present case, against FRA for failing to inform the applicant of the partial disclosure of its replies, since the applicant cannot be the author of those replies. 254 The fact that the ‘Subject’ field of an email is filled in by the sender of that email does not mean that the ‘Subject’ line of an email sent in reply still belongs to the sender. That line can easily be changed by the recipient, with the result that, in the present case, the applicant cannot be categorised, in principle, as the author of only part of FRA’s replies. 255 Moreover, since the ‘Subject’ line of those emails does not contain any of the applicant’s personal data, the question of whether or not it is the ‘property’ of the applicant or FRA is, in the present case, irrelevant. 256 Consequently, no complaint can be made against FRA for maintaining the content of the ‘Subject’ line of the emails. 257 Fifthly, the applicant puts forward the argument that it is unusual that a person should seek information on another person’s request for access to documents. 258 The mere fact that such a request may, in some circumstances, be unusual does not lead to a finding of unlawfulness. In any event, in accordance with Article 6(1) of Regulation No 1049/2001, an applicant is not obliged to state reasons for the application for access, with the result that there cannot, in any event, be a finding of irregularity on this point. 259 Consequently, the applicant cannot criticise FRA for having partially disclosed the emails in response to her request for access to documents, since FRA complied with the provisions of Regulation No 1049/2001 and Article 8 ECHR. 260 Accordingly, as the first condition to be satisfied in order for FRA to incur non-contractual liability has not been met, the claim for compensation in respect of the harm suffered as a result of the disclosure of FRA’s replies to the applicant must be dismissed. (c) The complaint alleging that documents annexed to the request for access to documents and the applicant’s addresses were leaked 261 The applicant criticises FRA, in essence, for having disclosed the addresses of her residences in Barcelona (Spain) and Vienna, together with the documents annexed to the request for access to documents, as mentioned in paragraph 19 of the present judgment, which, it is claimed, were in the file [confidential] and in the file [confidential]. (1) The finding of unlawful conduct (i) The disclosure of the applicant’s residential addresses 262 The applicant submits that FRA infringed the duty of confidentiality enshrined in Article 339 TFEU and Article 8 ECHR, on account of the disclosure to a third party of her residential addresses in Vienna and Barcelona. 263 First, the applicant claims that FRA disclosed her residential address in Vienna, as it was at that address that, on 2 May and 6 June 2016, she was served documents, by a court officer, [confidential]. The applicant therefore asserts that, in disclosing the documents annexed to her request for access to documents, FRA also disclosed her residential address. 264 Second, she maintains that, in 2014, FRA disclosed her residential address in Barcelona, the year in which a first ‘delivery attempt of judicial documents’ took place. 265 FRA disputes the merits of the applicant’s arguments. 266 In the first place, as regards the alleged disclosure of her residential address in Vienna, the applicant claims that that event was contemporaneous with the leak of the documents annexed to her request for access to documents. 267 It is clear that the applicant has provided neither proof nor prima facie evidence in support of her claim. 268 Moreover, the documents annexed to her request for access to documents do not make any mention of her home address. 269 Accordingly, it cannot be validly claimed, on that sole basis, that FRA disclosed the applicant’s residential address in Vienna. 270 In any event, first, it should be noted that FRA’s headquarters are in Vienna. Second, [confidential] was directed not only against the applicant but also against a person working for FRA at that time. 271 It therefore cannot be validly argued that [confidential] was the direct result of any disclosure of the applicant’s residential address in that city. 272 In the second place, the applicant claims that FRA disclosed the address of her domicile in Barcelona. 273 In support of that assertion, she points out at most that, in 2014, ‘a person who refused to identify himself came twice’ to her home in Barcelona ‘with some judicial documents’, some mentioning FRA, which were not, ultimately, served on the applicant. 274 In the light of that assertion alone, it cannot be held that FRA disclosed the applicant’s residential address in Barcelona. 275 Consequently, the applicant’s argument alleging breach of Article 399 TFEU and Article 8 ECHR must be rejected. (ii) The disclosure of the documents annexed to the request for access to documents 276 First, the applicant maintains that FRA infringed Article 4(1)(b) and Article 6(1) of Regulation No 45/2001, in that her personal data, as set out in the email mentioned in paragraph 19 of the present judgment, was disclosed for a purpose other than that for which it had been collected. 277 Second, the applicant claims that FRA failed to obtain, prior to disclosing the documents annexed to the request for access to documents, her ‘unambiguous consent’, as required under Article 2(h) of Regulation No 45/2001. 278 Third, the applicant takes the view that the communication of her personal data to OLAF, FRA’s external investigators [confidential], through lawyers representing Mr T., constitutes an unlawful transfer of her personal data in breach of Article 5, 7 and 8 of Regulation No 45/2001. 279 Fourth, the applicant claims that she did not receive the information which, in accordance with Article 11 of Regulation No 45/2001, is to be provided to the data subject from whom the personal data were collected. She also argues, in essence, that, in the absence of such information, she was deprived of the possibility of bringing an action under Article 279 TFEU. 280 Fifth, the applicant considers that FRA infringed her right of access, provided for in Article 13 of Regulation No 45/2001, in giving her incomplete replies. 281 Sixth, the applicant takes the view that her personal data ought to have been blocked by FRA, at her request, in accordance with Article 15(1)(c) of Regulation No 45/2001, since the processing of that data was unlawful. In the alternative, she argues that the data ought to have been erased in accordance with the provisions of Article 16 of that regulation. The applicant ought also to have been informed of any notification to third parties of the blocking of her data, in accordance with Article 17 of the regulation. The applicant requests, moreover, that the Court block ‘the use of her data until the matters [have been] clarified, thus trying to prevent accumulation of further damages in the future’. 282 Seventh, the applicant considers that, had FRA requested a prior check from the EDPS, in accordance with Article 27(1) of Regulation No 45/2001, her rights could have been protected. 283 Eighth, the applicant argues that the leak of the documents annexed to the request for access to documents constitutes unlawful processing of her personal data, in breach of Article 5 of Regulation No 45/2001 and the precautionary principle. 284 Ninth, the applicant claims that FRA infringed the principle of protection of legitimate expectations in disclosing her personal data against her wishes and without informing her of that disclosure, which, it is argued, may have had the effect of preventing her from exercising her right to an effective remedy under Article 47 of the Charter. She adds that FRA’s actions towards her were also contrary to the principles of legal certainty and natural justice. 285 Tenth, the applicant puts forward the argument that FRA infringed (i) the duty of confidentiality enshrined in Article 339 TFEU, in that the data annexed were covered by professional secrecy and (ii) her right to the protection of personal data. 286 Eleventh, the applicant claims that the Interim Director used his powers incorrectly. She alleges, first, that he used Regulations Nos 1049/2001 and 45/2001 to make public certain confidential documents for the purpose of using them as evidence in judicial proceedings against her and other FRA staff members. Secondly, she asserts that he added other emails to that in which her consent to disclosure was sought, in order to give the impression that the scope of the consultation was broader than it was, and that he was the person who was responsible for the second leak. 287 For its part, first, FRA claims never to have disclosed the documents annexed to the request for access to documents, be it directly or indirectly, though the intermediary of lawyers acting for Mr T., in accordance with the applicant’s refusal. 288 It points out, moreover, that, having become aware of the first leak, an internal administrative investigation was launched and the applicant’s personal data were sent to OLAF prior to the opening of that investigation, in accordance with Article 20(1) of Regulation No 45/2001. 289 In that context, it observes that Article 5(b) of Regulation No 45/2001 allows the processing of personal data for the purposes of internal disciplinary investigations, to which FRA was subject, pursuant to Article 7 of Regulation (EC) No 1073/1999 of the European Parliament and of the Council of 25 May 1999 concerning investigations conducted by [OLAF] (OJ 1999 L 136, p. 1). 290 FRA states, secondly, that it duly informed the applicant of the fact that her personal data had been processed in the context of an ongoing administrative investigation relating to the first leak, and confirmed to her that FRA had not disclosed her personal data to any other third party. Similarly, the applicant was informed of her right to have recourse to the EDPS if she deemed it appropriate. 291 Thirdly, the fact that an administrative investigation was being conducted also justified, according to FRA, the rejection of the applicant’s request that her personal data be blocked. Similarly, FRA observes that a third party could not be notified of a rectification, erasure or blocking of personal data that it had never received. 292 Fourthly, FRA takes the view that it cannot be held responsible for the leak of those documents, since it did what was within its powers to put an end to such reprehensible conduct on the part of its officials and agents. 293 Fifthly, FRA claims that any action brought would not have resulted in the grant of interim measures in the absence of fumus boni juris. 294 Sixth, it observes that the applicant merely claims — without, however, proving it — that the Interim Director misused his powers. 295 In that connection, it should be noted at the outset that, as regards requests for access to documents, the lawfulness of FRA’s actions cannot be assessed in the light of Article 339 TFEU, as the non-disclosure of certain documents is governed by specific provisions laid down by Regulations Nos 1049/2001 and 45/2001. 296 The applicant claims that, in the present case, FRA disclosed two documents that she had sent to it in support of her request for access to documents of 14 February 2015 — namely the email of 9 October 2014 and the list of payment annexed to it — to OLAF, the persons in charge of the administrative investigation and [confidential], through lawyers representing Mr T., who also used those documents, it is claimed, in [confidential], even though the applicant had formally opposed such disclosure. 297 The email of 9 October 2014 consists in an exchange between the applicant and the former colleague, in which the applicant’s surname and first name appear clearly in the addressee field. The list of payments, annexed to that email, concerns payments received by Mr T. from FRA. 298 It is common ground, therefore, in the present case, that the email contains the applicant’s personal data, within the meaning of Article 2(a) of Regulation No 45/2001. 299 Accordingly, it is necessary to assess the applicant’s arguments concerning (i) the disclosure of those documents to OLAF and the external investigators; and (ii) the presence of those documents in the file [confidential]. – The disclosure to OLAF and the external investigators 300 In that connection, first, it should be borne in mind that, under Article 5(b) of Regulation No 45/2001, personal data may only be processed if, inter alia, processing is necessary for compliance with a legal obligation to which the controller is subject. 301 Secondly, Article 8(1) of Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by [OLAF] and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999 (OJ 2013 L 248, p. 1), provides that ‘the institutions, bodies, offices and agencies shall transmit to the Office without delay any information relating to possible cases of fraud, corruption or any other illegal activity affecting the financial interests of the Union’. 302 Thirdly, Article 7(1) of Regulation No 45/2001 provides that ‘personal data shall only be transferred within or to other Community institutions or bodies if the data are necessary for the legitimate performance of tasks covered by the competence of the recipient’. 303 Fourthly, Article 20(1)(a) of Regulation No 45/2001 provides that the institutions may restrict the application of Article 4(1), Article 11, Article 12(1), Articles 13 to 17 and Article 37(1) of that regulation where such restriction constitutes a necessary measure ‘to safeguard the prevention, investigation, detection and prosecution of criminal offences’. 304 Fifthly, Article 20(3) of Regulation No 45/2001 provides, however, that ‘if a restriction provided for by paragraph 1 is imposed, the data subject shall be informed, in accordance with Community law, of the principal reasons on which the application of the restriction is based and of his or her right to have recourse to the European Data Protection Supervisor’. 305 In the present case, in its defence, FRA acknowledges that it sent the applicant’s personal data to OLAF after becoming aware of the first leak, that is, the disclosure to the applicant of the list of payments by an internal source at FRA. 306 In that context, the applicant cannot criticise FRA for communicating her personal data to OLAF, since those data were disclosed in accordance with Article 5(b) and Article 7(1) of Regulation No 45/2001. 307 Furthermore, FRA was entitled, in accordance with Article 20(1) of Regulation No 45/2001, to derogate from its obligations to provide information or not to grant the applicant’s request that her personal data be blocked. Moreover, in accordance with paragraph 3 of that article, the applicant was informed of the existence of an investigation and of her right to have recourse to the EDPS. 308 The same finding must be made as regards the communication of the personal data to the external investigators in connection with the administrative investigation. 309 Consequently, that complaint must be rejected. – The disclosure to Mr T. and [confidential] 310 The applicant claims FRA disclosed her personal data to [confidential], through lawyers for Mr T., who also used those documents [confidential]. 311 On this point, FRA denies having made such a disclosure, which is corroborated, prima facie, by its replies to the request for access to documents made by a third party, whereby it formally opposed disclosure to that third party of the documents annexed to the request for access to documents. 312 Although FRA initially suspended the disclosure of those documents for the purposes of consulting the applicant, in accordance with Article 4(4) of Regulation No 1049/2001, it subsequently, in its replies of 16 October, 12 November and 9 December 2015, repeatedly refused to disclose them, as the applicant had opposed that disclosure and it would have undermined ongoing investigations, on the basis of Article 4(2) of Regulation No 1049/2001 and Article 20(1)(a) of Regulation No 45/2001. 313 However, it is also apparent from the file in the present case that those documents were used as incriminating evidence in [confidential]. 314 It is therefore clear, in the light [confidential], that the documents annexed to the request for access to documents were leaked, with the result that it is necessary to determine whether that leak is to be imputed to FRA. 315 The applicant adds that the leak of those documents is not confined to [confidential], but extends to that [confidential]. 316 It is clear, with regard to the file in the latter case, that the applicant merely refers to such a leak. 317 Admittedly, the applicant bases her argument, in the application, on an annex which, she claims, relates to [confidential] and seeks, in her written answer to a question put by the Court, to add to the file in the present case documents contained in the file [confidential]. 318 The fact remains that (i) neither the annexes nor the schedule of annexes to the application refer to that case and (ii) the request to produce the documents contained in the file in that case was rejected in paragraph 194 of the present judgment. 319 The applicant cannot, therefore, have established, to the requisite legal standard, that the documents annexed to the request for access to documents in [confidential] were leaked. 320 [As rectified by order of 18 December 2019] Consequently, it is necessary to assess whether that leak may be imputed to FRA, in so far as it relates [confidential]. 321 In the first place, it is clear from the case-law that, in a situation where the exact causes of a leak are, a priori, unknown and the institution concerned is best placed to adduce evidence in that regard, any uncertainty as to the circumstances in which the leak occurred must be construed against it (see, to that effect and by analogy, judgment of 12 September 2007, Nikolaou v Commission, T‑259/03, not published, EU:T:2007:254, paragraph 196). 322 Furthermore, the institution has, at the very least, to provide an explanation or credible hypothesis as to the circumstances in which the leak may have occurred (see, to that effect and by analogy, judgment of 12 September 2007, Nikolaou v Commission, T‑259/03, not published, EU:T:2007:254, paragraph 198). 323 In the present case, while FRA has, admittedly, demonstrated, by its replies to the request for access to documents made by a third party, that it did not approve the disclosure of the documents annexed to the request for access to documents, the fact remains that it is apparent from FRA’s written pleadings that it has failed to provide any credible hypothesis as to the circumstances in which the leak may have occurred. 324 The leak of those documents is therefore imputable to FRA. 325 That finding is not called into question by the latter’s arguments. 326 First, its arguments relate solely to the first leak, of which the applicant was admittedly the recipient, and not to the leak of the documents annexed to the request for access to documents. 327 Secondly, the fact that FRA conducted an administrative investigation, following the disclosure to the applicant of the list of payments is not sufficient to exonerate it of liability for the leak of the documents annexed to the request for access to documents. 328 Moreover, a comparison of the version of the email sent by the applicant to FRA on 14 February 2015 and that used in evidence in [confidential] shows a significant difference, which is a strong indication that the documents were disclosed by a FRA staff member. 329 Unlike the email sent by the applicant to FRA, the version which appears in the file [confidential] contains FRA’s disclaimer, which appears to be automatically generated in emails sent from a work-related mailbox, which is, moreover, not disputed by FRA. 330 Consequently, the inclusion of that disclaimer indicates, at the very least, that the disclosure of the two documents originated at FRA. 331 While that disclosure is imputable to FRA, it is nonetheless necessary to verify whether it is contrary to the provisions of Regulation No 45/2001. 332 The disclosure of the two documents cannot be justified by any of the situations referred to in Article 5 of Regulation No 45/2001, in particular as it is apparent from FRA’s replies to the request for access to documents made by a third party that the applicant had, when she was consulted on this point, opposed the disclosure of the two documents. The same applies to the situations provided for in Articles 8 and 20 of Regulation No 45/2001. 333 Accordingly, it must be held that FRA infringed the provisions of Regulation No 45/2001. 334 In the second place, it must also be found that there was infringement of Articles 11, 13, 15 and 17 of Regulation No 45/2001 in that, in principle, the applicant ought to have been informed of the disclosure of her data and the possibility of, inter alia, having that data blocked or erased by FRA or any other third party to whom that data may have been communicated. 335 [As rectified by order of 18 December 2019] Consequently, the complaint must be upheld, without it being necessary to identify the person responsible for the leak at FRA. 336 Since FRA’s conduct in that regard is unlawful, it is necessary to determine whether it gave rise to damage and whether there is a causal link between the two. (2) Demonstration of damage suffered 337 The applicant claims, in the present case, that she suffered material and non-material damage as a result of the leak of her personal data. (i) Material damage 338 Although the applicant provisionally assessed her material damage at EUR 60 000 in her application, she refined that figure during the procedure before the General Court. 339 It is argued that her material damage is the result, in essence, of various fees that she had to incur in order to deal with the disclosure of her personal data and [confidential]. 340 It is claimed that the applicant’s material damage comprises (i) the sum of RON 13 600, disbursed in engaging the services of a lawyer following the discovery of the leak of her personal data; (ii) the sum of EUR 3 780, disbursed in engaging the services of a lawyer at the pre-litigation stage in the cases pending before the Court; (iii) the sum of EUR 11 173.36 covering the applicant’s representation and translation costs in [confidential]; and (iv) expenses incurred in dealing with the deterioration of her health. 341 For its part, FRA observes, first, that the applicant has failed to adduce any evidence in support of her claim that she suffered genuine damage. Second, it observes that the costs incurred during the pre-litigation stage cannot be reimbursed by the award of damages. 342 In that connection, it should be recalled that (i) the damage in respect of which compensation is sought must be actual and certain; and (ii) the applicant must adduce evidence to demonstrate the existence and extent of the damage suffered. 343 In the present case, neither in her application nor her reply does the applicant refer to any annex which might prove the payment of RON 13 600 made in respect of legal services provided by a lawyer. 344 The same applies, first, to the costs which she claims to have incurred during the pre-litigation stages, inasmuch as those costs have not been proven in any way by reference to annexes, irrespective of the question whether it is possible to award damages in respect of costs incurred during the pre-litigation stage. 345 Secondly, the applicant has failed to adduce any evidence to demonstrate the existence and scale of the costs which she claims to have incurred in connection with [confidential]. 346 In any event, it is apparent from her application for confidential treatment with regard to the public, lodged at the Court Registry on 23 December 2016, that [confidential]. 347 On the other hand, the applicant submitted a set of documents to the Court, demonstrating, to the requisite legal standard, various bank transfers made to her lawyer and to the persons responsible for translations [confidential], totalling EUR 11 173.26. 348 Furthermore, while the applicant admittedly pleads material damage as a result of the increase in her health-related expenditure, the fact remains that she merely refers to various medical prescriptions, invoices and reimbursements, without also giving precise figures to indicate the scale of the damage suffered. 349 Thus, the applicant has failed to demonstrate in any way the existence and extent of the damage in respect of that health expenditure. 350 Consequently, the only actual material damage that has been demonstrated, together with the extent of that damage, is that resulting from the costs incurred [confidential]. (ii) Non-material damage 351 As regards the leak of her personal data, the applicant quantifies her non-material damage at EUR 112 500. 352 She claims that that damage resulted from FRA’s actions, which gave rise, so far as the applicant is concerned, to feelings of injustice, frustration and distress. 353 FRA disputes the claim that, even if its conduct were unlawful, that conduct could cause any non-material damage for the applicant. 354 In that regard, it should be recalled that, although evidence of non-material damage is not a precondition for it to be taken into account, the applicant must at the very least demonstrate that the conduct complained of was such as to cause him such damage (see, to that effect, judgments of 16 July 2009, SELEX Sistemi Integrati v Commission, C‑481/07 P, not published, EU:C:2009:461, paragraph 38, and of 16 October 2014, Evropaïki Dynamiki v Commission, T‑297/12, not published, EU:T:2014:888, paragraphs 31, 46 and 63). 355 In the present case, it is clear that the applicant has demonstrated, to the requisite legal standard, that FRA’s conduct was such as to cause her non-material damage, as is apparent from paragraph 352 of the present judgment. 356 Accordingly, that must be taken into account for the purposes of assessing her claim for compensation. (3) Whether there is a causal link 357 It is necessary to verify whether there is a sufficiently direct causal link between FRA’s unlawful conduct, as found in paragraph 336 of the present judgment, and the material and non-material damage on which the applicant relies in support of her claim for compensation. 358 In the first place, in so far as concerns the material damage, it should be noted that no sufficiently direct causal link can be ascertained between the costs incurred by the applicant in [confidential] and the unlawful act found in paragraph 336 of the present judgment, in that that unlawful act concerns the leak of documents containing personal data and the addition of those documents to the file [confidential]. 359 In any event, the question of the reimbursement of costs incurred at national level comes within the exclusive jurisdiction of the national court, which, in the absence of relevant harmonising measures in that field, must settle such a question pursuant to the applicable national law (see, to that effect, judgment of 18 September 1995, Nölle v Council and Commission, T‑167/94, EU:T:1995:169, paragraph 37). 360 In the second place, in so far as concerns non-material damage, it cannot be disputed that there is a direct causal link, in that the documents which were the subject of the leak imputable to FRA were used in support, inter alia, of [confidential], which gave rise to feelings of injustice and distress for the applicant. 361 Accordingly, the causal link between the applicant’s non-material damage and FRA’s unlawful conduct is sufficiently immediate. 362 Consequently, in the light of the foregoing, it would be a fair assessment of the case to order FRA to pay the applicant the sum of EUR 5000 by way of compensation. (d) The complaint alleging failure to adopt preventive measures 363 The applicant claims, first, that the new FRA Director exceeded his powers and infringed his duty of care in failing to prevent the leak of her personal data. 364 She argues, secondly, that the new FRA Director infringed his duty of sound administration by the manner in which he replied to her requests. 365 More specifically, she criticises the new FRA Director for failing to provide her with sufficiently detailed and precise replies and for being excessively passive. 366 Thirdly, the applicant puts forward the argument that she acted in accordance with the provisions of the Staff Regulations of Officials of the European Union when she brought certain concerns regarding irregularities which vitiated public procurement rules to the attention of the former FRA Director, and that the decision not to renew her contract as a member of the contract staff of 4 April 2016 constituted a misuse of powers and an infringement of her freedom of expression and information. 367 The applicant therefore argues, in essence, that the damage which she suffered as a result of the leak of documents containing personal data could have been avoided had FRA complied with the provisions on whistleblowing. 368 FRA maintains that it did not disclose the applicant’s personal data in any way, with the result that it cannot be criticised for having acted in breach of its duty of care. 369 It adds that it asked the applicant on several occasions to avoid repetitive and abusive applications, as well as informing her of instances in which FRA did not have to reply to correspondence from citizens because of its nature. 370 As regards the alleged irregularities in public procurement, FRA points out that the breach claimed by the applicant bears no relation to the subject matter of the present dispute, with the effect that that claim must be declared inadmissible. 371 It should be observed that the applicant aims, in essence, to demonstrate that the leak of her personal data could have been avoided had the measures which she claims ought to have been applied had indeed been applied. 372 Irrespective of the merits of the arguments put forward in that regard by the applicant, it is clear, first, that, as is apparent from paragraph 336 of the present judgment, the leak of her personal data is imputable to FRA. 373 Second, the Court has found that damage was suffered as a result of the leak of her personal data, and the claim for compensation in respect of that damage has been upheld in paragraph 362 of the present judgment. 374 Furthermore, even assuming that the preventive measures claimed by FRA were indeed adopted, those measures could, at the very most, only have limited the damage suffered by the applicant as a result of the leak of her personal data. 375 In other words, even if FRA acted unlawfully in failing to respond adequately, the Court has found that damage was suffered as a result of the leak of her personal data, and the claim for compensation in respect of that damage has been upheld in paragraph 362 of the present judgment. 376 Consequently, the complaint alleging failure to adopt measures which could have prevented the leak of the applicant’s personal data must be rejected. (e) The complaint alleging that an improper interview was granted by the new FRA Director to the newspaper Politico 377 First, the applicant claims that the interview given by the new FRA Director to the newspaper Politico, published on 16 April 2016, led, on account in particular of statements made regarding ‘BP’, to the leak of personal data, in breach of Article 5 of Regulation No 45/2001 and of the precautionary principle. 378 Secondly, she criticises FRA for having publicly supported Mr T. 379 FRA disputes the merits of the applicant’s arguments. 380 In the first place, the applicant claims that the new FRA Director disclosed her personal data during the interview that he granted to Politico. 381 In that connection, first, it should be borne in mind that, under Article 5 of Regulation No 45/2001, personal data may be processed only in the circumstances exhaustively listed in that article. 382 In the present case, it is apparent from a reading of the article published in Politico that the new FRA Director is, first, quoted as having stated that ‘the agency had acted quickly to implement EU court decisions in two recent cases involving disaffected employees’. 383 Secondly, in the case of an official who has claimed to have been dismissed from FRA as a result of racial discrimination, the new FRA Director stated that the employee, identified in the procedural documents as ‘DD’, ‘returned to work in March’ and that ‘his agency had “actively” implemented a judgment of the General Court of the EU referring to the case of a person identified in court documents as “BP”’. 384 As regards the applicant specifically, the new FRA Director stated, third, that, for reasons of confidentiality, he could not reveal whether the applicant had been re-employed: ‘I am limited in what I can say, other than assure you that this has been an important priority of mine to ensure that we act on this immediately, just as in the case of DD’. 385 The new FRA Director thus clearly refrained from revealing the identity of the other parties and making negative statements with regard to them. His statements related to the implementation of the judgments in cases before the EU courts which are now closed, in particular the cases which gave rise to the judgments of 3 June 2015, BP v FRA (T‑658/13 P, EU:T:2015:356), and of 8 October 2015, DD v FRA (F‑106/13 and F‑25/14, EU:F:2015:118). 386 Furthermore, as regards the statements made in relation to ‘BP’, the new FRA Director confined himself to referring to the anonymisation rules applied by the EU courts, with regard to which the applicant fails to give any reasons as to why those rules may be insufficient. 387 Secondly, the new FRA Director cannot be criticised for, or have imputed to him, those measures undertaken by other persons, including the applicant, which made her directly identifiable. 388 First, the same applies in particular to the use of the letters ‘BP’ in an article which appeared in the Austrian press, published on 25 January 2016, in which the applicant strongly criticised the atmosphere at FRA. Secondly, the applicant did not oppose the use of her first name and surname, which made her directly identifiable, in an article published in Politico on 21 March 2017, in its ‘Brussels Influence’ section, in which reference was made to her allegations. 389 Lastly, nor can the applicant rely on the judgment of 12 September 2007, Nikolaou v Commission (T‑259/03, not published, EU:T:2007:254), in support of her arguments as, in that case, the press articles — which in part contained negative comments — referred to Mrs Kalliopi Nikolaou by name and to information relating to investigations being carried out concerning her. 390 Consequently, the applicant cannot maintain that the new FRA Direction infringed Article 5 of Regulation No 45/2001 in his interview with Politico. 391 In the second place, the applicant claims that the new FRA Director publicly supported Mr T., in breach of obligations which, it is argued, are incumbent on authorities to ‘avoid giving to the press information which could damage the official’. 392 In that connection, it should be noted that the applicant cannot consider the content of the article in Politico as indisputable. 393 It is apparent from the extract from the verbatim transcription of the recording of the interview, annexed to the rejoinder, that the new FRA Director did not ‘defend the [FRA’s] 2014 decision to hire as a consultant a former judge of the Civil Service Tribunal even though [Mr T.] was on a stand-by list of temporary judges who could be called on to serve’. The new FRA Director simply confined himself to giving a summary of the circumstances, as he understood them, surrounding Mr T’s position when he was employed as external legal counsel to FRA. 394 Accordingly, the applicant cannot claim that the new FRA Director publicly supported Mr T. 395 In the third place, the applicant claims, in essence, that the new FRA Director failed to comply with the precautionary principle in the interview given to Politico. 396 In that connection, it should be observed that the precautionary principle can be defined as a general principle of EU law requiring the competent authorities to take appropriate measures to prevent specific potential risks to public health, safety and the environment, by giving precedence to the requirements related to the protection of those interests over economic interests. In so far as the EU institutions are responsible, in all their spheres of activity, for the protection of public health, safety and the environment, the precautionary principle can be regarded as an autonomous principle stemming from the Treaty provisions (judgment of 26 November 2002, Artegodan and Others v Commission, T‑74/00, T‑76/00, T‑83/00 to T‑85/00, T‑132/00, T‑137/00 and T‑141/00, EU:T:2002:283, paragraph 184). 397 It is clear that the precautionary principle cannot be applied with regard to statements made to Politico by the new FRA Director, as the prevention of specific potential risks to public health, safety and the environment is not at issue in the present case. 398 Accordingly, the complaint alleging that an improper interview was granted to Politico must be rejected. 399 Consequently, the claim for compensation in respect of the damage suffered by the applicant as a result of the leak of her personal data must be upheld in part, and the claim for compensation must be dismissed as to the remainder. 2. The request for the examination of witnesses 400 On 30 November 2016, the applicant lodged a request for the examination of witnesses, namely FRA’s external legal counsel, the former FRA Director and the Interim Director. 401 FRA takes the view that the present request must be rejected as unfounded. 402 In that connection, it should be recalled that even where a request for the examination of a witness, made in the application, refers precisely to the facts on which and the reasons why a witness should be examined, it falls to the General Court to assess the relevance of the request to the subject matter of the dispute and the need to examine the witnesses named (see judgment of 19 December 2013, Siemens and Others v Commission, C‑239/11 P, C‑489/11 P and C‑498/11 P, not published, EU:C:2013:866, paragraph 323 and the case-law cited). 403 The Court of Justice has also stated that the General Court’s discretion in that regard is in line with the fundamental right to a fair hearing and, in particular, Article 6(3)(d) of the ECHR (see judgment of 19 December 2013, Siemens and Others v Commission, C‑239/11 P, C‑489/11 P and C‑498/11 P, not published, EU:C:2013:866, paragraph 324 and 325 and the case-law cited). 404 It is apparent from the case-law of the Court of Justice that that provision does not confer on the accused an absolute right to obtain the attendance of witnesses before a court and that it is in principle for the court hearing the case to determine whether it is necessary or appropriate to call a witness (see judgment of 19 December 2013, Siemens and Others v Commission, C‑239/11 P, C‑489/11 P and C‑498/11 P, not published, EU:C:2013:866, paragraphs 324 and 325 and the case-law cited). 405 In the present case, it is clear that, as is apparent from paragraphs 221 to 399 of the present judgments, the Court has been able to decide the matter on the basis of the forms of order sought, the pleas in law and arguments put forward, together with the evidence submitted by the parties. 406 Accordingly, the request for the examination of witnesses must be rejected. 3. The request for the adoption of a measure of inquiry 407 By letter lodged at the Court Registry on 13 July 2018, the applicant requested that the Court adopt measures of inquiry, in accordance with Article 88 and Article 91(b) of the Rules of Procedure. 408 FRA takes the view that that request must be rejected as unfounded. 409 In that connection, pursuant to Article 88(1) of the Rules of Procedure, measures of inquiry may be taken or modified at any stage of the proceedings either of the General Court’s own motion or on the application of a main party. 410 Moreover, pursuant to Article 91(b) of the Rules of Procedure, measures of inquiry may seek to request a party to provide information or produce any material relating to the case. 411 However, there is no need to order a measure of inquiry sought by an applicant where its purpose is not to clarify the plea the applicant raised or to prove that its factual submissions are accurate, but rather appears to be an attempt to obtain new evidence in support of its action, unless the applicant raises specific complaints which can be checked or clarified by a request for information or for specific documents (see, to that effect, judgment of 8 November 2000, Bareyt and Others v Commission, T‑175/97, ET:T:2000:259, paragraphs 89 to 91). 412 In the present case, the applicant bases the request for a measure of inquiry, in essence, on FRA’s allegedly incomplete and imprecise reply to the measure of organisation of procedure adopted by the Court on 6 June 2018. 413 It should be noted that, by its reply, FRA complied with the wording of the Court’s measure of organisation of procedure of 6 June 2018, and that reply did not necessitate the adoption by the Court of a measure of inquiry. 414 Accordingly, the request for the adoption of a measure of inquiry must be rejected. Costs 415 Under Article 134(3) of the Rules of Procedure, where each party succeeds on some and fails on other heads, the parties are to bear their own costs. However, if it appears justified in the circumstances of the case, the Court may order that one party, in addition to bearing his own costs, pay a proportion of the costs of the other party. 416 In the present case, it is appropriate to order each party to bear their own costs. 417 That allocation takes account of the costs incurred for the purposes of dealing with requests for the adoption of measures of organisation of procedure and measures of inquiry, the examination of witnesses, the introduction of a new plea in law and the submission of offers of further evidence. On those grounds, THE GENERAL COURT (Fifth Chamber), hereby: 1. Orders the European Union Agency for Fundamental Rights (FRA) to pay BP the sum of EUR 5 000; 2. Orders that the compensation awarded in paragraph 1 above be increased by default interest, to be calculated from the date of delivery of the present judgment until full payment, at the rate set by the European Central Bank (ECB) for its principal refinancing operations, plus two percentage points; 3. Dismisses the action as to the remainder; 4. Orders FRA and BP each to bear their own costs. Labucka Dittrich Ulloa Rubio Delivered in open court in Luxembourg on 11 July 2019. E. Coulon Registrar President *Language of the case: English. (i) The name appearing in the fourth indent of paragraph 144 and in paragraph 150 has been replaced in accordance with a decision of the Committee provided for in Article 2 of the decision of the General Court of 16 October 2019 establishing an internal supervision mechanism regarding the processing of personal data by the General Court when acting in its judicial capacity. 1 Confidential information omitted.