62020TJ0384(01)_RES
Case T‑384/20 RENV
OC
v
European Commission
Judgment of the General Court (Third Chamber) of 1 October 2025
(Non-contractual liability – OLAF investigation – Press release – Processing of personal data – Presumption of innocence – Principle of good administration – Duty to act diligently – Confidentiality of OLAF investigations – Sufficiently serious breach of a rule of law conferring rights on individuals – Causal link – Damage)
Non-contractual liability – Conditions – Unlawfulness – Sufficiently serious breach of a rule of law conferring rights on individuals – Institution with a reduced or non-existent discretion – Mere infringement of EU law sufficient
(Art. 340, second para., TFEU)
(see paragraphs 26-29)
EU institutions – Protection of natural persons with regard to the processing of personal data – Regulation 2018/1725 – Scope – Concept of the processing of personal data – Publication of a press release by the European Anti-Fraud Office (OLAF) – Included
(European Parliament and Council Regulation 2018/1725, Art. 3, point 3)
(see paragraph 48)
EU institutions – Protection of natural persons with regard to the processing of personal data – Regulation 2018/1725 – Conditions governing the lawfulness of the processing of personal data – Processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority – Meaning – Publication of a press release by the European Anti-Fraud Office (OLAF) – Informing the public of OLAF’s activities – Included
(European Parliament and Council Regulation 2018/1725, Arts 4(1)(a) and 5(1)(a))
(see paragraphs 52, 56, 57)
EU institutions – Protection of natural persons with regard to the processing of personal data – Regulation 2018/1725 – Publication of a press release by the European Anti-Fraud Office (OLAF) including information on the gender, the nationality and the family ties of the data subject permitting identification of that person – Unlawful processing of personal data
(European Parliament and Council Regulation 2018/1725, Arts 4(1)(a) and 5(1)(a))
(see paragraphs 59-61, 79, 80)
EU institutions – Protection of natural persons with regard to the processing of personal data – Regulation 2018/1725 – Further processing of personal data – Conditions – Compatibility of the further processing of the data with the purposes of the initial collection thereof – Publication of a press release by the European Anti-Fraud Office (OLAF) – Data initially collected during OLAF’s investigation – Data further processed with a view to informing the public of OLAF’s activities – Breach
(European Parliament and Council Regulation 2018/1725, Arts 4(1)(b) and 6)
(see paragraphs 67, 68, 70-76)
Non-contractual liability – Conditions – Unlawfulness – Sufficiently serious breach of a rule of law conferring rights on individuals – Rule of law conferring rights on individuals – Meaning – Principle of the presumption of innocence – Included – Informing the public of actions of the European Anti-Fraud Office (OLAF) in a press release – Whether permissible – Person identified or identifiable in a press release incriminating that person before his or her guilt is established by a court – Sufficiently serious breach of the principle of the presumption of innocence
(Charter of Fundamental Rights of the European Union, Art. 48(1); European Parliament and Council Regulation No 883/2013, Arts 9(1) and 10(5))
(see paragraphs 86-93, 110, 111, 114-117, 119-122)
Non-contractual liability – Conditions – Unlawfulness – Sufficiently serious breach of a rule of law conferring rights on individuals – Rule of law conferring rights on individuals – Meaning – Right to good administration and duty to act diligently – Obligation of neutrality and of impartiality – Included – Disclosure of inaccurate information in a press release from the European Anti-Fraud Office (OLAF) – Implication through use of the term ‘fraud’ that the person concerned is guilty – Sufficiently serious breach of those obligations
(Charter of Fundamental Rights of the European Union, Art. 41; European Parliament and Council Regulation No 883/2013, Art. 10(5))
(see paragraphs 126, 127, 142, 156-159, 164-167, 172)
Non-contractual liability – Conditions – Damage – Causal link – Damage caused by the publication of a press release from the European Anti-Fraud Office (OLAF) – Non-material damage from slur cast on honour and reputation – Non-material damage from prejudice to professional career – Damage linked to state of health – Included
(Art. 340, second para., TFEU; European Parliament and Council Regulation 2018/1725, Art. 65)
(see paragraphs 181-187, 200-202, 216, 222, 225-229)
Résumé
Hearing an action for non-contractual liability of the European Union, the General Court, while contributing to developments in the case-law on the protection of personal data, finds that the European Commission is to pay compensation for the damage caused by the publication of a press release from the European Anti-Fraud Office (OLAF) (‘the press release at issue’).
In September 2008, the Commission and a Greek university signed a grant agreement relating to the project led by the applicant, who is an academic researcher.
Once the project was completed, the Greek university, under the grant agreement, sought from the European Research Council Executive Agency (ERCEA) – which had replaced the Commission as the other party to the agreement – payment of an amount corresponding to expenditure incurred, including staff costs. Following an ex post financial audit, ERCEA concluded that a certain amount thereof was ineligible and thus sought to recover that amount from the Greek university by issuing a debit note to that end.
Meanwhile, the Director-General of OLAF, who had been informed by ERCEA of the results of its audit, decided, in May 2015, to open an investigation into possible irregularities or fraud in carrying out the project. (
1
)
In its final report on that investigation, OLAF recommended, first, that ERCEA take appropriate steps to recover the sums deemed overpaid to the Greek university concerned and, second, that the national judicial authorities, which had been informed thereof, initiate proceedings, inter alia, against the applicant for fraud and forgery. Thereafter, in May 2020, OLAF published on its website the press release at issue.
The following month, the applicant brought before the Court an action under Article 268 TFEU, seeking an order that the Commission pay compensation for the non-material damage allegedly caused by that press release. By its judgment of 4 May 2022, OC v Commission, (
2
) the Court dismissed the applicant’s action in its entirety, finding that she had not been able to demonstrate the existence of unlawful conduct by OLAF.
The applicant then brought an appeal before the Court of Justice, seeking to have the General Court’s decision set aside. By its judgment of 7 March 2024, OC v Commission, (
3
) the Court of Justice found, inter alia, that the General Court had erred in law by ruling that the applicant was not identified or identifiable in the press release at issue and that the information contained therein fell outside the concept of ‘personal data’. The Court of Justice thus set aside the judgment of the General Court and referred the case back to it.
Findings of the Court
In the first place, having recalled the three cumulative conditions for the European Union to incur non-contractual liability, the General Court examines the lawfulness of the processing of personal data that took place when the press release at issue was published.
First, it takes the view that informing the public of OLAF’s activities, in particular by issuing press releases, is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in that EU body. (
4
) Therefore, according to the Court, without prejudice to whether it complied with its obligations, OLAF did not exceed its powers by issuing the press release at issue.
Nevertheless, the Court finds that the information contained in that press release concerning the applicant, namely her age, her nationality and her gender, as well as the fact that her father worked at the Greek university, and the amount of the grant, not only permits identification of the applicant but, in addition, is not necessary, with the exception of the amount of the grant awarded, for the purpose of informing the public of OLAF’s anti-fraud activities. Thus, the Court finds that the publication of those data constitutes unlawful processing of the applicant’s personal data.
Second, the Court ascertains whether the further processing of the data, as carried out, is compatible with the purposes for which they were initially collected. In the present case, the applicant’s personal data were initially collected in the context of the investigation conducted by OLAF, for a specified purpose which reflects the anti-fraud mission vested in OLAF. The data were not collected with a view to the publication of a press release, which corresponds to an admittedly related, yet different, purpose, namely informing the public of OLAF’s activities.
Moreover, in addition to the link existing between the purposes of the initial collection of those data and those of the further processing thereof, the Court states that the view cannot be taken that OLAF took into account the nature of the data processed, in particular in so far as they make it possible for the applicant to be identified in connection with alleged criminal offences. Given the allegations made against the applicant, and judging by the content of the press articles following the publication of the press release at issue, the Court finds that OLAF did not take sufficient account of the possible consequences, for the applicant, of the further processing of her data. (
5
) The Court concludes that, by publishing the press release at issue, OLAF further processed the applicant’s personal data in breach of Regulation 2018/1725. (
6
)
Third, in order to determine whether the breach alleged constitutes a sufficiently serious breach capable of giving rise to the non-contractual liability on the part of the European Union, it is necessary to determine the margin of discretion available to the institutions. In that regard, the Court notes that, even if OLAF has a certain margin of discretion available to it for the purpose of applying the provisions of Regulation 2018/1725, (
7
) it must be held that OLAF gravely and manifestly disregarded those provisions by publishing, in the press release at issue, the applicant’s nationality, age and family ties. Furthermore, the Commission’s argument that, without the information included in that press release, the probability that the content thereof would be picked up by the media would have been reduced not only makes it possible to rule out that the error committed was excusable, but also establishes an element of intent.
Accordingly, the Court finds that, by publishing its press release, OLAF unlawfully processed the applicant’s personal data in breach of Regulation 2018/1725, (
8
) which constitutes a sufficiently serious breach capable of giving rise to liability on the part of the European Union.
In the second place, the Court ascertains the existence of the alleged breach by the applicant of the principle of the presumption of innocence and of the obligation to respect the confidentiality of investigations. In that regard, it recalls that it is apparent from the judgment on appeal that the applicant is identifiable, at least indirectly, on the basis of the information contained in the press release at issue, which is an essential prerequisite for the examination of whether there has been a breach of the principle of the presumption of innocence.
As regards the breach alleged, the Court observes that it has already been held that respect for the principle of the presumption of innocence does not preclude, in the interests of informing the public of actions implemented in the context of possible failures or fraud, an EU institution from reporting the main findings of OLAF’s final report concerning one of their members. However, it is for OLAF to do so using balanced and measured wording and in an essentially factual manner. (
9
)
Consequently, the Court finds that OLAF cannot be criticised for acting in breach of the principle of the presumption of innocence and the confidentiality of investigations merely because it informed the public of the conclusions set out in its final report.
However, it notes that account must be taken of the choice of words used, taking into consideration the actual meaning of the statements and not their literal form. In the present case, it holds that use of the term ‘fraud’ in the press release at issue is the result of a classification in law of the facts and implies guilt on the applicant’s part.
Furthermore, it notes that the fact that the press release at issue came with a description of OLAF’s investigative mission stating that it was for the competent national authorities to rule on whether the applicant is guilty is not sufficient to dispel the impression of guilt created by using the term ‘fraud’. Moreover, whether ‘all researchers’ or ‘ten researchers’ are involved is not decisive for the purpose of establishing whether the applicant is guilty. However, that information, in that it highlights the number of persons concerned, reinforces the sentiment that the applicant is guilty, resulting from the term ‘fraud’ being used in the press release.
Consequently, use of the term ‘fraud’ in that context is not measured within the meaning of the abovementioned criteria. Similarly, the classification of the applicant’s actions as ‘fraud’ goes beyond an essentially factual presentation of the conclusions of OLAF’s final report.
In the light of the foregoing, the Court finds that OLAF, by using the term ‘fraud’ in its press release, acted in breach of the principle of the presumption of innocence.
As regards the existence of a sufficiently serious breach, the Court states that, while OLAF enjoys a certain margin of discretion as regards the appropriateness and content of press releases, that discretion ceases when it comes to compliance with the fundamental rights of the persons concerned. First, the Court recalls that it has already been held that the Commission has no margin of discretion with respect to its obligation to respect the principle of the presumption of innocence. (
10
)
Second, use of the term ‘fraud’ in the press release at issue cannot be regarded as an excusable fault. It is a classification of the allegations made against the applicant going beyond a mere factual description of the conclusions set out in OLAF’s final report and forming part of OLAF’s communication strategy, which may be regarded as lacking the restraint expected of an EU body. Consequently, using the term ‘fraud’ in the press release at issue constitutes a sufficiently serious breach of the principle of the presumption of innocence capable of giving rise to liability on the part of the European Union.
Accordingly, having examined the other breaches alleged by the applicant, the existence of damage and that of a causal link between that damage and the breaches committed by OLAF, the Court orders the Commission to pay the applicant the sum of EUR 50000 for the damage sustained following the publication of the press release at issue.
(
1
)	Pursuant to Article 5 of Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999 (OJ 2013 L 248, p. 1).
(
2
)	Judgment of 4 May 2022, OC v Commission (T-384/20, not published, EU:T:2022:273).
(
3
)	Judgment of 7 March 2024, OC v Commission (C‑479/22, EU:C:2024:215).
(
4
)	Within the meaning of Article 5(1)(a) of Regulation 2018/1725.
(
5
)	Within the meaning of Article 6(d) of Regulation 2018/1725.
(
6
)	In particular, in breach of Article 4(1)(b) and Article 6(c) to (e) of Regulation 2018/1725.
(
7
)	In particular, Article 4(1)(a) and (b), Article 5(1)(a) and Article 6(c) to (e) of Regulation 2018/1725.
(
8
)	In particular, in breach of Article 5(1)(a) and (b) of Regulation 2018/1725.
(
9
)	Judgment of 30 November 2022, KN v Parliament (T‑401/21, EU:T:2022:736, paragraph 67 and the case-law cited).
(
10
)	Judgment of 8 July 2008, Franchet and Byk v Commission (T‑48/05, EU:T:2008:257, paragraphs 219 and 314).