62023TJ1180_RES
Case T‑1180/23
BW
v
European Union Agency for Law Enforcement CooperationandEuropean Union Agency for Criminal Justice Cooperation
Judgment of the General Court (Fifth Chamber) of 25 February 2026
(Cooperation between police authorities and other law enforcement agencies of Member States – Sky ECC encrypted communications service – Alleged unlawful processing of personal data – Action for annulment – Act not subject to review – Preparatory act – Admissibility – Processing of personal data by Member States and transfer of such data to Europol – Transfer of personal data by Europol to a Member State – Transfer of personal data from Eurojust to a third country – Non-contractual liability – Article 50 of Regulation (EU) 2016/794 – Joint and several liability of Europol and the Member States for unlawful data processing – Sufficiently serious breach of a rule of law conferring rights on individuals – Actual damage – Regulation (EU) 2018/1727 – Insufficient coordination by Eurojust of criminal proceedings between a Member State and a third country – Articles 71, 72, 89, 91 and 92 of Regulation (EU) 2018/1725)
Action for annulment – Jurisdiction of the EU judicature – Application for annulment of acts of processing personal data carried out by national authorities in the context of criminal proceedings, as well as acts of transmission of documents and information by those authorities to Europol or Eurojust – Not included
(Art. 263 TFEU)
(see paragraphs 23-25)
Action for annulment – Jurisdiction of the EU judicature – Request for annulment of an agreement establishing a joint investigation team (JIT) – Not included
(Art. 34 TEU; Art. 263 TFEU)
(see paragraphs 26-31)
Actions for damages – Subject matter – Compensation for damage resulting from unlawful processing of personal data – Action brought against Eurojust by Member States or Europol – Lack of jurisdiction of the EU judicature
(Arts 268 and 340 TFEU; European Parliament and Council Regulation 2018/1727)
(see paragraphs 33-35, 41)
Actions for damages – Subject matter – Compensation for damage resulting from unlawful processing of personal data – Action brought against Europol by Member States – Jurisdiction of the EU judicature – Limit – Lack of jurisdiction in the event of damage resulting from operations carried out by the police or other law enforcement agencies of Member States
(Arts 268, 276 and 340 TFEU; European Parliament and Council Regulation 2016/794, recital 57 and Art. 49(3) and (4) and 50)
(see paragraphs 37, 38, 42-46)
Non-contractual liability – Joint and several liability of the Union and the Member States – Regulation 2016/794 – Liability for unlawful processing of personal data – Joint and several liability of Europol and the Member State concerned – Criteria – Proof that the unlawful processing is attributable to Europol or the Member State concerned
(Art. 340, second para., TFEU; European Parliament and Council Regulation 2016/794, Art. 50(1))
(see paragraphs 93, 136)
Actions for annulment – Actionable measures – Concept – Measures producing binding legal effects – Preparatory measures – Not included – Participation of Europol or Eurojust in meetings or working groups – Not included
(Art. 263 TFEU)
(see paragraphs 108-110)
Actions for annulment – Actionable measures – Concept – Acts producing binding legal effects – Transmission by a Union agency of personal data from the Sky ECC encrypted communications service – Transmission to a Member State – Not included – Transmission to a third country – Included – Condition
(Art. 263 TFEU)
(see paragraphs 111-123)
Non-contractual liability – Conditions – Regulation 2016/794 – Liability for the unlawful processing of personal data – Nature of that liability – Joint and several liability of Europol and the Member State concerned – Scope – Assessment of the legality of acts or conduct by Member States other than the collection of data during operations carried out by the police or other law enforcement services of Member States – Assessment based on the relevant EU or national law
(Arts 268, 276 and 340, second para., TFEU; European Parliament and Council Regulation 2016/794, Art. 50(1))
(see paragraphs 141, 142, 162-164)
Résumé
Dismissing an action for annulment and damages brought by BW against the European Union Agency for Law Enforcement Cooperation (Europol) and the European Union Agency for Criminal Justice Cooperation (Eurojust) in the context of police and judicial cooperation between several Member States, for the first time since the judgment in Kočner v Europol, (
1
) the General Court clarifies the scope of joint and several liability, particularly with regard to the limits resulting from Article 276 TFEU. It also ruled that the transmission of personal data by Eurojust to a Member State does not constitute a challengeable act within the meaning of Article 263 TFEU, while recognising, by contrast, that the transmission of such data to a third country is challengeable in the absence of any other effective judicial review.
BW, the applicant, is a Serbian national who has been prosecuted and imprisoned in the Netherlands since May 2023 for importing cocaine, and has also been prosecuted in Serbia since autumn 2023 for offences relating in particular to drug trafficking.
The criminal proceedings brought by the Netherlands and Serbian authorities stem from investigations launched in the late 2010s by the Belgian, Netherlands and French authorities against the ‘Sky ECC organisation’, ECC meaning Elliptic Curve Cryptography, which is suspected of marketing encrypted communications products and services specifically designed to facilitate criminal activity.
Following those investigative measures, at the end of 2018 Belgium and the Netherlands issued joint investigation decisions requesting France to create an image of the servers used by the Sky ECC service and located in that State. France complied with that request by intercepting, recording and transcribing encrypted communications entering and leaving those servers, including data concerning BW.
In 2019, through a joint investigation team agreement (‘the JIT agreement’) (
2
) concluded between them, the Belgian, French and Netherlands authorities set up a joint investigation team (‘the JIT’). That led to the sharing between Europol and the three Member States concerned of the raw data intercepted, which was then to be analysed, as well as the results of that analysis.
As part of that cooperation, Europol stored the data in its computer system, cross-referenced it, produced intelligence reports, generated data visualisation graphics and interpreted multilingual data sets. For its part, Eurojust provided support and advice on opportunities for judicial cooperation, organised several coordination meetings between the relevant national authorities and Europol, and facilitated judicial cooperation between Serbia, on the one hand, and the Netherlands and France, on the other.
In that context, BW asked the General Court to annul the JIT agreement, the acts of Europol and Eurojust adopted on the basis of the latter, and the acts of processing, analysing and sharing by them and the Member States concerned of data from the Sky ECC server concerning him. He also requested that Europol and Eurojust be ordered to pay him compensation for the non-material and material damage he claims to have suffered.
Findings of the Court
First, with regard to the question of its jurisdiction, the General Court declares, in the first place, that it has no jurisdiction to hear, on the basis of Article 263 TFEU, the authorisation by the French court of the interception operations carried out by the French authorities, the conduct of those operations, the transmission to Europol by the French authorities of the documents and information obtained in the course of those operations, the transmission to Eurojust and the Serbian authorities by the French authorities of the documents and information requested by the Serbian authorities in the context of their requests for mutual legal assistance, the regularity of the criminal proceedings before the Serbian courts and the JIT agreement.
With regard, more specifically, to that agreement, the General Court notes that the EU Courts do not have jurisdiction to rule directly on its legality on the basis of Article 263 TFEU, since it is not an EU act. The JIT agreement was signed and therefore concluded by only three Member States. That finding is not called into question either by the fact that the agreement is based on a convention concluded by those Member States pursuant to Article 34 TEU and on a framework decision of the Council of the European Union, or by the creation of the JIT concerned on the initiative of Europol or Eurojust, or by the decision of Belgium, France and the Netherlands, taken under the JIT agreement to involve Europol and Eurojust as ‘participants’ in the JIT. In that context, the General Court specifies that the power conferred on Europol or Eurojust to propose or assist in the creation of a JIT, as well as on their agents to take part in a JIT, (
3
) does not confer on those agencies the status of ‘party’ to the agreement by which the three Member States created the JIT concerned.
In the second place, the General Court declares that it has no jurisdiction to hear the applicant’s claim seeking a declaration that Eurojust is liable on account of the actions of Belgium, France and the Netherlands, or even Serbia, or on account of the actions of Europol. It bases that conclusion in particular on the fact that the liability of the European Union under Articles 268 and 340 TFEU cannot be sought from an institution, body or agency of the European Union other than the one which is alleged to have caused the liability, unless the EU legislature has expressly provided for a derogation from joint and several liability either between one of those institutions or bodies or agencies of the EU and one or more Member States, or even one or more third countries, or between several institutions, bodies or agencies of the EU. It finds that, in this case, no act provides for a derogation from the rules on joint and several liability between Eurojust and the Member States or between Eurojust and Serbia.
However, the General Court recognises that it has jurisdiction to hear the application seeking a declaration of liability on the part of Eurojust for its own conduct and on the part of Europol for conduct attributable both to itself and to the Member States that took part in the cooperation relating to the Sky ECC service.
Despite its jurisdiction to hear the claim seeking a declaration of Europol’s joint and several liability for conduct attributable to the French authorities in particular, the General Court states that it has no jurisdiction to hear the applicant’s allegations of damage allegedly caused to him by the interception of his personal data in the course of police operations carried out by those authorities. In that regard, notwithstanding the joint and several liability regime provided for in the Europol regulation, that agency cannot be held jointly and severally liable for any damage resulting from the unlawful processing of personal data of a natural person during operations carried out by the police or other law enforcement services of a Member State, even if that processing took place in the context of cooperation based on that Regulation. It follows from Article 276 TFEU that, in exercising its powers relating to judicial cooperation in criminal matters and police cooperation, the EU Courts do not have jurisdiction to review the validity or proportionality of operations carried out by the police or other law enforcement services in a Member State.
Secondly, with regard to the claims for annulment, the General Court, in ruling on their admissibility, finds that the acts or conduct criticised by the applicant are not open to challenge, except for the transmission by Eurojust to the Serbian authorities, on 24 June 2022, of an email from the French authorities containing a link to a secure download site containing, in particular, some of his conversations from the Sky ECC service.
With regard to that transmission, the General Court points out that, although it is apparent from the case-law concerning the transmission of final reports and information to Member States by the European Anti-Fraud Office (OLAF), which is applicable by analogy to the present case, that such transmission does not constitute a challengeable act, both the Court of Justice and the General Court have, however, taken into consideration, in order to rule out the reviewability of OLAF’s transmissions, the fact that the applicant had other means at its disposal to ensure the legality of those transmission decisions, including the preliminary ruling procedure. The General Court notes that the transmission of 24 June 2022 took place between an EU agency and the authorities of a third country, in this case Serbia. Thus, since it cannot be challenged in the context of the present action, the legality of that transmission under EU law can no longer be challenged and the personal data it contains may be regarded as having been lawfully transmitted to the Serbian authorities, without the applicant subsequently being able to obtain from the courts of that third country either an assessment of the validity of that transmission under EU law or a preliminary ruling from the Court of Justice on that matter. In that sense, that transfer constitutes the final stage of a special procedure whereby Eurojust transfers personal data relating to an identified person to the authorities of a third country at their request.
The General Court adds that only by recognising that the transfer of 24 June 2022 is open to challenge can effective supervision by a judicial authority or other independent body be guaranteed in relation to the transfer of intercepted personal data and their use for purposes other than those of the criminal proceedings for which they were initially collected. The fact that the applicant could bring an action before the French courts or that he could bring an action before the European Court of Human Rights following a possible conviction by the Serbian criminal courts is irrelevant. First, the French courts cannot hear an action for annulment against an act of an EU agency. Secondly, in the absence of the EU’s accession to the Convention for the Protection of Human Rights and Fundamental Freedoms, that Court cannot find that the European Union has violated that convention, particularly in the context of an appeal brought against a third country.
However, the General Court rejects as unfounded the claims seeking annulment of the transfer of 24 June 2022, as the applicant has not established how that transfer gave rise to unlawful processing of his personal data.
Thirdly, with regard to the applicant’s claims for compensation, the General Court considers that the first head of damage relates to allegations of incorrect processing of data by both Europol and the three Member States concerned, which fall within the scope of the derogation from joint and several liability provided for in the Europol regulation, (
4
) and thus takes into account not only the acts or conduct of Europol, under the general liability regime applicable to it under that regulation, (
5
) but also those of the three Member States concerned, under the aforementioned derogation regime of joint and several liability.
The General Court adds that Europol is wrong to argue that it cannot be held responsible for the acts or conduct of Member States and that the General Court cannot assess their legality. While it is true that, under Article 276 TFEU, the EU Courts do not have jurisdiction to review the validity or proportionality of operations carried out by the police or other law enforcement authorities in a Member State, including in the context of actions brought under Articles 268 and 340 TFEU, it remains that, outside those specific operations, the derogatory regime of joint and several liability provided for in the Europol regulation implicitly but necessarily implies that Europol may be held liable for acts or conduct of Member States. It follows just as necessarily that, in the context of actions for damages based on that derogatory regime, the General Court is empowered to assess the legality of acts or conduct of Member States other than those by which their police or other law enforcement services collected the data concerned, whether on the basis of EU law or on the basis of the national law of the State concerned.
With regard to the second head of damage, which essentially concerns the sole breach of the right to a fair trial due to the impossibility of verifying the ‘usability’ of data from the Sky ECC service in national criminal proceedings following investigations in which Europol participated, the Court finds that the applicant does not contest the lawfulness of the processing of his personal data within the meaning of Article 28 of the Europol regulation, which is the only argument that could bring a dispute within the scope of the derogation from joint and several liability provided for in that regulation. Thus, for the purpose of examining this head of damage, it takes into consideration only the acts or conduct of Europol under the general liability regime arising from that regulation.
As regards the third head of damage, relating to the alleged existence of double prosecution of the applicant for the same acts by the Netherlands and Serbian criminal authorities, the General Court points out that, in this head of claim, the applicant criticises Europol solely for failing to fulfil its obligations under the JIT agreement. Thus, it takes into consideration only the acts or conduct of Europol, under the general liability regime arising from the Europol regulation.
The General Court rejects the three heads of damage as unfounded.
(
1
)	Judgment of 5 March 2024, Kočner v Europol (C‑755/21 P, EU:C:2024:202).
(
2
)	This agreement was concluded on the basis of Article 13 of the Convention established by the Council in accordance with Article 34 TEU on mutual assistance in criminal matters between Member States of the European Union (OJ 2000 C 197, p. 3) and the Council Framework Decision of 13 June 2002 on joint investigation teams (OJ 2002 L 162, p. 1).
(
3
)	Respectively conferred by Article 5 of Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on Europol and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (OJ 2016 L 135, p. 53; ‘the Europol regulation’), and Article 8(1)(d) of Regulation (EU) 2018/1727 of the European Parliament and of the Council of 14 November 2018 on Eurojust, and replacing and repealing Council Decision 2002/187/JHA (OJ 2018 L 295, p. 138).
(
4
)	Article 50(1) of the Europol regulation.
(
5
)	General responsibility of Europol referred to in Article 49 of the Europol regulation.