JUDGMENT OF THE GENERAL COURT (Tenth Chamber)
25 March 2026 (*)
( Action for damages – Non-contractual liability of the European Union – Origin of the dispute – Limitation period – Admissibility – Article 339 TFEU – Obligation to state reasons – Principle of good administration – Article 41 of the Charter of Fundamental Rights )
In Case T‑183/24,
DP,
DQ,
represented by N. Flandin, lawyer,
applicants,
v
European Insurance and Occupational Pensions Authority (EIOPA), represented by A. Terstegen-Verhaag and C. Coucke, acting as Agents, and by B. Wägenbaur, lawyer,
defendant,
THE GENERAL COURT (Tenth Chamber),
composed of S.L. Kalėda, President, M. Jaeger (Rapporteur) and S. Verschuur, Judges,
Registrar: M. Zwozdziak-Carbonne, Administrator,
having regard to the written part of the procedure,
further to the hearing on 26 November 2025,
gives the following
Judgment
1        By their action under Article 268 and the second paragraph of Article 340 TFEU, the applicants, DP and DQ, seek compensation for the non-material damage which they claim to have suffered as a result of the unlawful conduct of the European Insurance and Occupational Pensions Authority (EIOPA).
I.      Background to the dispute
2        The applicants carry out consultancy services for the benefit of insurance companies and pension funds which are supervised by the national competent authorities which are in turn supervised by EIOPA.
3        DQ is 100% held by DP, which is 100% held by A, who is the founder, legal representative and managing director of the applicants.
4        On 1 August 2017, in the context of a possible recruitment to EIOPA, A completed a declaration of conflict of interest which contained, inter alia, information concerning the ownership and business conducted by the applicants.
5        By email dated 7 August 2017, A informed EIOPA that he intended to put an end to the consultancy activities he was providing, directly or via the applicants, to companies active in the insurance sector.
6        By email dated 23 August 2017, EIOPA confirmed to A that it had not identified any conflict of interest and sent him a proposed employment contract.
7        On 16 September 2017, A was recruited to the ‘Oversight’ department of EIOPA as a grade AD 7 member of staff for a period of three years.
8        On 26 June 2018, A provided a new declaration of conflict of interest to EIOPA.
9        By email dated 20 July 2018, EIOPA asked A to confirm that the applicants were no longer active in the financial sector.
10      By email dated 6 August 2018, A informed EIOPA that the applicants were no longer active in the insurance sector.
11      On 7 December 2018, EIOPA initiated an ethics check procedure in relation to A to review the content of the two declarations of conflict of interest which he had provided in 2017 and 2018 (‘the ethics check’). In that procedure, the EIOPA officer responsible for questions of professional ethics (‘the ethics officer’) requested A:
–        to indicate the applicants’ activities carried out in 2017 and 2018 in the pension sector and in the wider financial sector;
–        to confirm, as referred to in his email of 7 August 2017, that A had put an end to the consultancy services provided directly or via the applicants;
–        to describe A’s relationship to the applicants, the applicants’ activities and the income they had received for 2017 and 2018.
12      By email dated 7 December 2018, A informed EIOPA that in 2018 the applicants had no activities in the financial sector or client related activities. He also confirmed that the information regarding the cessation of his own consultancy services referred to in his email dated 7 August 2017 was accurate and exhaustive.
13      By email dated 4 January 2019, the ethics officer asked A to provide him with a statement prepared by an external accountant showing all the income he had received in 2018 from the activities of the applicants.
14      In his report dated 28 January 2019, the external accountant stated that for 2018 he had noted 10 sources of income in a bank account belonging to A, including the salary paid by EIOPA.
15      By email dated 18 February 2019, the ethics officer reiterated to A his request for a declaration drawn up by an external accountant indicating, specifically for 2018, all his income deriving from the applicants and asked him to provide the applicants’ accounting documents covering the period following his entry into service at EIOPA. In addition, by email dated 20 February 2019, he informed A that he had called on external counsel for advice on procedure and no substantive assessment of his file had been carried out by external counsel.
16      By emails dated 14 January and 10 March 2019, A provided the ethics officer with the information requested, asserting that the data provided were confidential.
17      On 4 April 2019, the ethics officer sent his screening report to EIOPA, in which he stated that A was in a conflict of interest situation, since (i) he had received undeclared external income in 2018 in excess of the authorised amount and (ii) the applicants were still active in the insurance sector.
18      On 7 May 2019, the Executive Director of EIOPA (‘the Executive Director’) transferred A from the ‘Oversight’ department to another department.
19      On 17 May 2019, A sent to EIOPA his comments on the screening report drawn up by the ethics officer.
20      By decision dated 22 July 2019 (‘the decision to open the administrative inquiry’), the Executive Director opened an administrative inquiry in relation to A in order to establish the nature of his outside activities (‘the administrative inquiry’).
21      By email dated 20 August 2019, A stated that it had been agreed with EIOPA that the information he had provided to it would be disclosed only to the ethics officer, the Executive Director and the data protection officer. In that context, he asked EIOPA why that information had been sent to the investigator dealing with the administrative inquiry (‘the external investigator’) without his prior consent and without the external investigator having signed a non-disclosure agreement.
22      On 30 September 2019, the external investigator issued her report, in which she concluded that A was in a conflict of interest situation as regards EIOPA.
23      By decision dated 17 December 2019, A was dismissed from his duties at EIOPA (‘the dismissal decision’).
24      By email dated 13 January 2020, the data protection officer disclosed to A the names of the persons at EIOPA who had had access to the information he had provided in the context of the ethics check and the administrative inquiry.
25      On 3 February 2020, A lodged a complaint with EIOPA against the dismissal decision (‘the complaint concerning the dismissal decision’). In that decision, he challenged, inter alia, the lawfulness of his being transferred to another EIOPA department and of the dismissal decision, complained of a number of irregularities on the part of that agency in the processing of his personal data and the data of his wife, the applicants and their former clients, and requested compensation be paid in respect of the damage which he claimed to have suffered as a result of the loss of his turnover following the termination, which EIOPA had required of him, of client agreements which he had entered into directly or via the applicants, the amount of that compensation being equivalent to the sum of the value of the contracts terminated and the value of the contracts he was about to sign when he took up his duties at EIOPA.
26      By decision dated 2 June 2020, EIOPA rejected the complaint concerning the dismissal decision.
27      On 30 September 2020, A brought an action before the European Data Protection Supervisor (EDPS) claiming, inter alia, that EIOPA has processed unlawfully his personal data, his wife’s personal data and the applicants’ personal data.
28      By letters dated 17 March, 19 May and 16 July 2021, the applicants, represented by A, requested compensation from EIOPA for the damage they claimed to have suffered as a result of the disclosure of their personal data by EIOPA.
29      By letters dated 7 May, 13 July and 30 August 2021, EIOPA rejected the requests set out in the applicants’ letters dated 17 March, 19 May and 16 July 2021.
30      On 1 December 2021, A submitted a complaint to the European Ombudsman.
31      By decision dated 9 September 2022, the EDPS found that EIOPA had infringed Article 4(1)(a), Article 14 and Article 15(1)(c) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ 2018 L 295, p. 39), in so far as, during the administrative inquiry, it had failed properly to inform A of the legal basis for the processing of his personal data. The EDPS therefore decided to issue a reprimand to EIOPA in accordance with Article 52(2)(b) of that regulation.
32      By decision dated 25 May 2023, the Ombudsman found that, during EIOPA’s recruitment of A, it failed to handle the conflict of interest issues in a diligent manner, which gave rise to a serious instance of maladministration, and that EIOPA had failed to conduct the ethics check and the administrative inquiry with the requisite focus and rigour. However, the Ombudsman clarified that, given the improvements introduced by EIOPA to its procedures for handling conflicts of interest, it was not necessary to proceed to a recommendation, in so far as it was unlikely that the events in the present case would reoccur in the future. Accordingly, the Ombudsman closed the case, stating that her decision did not entitle A to seek redress for the damage he had suffered and that no other legal consequences could be drawn from her decision.
33      On 4 April 2024, the applicants brought the present action.
II.    Forms of order sought
34      The applicants claim that the Court should:
–        order EIOPA to pay to each of them, by way of compensation for the non-material damage suffered as a result of the sufficiently serious breach of Article 339 TFEU and Article 41 of the Charter of Fundamental Rights of the European Union (‘the Charter’), the sum of EUR 15 000, together with compensatory interest calculated from 4 July 2019 at the rate defined by the European Central Bank (ECB);
–        order EIOPA to pay the costs.
35      EIOPA contends that the Court should:
–        dismiss the action as inadmissible or, in the alternative, as unfounded;
–        order the applicants to pay the costs.
III. Law
A.      The plea of inadmissibility
36      By separate document, lodged at the Registry of the General Court on 2 July 2024, EIOPA raised an objection of inadmissibility pursuant to Article 130(1) of the Rules of Procedure of the General Court. In that document, it set out two complaints.
1.      The first complaint in the plea of inadmissibility: the origin of the dispute
37      EIOPA submits that the action is inadmissible since, in so far as that action derives from the employment contract concluded between A and EIOPA, the applicants are not entitled to bring proceedings on the basis of non-contractual liability pursuant to the second paragraph of Article 340 TFEU, but ought rather to have acted on the basis of Article 270 TFEU.
38      In that regard, first, EIOPA maintains that the action is based exclusively on events which took place during A’s period of employment with EIOPA. Second, EIOPA is of the view that the purpose of A sending information concerning the applicants was to ascertain, when examining his outside activities, whether there was a conflict of interest. Third, EIOPA submits that, while the applicants appear to be distinct from A, their founder is A, who directly or indirectly holds 100% of their capital and is their managing director. Therefore, in accordance with the judgments of 30 September 2021, Court of Auditors v Pinxten (C‑130/19, EU:C:2021:782); of 16 January 2003, Fichtner v Commission (T‑75/00, EU:T:2003:9); and of 28 March 2012, BD v Commission (F‑36/11, EU:F:2012:49), the applicants’ economic activity cannot be ‘artificially separated’ from that of A. Fourth, EIOPA maintains that, in the complaint concerning the dismissal decision, A had already sought compensation from it for the non-material damage suffered as a result of the disclosure of the data concerning the applicants. Fifth, EIOPA submits that if the Court were to uphold the present claim for compensation, that decision would benefit A, in so far as it would enable him to obtain compensation for the non-material damage allegedly suffered by the applicants despite the fact that he himself did not bring an action for annulment against the decision of 2 June 2020 rejecting the complaint concerning the dismissal decision.
39      The applicants dispute EIOPA’s arguments.
40      It must be stated, as is apparent from pages 1 and 24 of the application, and is not contested, that the action is based on Article 268 and the second paragraph of Article 340 TFEU.
41      Under Article 270 TFEU, as implemented by Article 91(1) of the Staff Regulations of Officials of the European Union (‘the Staff Regulations’), the Court of Justice of the European Union has jurisdiction in any dispute between the Union and any person to whom those regulations apply.
42      Article 270 TFEU thereby creates a means of legal redress for civil service disputes distinct from general remedies, such as actions for annulment governed by Article 263 TFEU or actions for damages governed by Article 268 TFEU and the second and third paragraphs of Article 340 TFEU. Indeed, in accordance with the case-law, it follows from the Staff Regulations that, unlike any other individual, an official or other member of the staff of the European Union is connected to the institution or body to which he or she belongs by a legal employment relationship involving a balance of specific reciprocal rights and obligations, which is reflected by the institution’s duty to have regard for the welfare of the person concerned (see judgment of 6 July 2022, OC v EEAS, T‑681/20, not published, EU:T:2022:422, paragraph 65 and the case-law cited).
43      In addition, in accordance with settled case-law, any dispute between an official or member of staff and the institution to which he or she belongs, even in the case of an action for compensation, falls within the scope of Article 270 TFEU, as implemented by Article 91(1) of the Staff Regulations, where the dispute has its origin in the employment relationship between that official or other member of staff and an EU institution (judgment of 4 June 2020, Schokker v EASA, C‑310/19 P, not published, EU:C:2020:435, paragraph 50; see also judgment of 5 May 2022, Commission v Missir Mamachi di Lusignano, C‑54/20 P, EU:C:2022:349, paragraph 42 and the case-law cited).
44      Accordingly, with regard to an action for compensation brought by an official or a member of staff, the view is taken in the case-law that, since that action has its origin in the employment relationship between that official or member of staff and the institution in question, it cannot be based on the second paragraph of Article 340 TFEU but must be brought on the basis of Article 270 TFEU, if it is not to be inadmissible (see, to that effect, judgments of 17 February 1977, Reinarz v Commission and Council, 48/76, EU:C:1977:30, paragraphs 9 and 10; of 7 October 1987, Schina v Commission, 401/85, EU:C:1987:425, paragraph 9; and of 12 June 2002, Mellone v Commission, T‑187/01, EU:T:2002:155, paragraph 74).
45      It follows from the case-law that, where the dispute has its origin in the employment relationship between an official or member of staff and an institution of the European Union, not only that official or member of staff, but also any other person to whom the Staff Regulations apply, as provided for in Article 91(1) of the Staff Regulations, may bring proceedings against an institution of the European Union on the basis of Article 270 TFEU to challenge the lawfulness of an act affecting him or her adversely (see, to that effect, judgment of 5 May 2022, Commission v Missir Mamachi di Lusignano, C‑54/20 P, EU:C:2022:349, paragraph 46).
46      It should also be noted that, in accordance with the case-law, the Staff Regulations and the Conditions of Employment of Other Servants of the European Union are intended to regulate legal relations between the EU institutions and their officials or other members of staff. In order to achieve that aim, the Staff Regulations not only establish a series of reciprocal rights and obligations between those institutions and their officials or members of staff but also confer rights and benefits on certain members of their family. The grant of such rights and benefits constitutes recognition of the close family ties between those persons and the official or other member of staff and of the potential influence of those family ties on the conditions in which the official or other member of staff is required to carry out his or her work (see, to that effect, judgment of 5 May 2022, Commission v Missir Mamachi di Lusignano, C‑54/20 P, EU:C:2022:349, paragraphs 47 and 51).
47      In that regard, in the first place, it should be noted that the Staff Regulations and the Conditions of Employment of Other Servants of the European Union do not confer rights or benefits on companies owned directly or indirectly by an official or other member of staff.
48      In the second place, it should be stated that the family links referred to in the case-law cited in paragraph 46 above are distinct from the economic relationship which the shareholder who has invested in a company in exchange for shares has with that company.
49      It follows that the applicants are not persons to whom the Staff Regulations apply, as provided for in Article 91(1) of the Staff Regulations.
50      Therefore, in accordance with the case-law cited in paragraph 45 above and there being no need to assess whether the present dispute has its origin in the employment relationship between A and EIOPA, it must be held that the applicants were not entitled to bring proceedings on the basis of Article 270 TFEU.
51      That finding cannot be called in question by the arguments put forward by EIOPA.
52      As regards EIOPA’s first and second arguments, which will be dealt with together, the fact that the action is based on events which took place during the period of A’s employment at EIOPA and that the purpose of providing information concerning the applicants was to ascertain whether there was a conflict of interest is irrelevant in the present case. As is apparent from paragraph 50 above, since the Staff Regulations do not apply to the applicants, they cannot act on the basis of Article 270 TFEU, regardless of whether the dispute has its origin in the employment relationship between A and EIOPA.
53      As regards EIOPA’s third argument, the fact that A is the founder of the applicants, that he directly or indirectly holds 100% of the capital of the applicants, that he is their managing director and that he carries out his outside activities via the applicants is also irrelevant for the purpose of assessing whether the action is admissible. The fact that there is a link between a shareholder and his companies and the fact that that shareholder conducts, via those companies, an outside activity does not create a right for those companies to use specific means of redress reserved to a shareholder based on the employment relationship which links that shareholder, who is an official or other member of staff, with an EU institution.
54      Moreover, the reference to the judgments of 30 September 2021, Court of Auditors v
Pinxten (C‑130/19, EU:C:2021:782), of 16 January 2003, Fichtner v Commission (T‑75/00, EU:T:2003:9), and of 28 March 2012, BD v Commission (F‑36/11, EU:F:2012:49), is also irrelevant in the present case. Those judgments do not follow on from actions brought by companies controlled by officials or other members of staff of the European Union, but follow on from actions brought by a former Member of the Court of Auditors, a former Commission official and a former member of staff of the Commission respectively. Accordingly, those judgments provide no analytical evidence which could be used to assess whether the present action is admissible, but rather they relate, in essence, to whether or not the officials and members of staff in question complied with the obligation laid down in Article 12b of the Staff Regulations to first request permission before carrying out outside activities.
55      As regards EIOPA’s fourth argument, the fact that, in the complaint concerning the dismissal decision, A had already requested compensation from EIOPA for the non-material damage allegedly suffered as a result, inter alia, of the disclosure of the applicants’ data is also irrelevant. The question in the present case is whether the action brought by the applicants, and not by A, is inadmissible because it was brought on the basis of the second paragraph of Article 340 TFEU.
56      As regards EIOPA’s fifth argument, even if the decision to be taken by the General Court in relation to the action benefits A by allowing him to obtain compensation for the non-material damage allegedly suffered despite his failure to bring an action for annulment against the decision rejecting the complaint concerning the dismissal decision, that is irrelevant in the present case. The procedures which the applicants must use in order to access the EU Courts and the legal basis of their action cannot depend on the benefits which third parties might derive from the decision of the General Court to be taken in relation to their action.
57      Consequently, the first complaint raised by EIOPA in the plea of inadmissibility must be rejected.
2.      The second complaint in the plea of inadmissibility: the limitation period
58      EIOPA maintains that, even if the applicants were entitled to bring proceedings on the basis of the second paragraph of Article 340 TFEU, their action is out of time, since the action was brought after the five-year limitation period laid down for the non-contractual liability of the European Union had expired. In that regard, EIOPA maintains that that period must be calculated from the time when A provided it with information concerning the applicants, in July 2018 and subsequently in January and March 2019. At the hearing, EIOPA stated that the limitation period could not be calculated from the date when the ethics officer drafted his screening report, namely 4 April 2019, since that document is merely confirmatory in nature and simply examines the information which had previously been provided by A. In that context, EIOPA is of the view that the action brought on 4 April 2024 is out of time.
59      The applicants dispute EIOPA’s arguments.
60      Under Article 46 of the Statute of the Court of Justice of the European Union, which is applicable to proceedings before the General Court in accordance with Article 53 of that Statute, proceedings against the Union in matters arising from non-contractual liability are to be barred after a period of five years from the occurrence of the event giving rise to them.
61      In accordance with settled case-law, the period begins to run when all the requirements governing the obligation to provide compensation for damage are satisfied, namely that the conduct of which the institutions are accused is unlawful, that the damage has actually occurred and that there is a causal link between the alleged conduct and the damage claimed. As regards, in particular, the condition relating to damage having actually occurred, the limitation period begins to run when the damage to be made good has materialised (judgments of 17 July 2008, Commission v Cantina sociale di Dolianova and Others, C‑51/05 P, EU:C:2008:409, paragraph 54, and of 6 April 2022, Planistat Europe and Charlot v Commission, T‑735/20, not published, EU:T:2022:220, paragraph 34).
62      Therefore, in accordance with the case-law, the limitation period runs from the time when the financial or non-material damage actually materialises and not from the date on which the harmful event occurred (judgments of 28 February 2013, Inalca and Cremonini v Commission, C‑460/09 P, EU:C:2013:111, paragraph 60, and of 6 April 2022, Planistat Europe and Charlot v Commission, T‑735/20, not published, EU:T:2022:220, paragraph 34).
63      In the present case, the applicants maintain that, in the context of the ethics check, A provided EIOPA with information concerning their internal functioning, their activities in the pension sector and in the financial sector, their income in 2017 and 2018, their accounts, the transactions and payments they had made and the invoices which they had issued to their clients (‘the ethics check information’). In addition, they state that, during the administrative inquiry, A sent to EIOPA information concerning their accounts from 2015 to 2019, the agreements they had concluded with their clients, the names of their former clients, the kind of services their clients had received, how they had set the price of the services offered, how they had approached their potential clients, the methodologies of persuading them to sign contracts and their overall level of activity (‘the information from the administrative inquiry’, when taken together with the ethics check information, ‘the information provided’).
64      In that context, the applicants seek compensation for non-material damage consisting of damage to their image and reputation which they claim to have suffered as a result of the sufficiently serious breach by EIOPA of Article 339 TFEU, as a result of it having disclosed the information provided to unauthorised persons, and of the right to good administration of justice recognised in Article 41 of the Charter. In that regard, they maintain, first, that EIOPA did not properly state the reasons why it had asked A to send it the information provided and disclosed it to unauthorised persons and, second, that EIOPA appointed to the position of external investigator a person who did not have the necessary competences and who, being in a conflict of interest situation, failed to conduct the administrative inquiry impartially.
65      In the light of those factors and without prejudice to whether the alleged infringements constitute unlawful acts, it is necessary to determine the day as of which the harmful effects alleged by the applicants occurred.
66      It should be noted that the applicants are of the view that the harmful effects resulting from the alleged infringements materialised at two different points in times.
67      First, the applicants assert, in essence, that a first instance of harm occurred on 4 April 2019, when, without having informed A and without having obtained his prior consent, the ethics officer sent his screening report containing the ethics check information not only to the Executive Director and the data protection officer, but also to his own assistant and to the assistant to the Executive Director, to EIOPA’s legal adviser (‘the legal adviser’) and to the external counsel.
68      Second, the applicants are of the view, in essence, that a second instance of harm occurred on 22 July 2019, when the administrative inquiry was opened. According to the applicants, during that inquiry, the external investigator disclosed the information provided to the assistant to the Executive Director, the legal adviser, the European Anti-Fraud Office (OLAF) and to two witnesses without having informed A and without having obtained his prior consent.
69      In that regard, in the first place, it must be stated that, contrary to EIOPA’s assertions, it is not apparent from the file that A provided information concerning the applicants to EIOPA in July 2018. By email of 20 July 2018, EIOPA asked A to confirm that the applicants were no longer active in the financial sector and it was only by an email of 6 August 2018 that A informed EIOPA that the applicants were no longer active in the insurance sector.
70      In the second place, it is true that it is apparent from the file that, on 14 January and 10 March 2019, A provided EIOPA with information concerning the applicants, submitting that the data transmitted were confidential. However, the case-law cited in paragraphs 61 and 62 above states that the limitation period for bringing an action in relation to non-contractual liability runs from the time when all the requirements governing the obligation to provide compensation for damage are satisfied and, in particular, when the damage relied on has materialised.
71      It must be stated that it was not when A sent the information provided to EIOPA that the damage relied on by the applicants occurred. Moreover, there being no need to rule on the admissibility of the argument raised by EIOPA at the hearing concerning the confirmatory nature of the report drafted by the ethics officer, it must be held that the fact that the ethics officer, in his report, merely examined the information which had previously been provided by A is irrelevant in the present case. Indeed, the damage alleged by the applicants, even if it were established, occurred on 4 April and 22 July 2019 when, in sending the information provided to allegedly unauthorised persons, EIOPA committed the alleged infringements.
72      It follows that the five-year limitation period for bringing an action for non-contractual liability laid down in Article 46 of the Statute of the Court of Justice of the European Union must be calculated from 4 April 2019 as regards the first instance of harm alleged, and from 22 July 2019, as regards the second instance of harm alleged.
73      Accordingly, in so far as the action was brought on 4 April 2024, it is not out of time and, therefore, the second complaint raised by EIOPA in the plea of inadmissibility must be rejected.
74      In the light of the foregoing, it must be held that the action is admissible.
B.      Substance
75      The applicants are putting into issue the non-contractual liability of the European Union in terms of two heads of claim of unlawfulness, alleging, first, a sufficiently serious breach of Article 339 TFEU and, second, a sufficiently serious breach of Article 41 of the Charter.
76      As a preliminary point, it should be recalled that, pursuant to the second paragraph of Article 340 TFEU, in the case of non-contractual liability, the Union, in accordance with the general principles common to the laws of the Member States, is to make good any damage caused by its institutions or by its servants in the performance of their duties.
77      According to settled case-law, the European Union may incur non-contractual liability under the second paragraph of Article 340 TFEU if a number of conditions are fulfilled: the conduct of the institution or of its staff in the performance of their duties must be unlawful, actual damage must have been suffered and there must be a causal link between the conduct and the damage complained of (see judgments of 5 March 2024, Kočner v Europol,
C‑755/21 P, EU:C:2024:202, paragraph 117 and the case-law cited, and of 3 December 2015, CN v Parliament, T‑343/13, EU:T:2015:926, paragraph 44 and the case-law cited; judgment of 20 July 2016, Oikonomopoulos v Commission, T‑483/13, EU:T:2016:421, paragraph 25).
78      It follows from that case-law that the first condition for such liability, which concerns the unlawfulness of the conduct in question alleged against the EU institution, body, office or agency concerned comprises two parts, namely that it is necessary (i) that a breach of a rule of EU law intended to confer rights on individuals has occurred and (ii) that that breach is sufficiently serious (judgment of 5 March 2024, Kočner v Europol,
C‑755/21 P, EU:C:2024:202, paragraph 118; see also judgment of 3 December 2015, CN v Parliament, T‑343/13, EU:T:2015:926, paragraph 44 and the case-law cited; judgment of 20 July 2016, Oikonomopoulos v Commission, T‑483/13, EU:T:2016:421, paragraph 2[6]); both parts must be satisfied.
79      In that regard, in the first place, the case-law indicates that a rule of law is intended to confer rights on individuals where the infringement concerns a provision which creates, for their benefit, rights which the national courts must safeguard, with the result that it has a direct effect, granting individuals an advantage which could be defined as a vested right, the function of which is to protect their interests or which confers on them rights the content of which is sufficiently identifiable (see, to that effect, judgments of 16 October 2014, Evropaïki Dynamiki v Commission, T‑297/12, not published, EU:T:2014:888, paragraph 76 and the case-law cited, and of 9 February 2022, QI and Others v Commission and ECB,
T‑868/16, EU:T:2022:58, paragraph 90 and the case-law cited).
80      In addition, in order for the European Union to incur liability, the protection offered by the rule relied on must be effective as regards the person who relies on it. A rule cannot be taken into account if it does not confer any right on the individual relying on it, even if it confers a right on other natural or legal persons (see, to that effect, judgments of 3 December 2015, CN v Parliament, T‑343/13, EU:T:2015:926, paragraph 86 and the case-law cited, and of 23 February 2022, ASL Aviation Holdings and ASL Airlines (Ireland) v Commission, T‑540/18, EU:T:2022:85, paragraph 43 and the case-law cited).
81      In the second place, the decisive criterion for finding that a breach of a rule of law conferring rights on individuals is sufficiently serious is whether there has been a manifest and grave disregard by the institution for the limits of its discretion (see judgments of 5 March 2024, Kočner v Europol,
C‑755/21 P, EU:C:2024:202, paragraph 126 and the case-law cited, and of 3 December 2015, CN v Parliament, T‑343/13, EU:T:2015:926, paragraph 44 and the case-law cited).
82      Accordingly, a decisive factor in deciding whether there has been a sufficiently serious breach committed by an institution is the discretion available to that institution (see, to that effect, judgment of 12 July 2005, Commission v CEVA and Pfizer, C‑198/03, EU:C:2005:445, paragraphs 65 and 66).
83      Next, it is for the EU Courts to take account of the complexity of the situation to be regulated, the difficulties in the application or interpretation of the legislation, the clarity and precision of the rule infringed, and whether the error made was inexcusable or intentional (judgment of 3 March 2010, Artegodan v Commission, T‑429/05, EU:T:2010:60, paragraph 62).
84      In those circumstances, mere errors of assessment cannot of themselves be sufficient to give rise to a manifest and grave infringement (see, to that effect, judgment of 9 September 2008, MyTravel v Commission
T‑212/03, EU:T:2008:315, paragraph 85).
85      The two heads of claim of unlawfulness raised by the applicants must be examined in that context.
1.      The second head of claim of unlawfulness: sufficiently serious breach of Article 339 TFEU
86      The applicants submit that EIOPA breached Article 339 TFEU in a sufficiently serious manner. In that regard, they maintain, in essence, that, without having informed A and without having obtained his prior consent, EIOPA sent the information provided to unauthorised persons. More specifically, first, they allege the ethics officer provided the information from the ethics check to his own assistant and to the assistant to the Executive Director, to the legal adviser, to the external counsel and, when the administrative inquiry was opened, to the external investigator. Second, they allege the external investigator disclosed the information from the administrative inquiry to the assistant to the Executive Director, the legal adviser, OLAF and two witnesses.
87      EIOPA disputes the applicants’ arguments.
88      As a preliminary point, it should be recalled that Article 339 TFEU is worded as follows:
‘The members of the institutions of the Union, the members of committees, and the officials and other servants of the Union shall be required, even after their duties have ceased, not to disclose information of the kind covered by the obligation of professional secrecy, in particular information about undertakings, their business relations or their cost components.’
89      It is apparent from the case-law that Article 339 TFEU is a rule of law conferring rights on individuals, since the obligation to maintain professional secrecy which it imposes on members of the institutions of the European Union and on officials and other members of staff of the European Union creates specific rights for individuals to have confidential information protected, which they may assert before the EU Courts against the institutions, agencies, committees or bodies in question (see, to that effect, judgments of 16 October 2014, Evropaïki Dynamiki v Commission, T‑297/12, not published, EU:T:2014:888, paragraph 77 and the case-law cited, and of 6 June 2019, Dalli v Commission, T‑399/17, not published, EU:T:2019:384, paragraphs 169 and 170).
90      Moreover, in accordance with the case-law cited in paragraph 80 above, the protection afforded by Article 339 TFEU is effective as regards the applicants, since that provision confers on them the right for the information covered by the obligation of professional secrecy provided by A to EIOPA not to be disclosed by EIOPA or by its officials and members of staff.
91      In that context, it is necessary to examine whether the information provided falls within the scope of Article 339 TFEU and whether its alleged disclosure by EIOPA, without having informed A and without having obtained his prior consent, constitutes a sufficiently serious breach of that provision.
92      As regards the nature of the information provided, it should be noted that, according to the case-law, both business secrets and other confidential information may be information covered by the obligation of professional secrecy under Article 339 TFEU. First, it is necessary that such business secrets or confidential information be known only to a limited number of persons. Second, it must be information whose disclosure is liable to cause serious harm to the person who has provided it or to third parties Third, the interests liable to be harmed by the disclosure of that information must be objectively worthy of protection (judgments of 12 October 2007, Pergan Hilfsstoffe für industrielle Prozesse v Commission, T‑474/04, EU:T:2007:306, paragraph 65; of 8 November 2011, Idromacchine and Others v Commission, T‑88/09, EU:T:2011:641, paragraph 45; and of 15 July 2015, Pilkington Group v Commission, T‑462/12, EU:T:2015:508, paragraph 45).
93      In the present case, the information provided satisfies the three conditions laid down by the case-law cited in paragraph 92 above. First of all, since it concerns information relating to the applicants’ activities, their income, their accounts and their business relations with their customers, that information constitutes business secrets and other confidential information which, by its nature, is known to a limited number of persons, in particular A as the applicants’ legal representative and managing director, and other persons contributing to the business or reviewing the applicants’ business. Next, disclosure of the information provided is likely to cause harm both to the applicants and to their customers, since it would enable competitors and third parties more generally to acquire information on the applicants’ internal functioning and economic and business activities as well as information on customers who have business relations with them. Finally, the interests liable to be harmed by the disclosure of the information provided are worthy of protection, in so far as they are economic and business interests connected with the applicants’ pursuit of their business.
94      As regards EIOPA allegedly sending the information provided to unauthorised persons, without having informed A and without having obtained his prior consent, in the first place, it must be noted that it is apparent from the responses given by EIOPA to the EDPS in the context procedure leading to the EDPS’ decision and from the email sent by the data protection officer to A on 13 January 2020, and it is not disputed, that EIOPA provided (i) the ethics check information to the assistants to the Executive Director and to the ethics officer, to the legal adviser and to the external investigator, and (ii) the information from the administrative inquiry to the assistant to the Executive Director and to the legal adviser.
95      First of all, as regards the provision of the information from the ethics check to the assistants to the Executive Director and to the ethics officer and the provision of the information from the administrative inquiry to the assistant to the Executive Director, it must be stated that those assistants provided an administrative support function to their superiors. Accordingly, in so far as they formed part of the teams of the Executive Director and of the ethics officer, they were permitted to acquaint themselves with the information provided. In that regard, it should be recalled that the ethics officer drafted the screening report containing the information on the ethics check and that the Executive Director was the addressee of that report. Similarly, the Executive Director was the addressee of the report drafted by the external investigator which contained the information from the administrative inquiry. Accordingly, the assistants to the Executive Director and to the ethics officer became acquainted with the information provided in the context of their work and for the purpose of performing their tasks at EIOPA.
96      Moreover, it is apparent from the responses given by EIOPA to the EDPS in the context of the procedure which led to the EDPS’ decision that the assistants to the Executive Director and to the ethics officer were not only subject to statutory confidentiality obligations, but that they had also signed additional agreements intended to protect the confidentiality of the information provided, and that is not disputed. The applicants have adduced no evidence demonstrating that the assistants in question failed to comply with their confidentiality obligations or that they used the information provided for purposes other than the performance of their administrative support function to the ethics officer and to the Executive Director.
97      Next, as regards the information provided having been sent to the legal adviser, it should be noted that EIOPA stated at the hearing that the legal adviser was a member of EIOPA staff who performed legal support functions on all questions falling within her area of activity. It also stated that, in the present case, the legal adviser had been called upon to clarify the legal framework which applied to A’s performance of his outside activities in the context of and via the applicants.
98      It should also be noted that it is apparent from the responses given by EIOPA to the EDPS in the context of the procedure which led to the EDPS’ decision, and was not disputed, that, in addition to her statutory confidentiality obligations, the legal adviser had signed additional agreements intended to protect the confidentiality of the information provided. The applicants have adduced no evidence demonstrating that the legal adviser breached her obligations of confidentiality or that she used the information provided for purposes other than the performance of her duties at EIOPA.
99      Finally, as regards the information from the ethics check having been provided to the external investigator, it should be noted that Article 2(1) of the decision of the EIOPA Management Board on the conduct of administrative inquiries and disciplinary proceedings (the ‘decision of the management board’) provides that an administrative inquiry is to be opened at the request of the Executive Director and to define its subject matter and scope. Moreover, Articles 3 and 4 of that decision state that, in the event of an administrative inquiry being opened, the Executive Director is to appoint the investigation panel or the external [investigator] responsible for conducting it. The investigation panel and the external [investigator] must exercise their powers of administrative inquiry independently and are to seek to obtain all relevant facts and circumstances of the case. In order to conduct the investigation, the investigation panel and the external [investigator] have the power to obtain documents, to request EIOPA staff members to provide them with information and to carry out on-the-spot investigations, provided that the documents and information requested are necessary, proportionate and relevant.
100    The decision of the management board was supplemented, in the present case, by the decision to open the administrative inquiry, which stated, inter alia, that the purpose of that inquiry was to seek clarity on the outside activities conducted by A from the date of his recruitment, in order to ascertain whether those activities were compatible with the interests of EIOPA, whether they gave rise to a conflict of interest and whether they had enabled A to obtain higher remuneration than authorised by EIOPA. It also provided that the final report of the administrative inquiry, setting out all the facts and circumstances of the case, the assessment of the external investigator and a copy of all the documents used by that investigator to reach her conclusion, was to be submitted to the Executive Director.
101    It is apparent from the decision of the management board and from the decision to open the administrative inquiry that (i) the external investigator was required to conduct a thorough assessment of whether the outside activities carried out by A from the date of his recruitment to EIOPA gave rise to a conflict of interest and (ii) in order to do so, she was entitled to obtain all the information and documents which she considered necessary, proportionate and relevant.
102    It follows that when opening the administrative inquiry, EIOPA provided the external investigator with the information on the ethics check in order to enable her to carry out her duties in the context of that inquiry.
103    Moreover, it is apparent from the responses given by EIOPA to the EDPS in the context of the procedure which led to the EDPS’ decision that the external investigator had signed an agreement protecting the confidentiality of the information received in the performance of her duties, and that was not disputed. The applicants have adduced no evidence demonstrating that the external investigator acted in breach of her obligations of confidentiality or that she used the information received for purposes other than performing her duties in the context of the administrative inquiry.
104    In the light of the foregoing, it must be held that the assistants to the Executive Director and to the ethics officer, the legal adviser and the external investigator were authorised to receive the information provided in order to perform their legitimate duties, in the context of the ethics check and the administrative inquiry, and EIOPA did not have to inform A beforehand or obtain his consent.
105    In the second place, as regards the alleged provision of the information from the ethics check to the external counsel, it must be recalled that, by email dated 20 February 2019, the ethics officer informed A that, to obtain advice on procedure, he had called upon the external counsel and that the external counsel had not carried out any substantive assessment of his file. Moreover, EIOPA stated at the hearing that the external counsel was a lawyer duly registered with the bar of a Member State and that that external counsel had signed agreements intended to protect the confidentiality of the information received. However, the applicants provided no evidence demonstrating that EIOPA provided the information on the ethics check to the external counsel or that the external counsel breached the confidentiality obligations incumbent on such external adviser.
106    In the third place, as regards the information from the administrative inquiry allegedly being provided to two witnesses, it must be stated that the applicants do not indicate who those witnesses are. Nevertheless, it is apparent from the external investigator’s report dated 30 September 2019 that, for the purposes of the administrative inquiry, she had interviewed two witnesses, namely the ethics officer and another witness (‘the second witness’). Even if the applicants are referring to those two witnesses, it must be stated that, in their pleadings, they do not dispute that the ethics officer was entitled to receive the information from the administrative inquiry. In addition, in the rejoinder, EIOPA states that the second witness was a member of its staff, that that witness performed the duties of an ethics adviser and that he was bound by statutory confidentiality obligations. Accordingly, he was interviewed by the external investigator in the context of the administrative inquiry in his capacity as an ethics adviser. The applicants have provided no evidence demonstrating that the external investigator disclosed the information from the administrative inquiry to the second witness during his interview.
107    In the fourth place, as regards the alleged provision of information from the administrative inquiry to OLAF, it must be stated that it follows from Article 1(4) of Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by [OLAF] and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999 (OJ 2013 L 248, p. 1) that OLAF is to conduct, within the institutions, bodies, offices and agencies of the European Union, administrative investigations for the purpose of combating fraud, corruption and any other illegal activity affecting the financial interests of the European Union. To that end, it is to investigate serious matters relating to the discharge of professional duties constituting a dereliction of the obligations of officials and other servants of the Union liable to result in disciplinary or, as the case may be, criminal proceedings, or an equivalent failure to discharge obligations on the part of members of institutions and bodies, heads of offices or agencies or staff members of institutions, bodies, offices or agencies not subject to the Staff Regulations. Article 8(1) of that regulation also states that the institutions, bodies, offices and agencies are to transmit to OLAF without delay any information relating to possible cases of fraud, corruption or any other illegal activity affecting the financial interests of the Union.
108    It should also be noted that Article 2(5) of the decision of the management board provides that, before opening an administrative inquiry into matters which may fall within the remit of OLAF, the Executive Director is required to consult OLAF to ascertain that it does not intend to open its own investigation into the same facts.
109    In the present case, it is apparent from the file, and has not been disputed, that EIOPA had brought the matter before OLAF prior to opening the administrative inquiry, in so far as, in the screening report dated 4 April 2019, the ethics officer had indicated that A was in a conflict of interest situation. Therefore, since A’s situation could constitute a case of fraud, corruption or illegal activity affecting the financial interests of the European Union, EIOPA was required to bring the matter before OLAF in order to ascertain whether it intended to open its own investigation into the facts dealt with in the ethics officer’s report. It is apparent from the decision to open the administrative inquiry that, after having been consulted, OLAF decided not to open its own investigation concerning A.
110    In that context, EIOPA states in its pleadings that it provided OLAF with only the ethics officer’s report and A’s comments on that report. The applicants have adduced no evidence demonstrating that that assertion is incorrect.
111    In the light of all the foregoing, it is necessary to reject the first head of claim of unlawfulness, alleging a sufficiently serious breach of Article 339 TFEU.
2.      The second head of claim of unlawfulness: a sufficiently serious breach of Article 41 of the Charter
112    The applicants submit that EIOPA committed a sufficiently serious breach of the right to good administration enshrined in Article 41 of the Charter.
113    The applicants raise three complaints in support of the present head of claim of unlawfulness.
(a)    The first complaint of the second head of claim of unlawfulness: failure to state reasons
114    The applicants submit that EIOPA committed a sufficiently serious breach of Article 41(2)(c) of the Charter, in so far as it failed to fulfil its obligation under that provision to state reasons.
115    As a preliminary point, it should be recalled that Article 41 of the Charter provides as follows:
‘1.      Every person has the right to have his or her affairs handled impartially, fairly and within a reasonable time by the institutions, bodies, offices and agencies of the Union.
2.      This right includes:
(a)      the right of every person to be heard, before any individual measure which would affect him or her adversely is taken;
(b)      the right of every person to have access to his or her file, while respecting the legitimate interests of confidentiality and of professional and business secrecy;
(c)      the obligation of the administration to give reasons for its decisions.
…’
116    According to the case-law, the right to good administration does not, in itself, confer rights on individuals, except where it constitutes the expression of specific rights such as the right to have one’s affairs handled impartially, fairly and within a reasonable time, the right to be heard, the right to have access to files and the obligation to give reasons for decisions (judgments of 4 October 2006, Tillack v Commission, T‑193/04, EU:T:2006:292, paragraph 127, and of 13 November 2008, SPM v Council and Commission, T‑128/05, not published, EU:T:2008:494, paragraph 127; see also order of 20 December 2019, Dragomir v Commission, T‑297/19, not published, EU:T:2019:902, paragraph 47 and the case-law cited).
117    In the present case, since the applicants allege an infringement of the right to good administration on account of EIOPA’s failure to have due regard to its obligation to state reasons under Article 41(2)(c) of the Charter, it must be held that, in accordance with the case-law cited in paragraph 116 above, that provision is intended to confer rights on individuals.
118    Furthermore, in accordance with the case-law cited in paragraph 80 above, the protection afforded by that article is effective as regards the applicants in so far as Article 41(2)(c) of the Charter confers on them the right to have decisions adopted in respect of them by EIOPA be duly reasoned.
119    Therefore, it is necessary to assess whether EIOPA committed a sufficiently serious breach of Article 41(2)(c) of the Charter.
120    It should be stated that, in accordance with the case-law, it follows from Article 41(2)(c) of the Charter that the authority adopting a measure must disclose in a clear and unequivocal fashion the reasoning underlying that measure so as to enable (i) the persons concerned to ascertain the reasons for the measure and thereby enable them to assert their rights and (ii) the Court to exercise its power of review (see, to that effect, judgment of 21 December 2022, Vialto Consulting v Commission, T‑537/18, not published, EU:T:2022:852, paragraph 63 and the case-law cited).
121    It is also apparent from the case-law that the requirements to be satisfied by the statement of reasons depend on the circumstances of each case, in particular the content of the measure in question, the nature of the reasons given and the interest which the addressees of the measure, or other parties to whom it is of direct and individual concern, may have in obtaining explanations (see judgment of 10 January 2024, VN v Commission, T‑159/23, not published, EU:T:2024:5, paragraph 35 and the case-law cited). It is not necessary for the reasoning to go into all the relevant facts and points of law, since the question of whether the statement of reasons for a measure is to be deemed adequate must be assessed with regard not only to its wording, but also to its context and to all the legal rules governing the matter in question (see judgment of 14 July 2021, BG v Parliament, T‑253/19, not published, EU:T:2021:459, paragraph 45 and the case-law cited).
122    It follows, according to the case-law, that a statement of reasons need not be exhaustive, but must be regarded as sufficient if it sets out the facts and the legal considerations having decisive importance in the context of the decision (see judgment of 21 December 2022, Vialto Consulting v Commission, T‑537/18, not published, EU:T:2022:852, paragraph 64 and the case-law cited).
123    The two arguments put forward by the applicants in support of the first complaint of their second head of claim of unlawfulness must be examined in that context.
(1)    The first argument, relating to the statement of reasons for the request to provide information from the administrative inquiry
124    The applicants submit, in essence, that EIOPA committed a sufficiently serious breach of Article 41(2)(c) of the Charter, in so far as the external investigator failed to state to the requisite legal standard the reason why she found it necessary to request A to provide her with the information from the administrative inquiry, even though that inquiry consisted solely in ascertaining whether there was a conflict of interest concerning A. According to the applicants, the external investigator did not need to take into account their economic and business activities carried out before and during A’s period of work at EIOPA, but could confine herself to examining the bank statements and other tax documents which A had provided to her.
125    EIOPA disputes the applicants’ arguments.
126    In the first place, it should be noted that, in accordance with the case-law cited in paragraph 121 above, in view of the circumstances of the case and the specific context in which, during the administrative inquiry and for the purposes of that investigation, the external investigator asked A to provide her with the information from the administrative inquiry, it cannot be held that the external investigator was bound by an obligation to give reasons as referred to in Article 41(2)(c) of the Charter for her request that information be sent. The decision of the management board and the decision to open the administrative inquiry contained an adequate statement of the reasons which led the external investigator to request A to provide her with the information from the administrative inquiry.
127    In that regard, it must be stated that, according to the case-law, the reasons given for a decision are sufficient if it was adopted in a context which was known to the person concerned which enables him or her to understand the scope of the measure concerning him or her (judgments of 11 June 2020, Commission and Slovak Republic v Dôvera zdravotná poist’ovňa, C‑262/18 P and C‑271/18 P, EU:C:2020:450, paragraph 67, and of 14 April 2021, RQ v Commission, T‑29/17 RENV, not published, EU:T:2021:188, paragraph 87).
128    In the present case, the applicants were aware of the context in which the external investigator had requested that A provide her with the information from the administrative inquiry. While the applicants are distinct from A as a matter of form, A is their legal representative and their managing director and sole shareholder of DP, which holds 100% of DQ. Accordingly, in so far as A worked at EIOPA and was subject to the ethics check and the administrative inquiry, he knew or at least ought to have known, in his capacities as legal representative, managing director and sole shareholder of one of the applicants, of the detailed arrangements for the conduct of the administrative inquiry, including the broad investigative powers conferred on the external investigator by the decision of the management board and by the decision to open the administrative inquiry.
129    In the second place, it should be recalled that, as stated in paragraph 101 above, it is apparent from the decision of the management board and from the decision to open the administrative inquiry that the external investigator was required to make a detailed assessments of whether the outside activities carried out by A from the date of his recruitment to EIOPA gave rise to a conflict of interest and, for that purpose, she enjoyed a broad discretion which enabled her, inter alia, to request A to provide her with all the information and documents which she considered necessary, proportionate and relevant.
130    Since the information from the administrative inquiry concerned the applicants’ economic and business activities, it was important information for assessing whether A’s outside activities in the context of and via the applicants had enabled him to obtain unauthorised income and whether, as a result of the economic and business relations between the applicants and their clients, those activities gave rise to a conflict of interest incompatible with A’s employment at EIOPA.
131    Furthermore, the applicants have adduced no evidence to permit the inference that the information from the administrative inquiry was not necessary, proportionate and relevant in order to shed light on A’s outside activities and have provided no evidence demonstrating that the bank statements and the other tax documents to which they refer in the reply were sufficient to complete the administrative inquiry.
132    It is true that the decision to open the administrative inquiry indicated that the mandate of the external investigator was limited to assessing the outside activities carried out by A from the date of his recruitment to EIOPA.
133    Nevertheless, it must be held that there is a correlation between the business carried out by A in the context of and via the applicants before his recruitment to EIOPA and the business which he carried out after that recruitment. Prior to his recruitment, A had informed EIOPA, by email dated 7 August 2017, that he intended to put an end to the consultancy activities he was providing directly or via the applicants to companies active in the insurance sector. However, in his screening report dated 4 April 2019, the ethics officer concluded that A had not ceased those activities and that the applicants were still active in the insurance sector. Therefore, in order to ascertain whether A continued, after his recruitment, to conduct business in the context of and via the applicants, the external investigator also needed to refer to data concerning the applicants’ business before his recruitment in order to compare such data with the business carried out from the date of his recruitment to EIOPA.
134    It follows that, in exercising the broad investigative powers which had been conferred on her by the decision of the management board and the decision to open the administrative inquiry, the external investigator was entitled to request A to provide her with all the information which appeared to her to be important in order to complete that inquiry, which included the information from the administrative inquiry.
135    In the light of the foregoing, it is necessary to reject the first argument of the first complaint of the second head of claim of unlawfulness, alleging a sufficiently serious breach of Article 41(2)(c) of the Charter.
(2)    The second argument, relating to the statement of reasons for the disclosure of information from the administrative inquiry to unauthorised persons
136    The applicants submit that EIOPA committed a sufficiently serious breach of Article 41(2)(c) of the Charter, in so far as the external investigator failed to state to the requisite legal standard why, in the context of the administrative inquiry, she provided the information from the administrative inquiry to the assistant to the Executive Director, to the legal adviser, to OLAF and to two witnesses.
137    EIOPA disputes the applicants’ arguments.
138    In the first place, it is apparent from the file, and is not disputed, that EIOPA did indeed provide the information from the administrative inquiry to the assistant to the Executive Director and to the legal adviser. However, in accordance with the case-law cited in paragraphs 121 and 127 above, in view of the circumstances of the case and the specific context, which was known to the applicants, and in which, in order to enable the assistant to the Executive Director and the legal adviser to perform their legitimate duties at EIOPA, the external investigator had given them access to the information from the administrative inquiry, it cannot be held that, as regards that access, the external investigator was bound by an obligation to give reasons, as referred to in Article 41(2)(c) of the Charter.
139    First of all, it should be noted that, in addition to their statutory obligations of confidentiality, the assistant to the Executive Director and the legal adviser had signed additional agreements intended to protect the confidentiality of the information received in the context of their duties.
140    In addition, first, as regards the assistant to the Executive Director, it should be noted that, in accordance with the decision to open the administrative inquiry and the decision of the management board, the external investigator was required to send to that director her report containing not only a statement of all the facts and circumstances of the case and her assessment concerning A’s alleged breach of the applicable rules, but also a copy of all the documents which she had used in the context of the administrative inquiry.
141    In so far as the Executive Director relied, as regards administration, on his assistant, who formed part of his team and was required to respect the confidentiality of the information received, it was inherent to the performance of that assistant’s duties to become acquainted, within the limits of that assistant’s work, with the documents and information relating to the administrative inquiry, which included the information from the administrative inquiry.
142    Second, as regards the legal adviser, it must be held that, in so far as she performed a legal support function in EIOPA and in so far as, in the present case, she had been called upon to clarify the legal framework governing A’s conduct of his outside activities, the external investigator was authorised to consult the legal adviser in the context of the administrative inquiry.
143    Furthermore, in so far as A worked at EIOPA and is the legal representative and managing director of the applicants and the sole shareholder of DP which holds 100% of DQ, it must be held that the applicants had, or at least ought to have had, knowledge of EIOPA’s internal functioning. Accordingly, they ought to have known that the Executive Director had administrative assistance from his assistant and that EIOPA had legal assistance from the legal adviser and that that administrative assistant and that legal adviser could have access, for the performance of their duties, to confidential information.
144    In the second place, as stated in paragraphs 106 and 110 above, the applicants have not demonstrated that EIOPA provided the information from the administrative inquiry to two witnesses or to OLAF.
145    In the light of the foregoing, it is necessary to reject the second argument of the first complaint of the second head of claim of unlawfulness, alleging a sufficiently serious breach of Article 41(2)(c) of the Charter, and, therefore, it is necessary to reject that complaint in its entirety.
(b)    The second complaint of the second head of claim of unlawfulness: lack of impartiality
146    The applicants submit, in essence, that EIOPA committed a sufficiently serious breach of Article 41(1) of the Charter, since it appointed a person to the post of external investigator who, because of her links with EIOPA, was in a conflict of interest situation and who failed to conduct the administrative inquiry impartially.
147    In that regard, in the first place, the applicants state that, contrary to what is stated in Article 3(2) of the decision of the management board, the Executive Director appointed a former employee of EIOPA to the post of external investigator.
148    In the second place, the applicants state that, even though, during August 2018, the external investigator left EIOPA to set up a company active in the agricultural sector, her link with that agency was not severed, since she was obliged for the year following her departure to request prior authorisation from EIOPA before conducting business via her company. Therefore, according to the applicants, when the former EIOPA employee was appointed to the post of external investigator on 22 July 2019, that employee was in a conflict of interest situation.
149    EIOPA disputes the applicants’ arguments.
150    As a preliminary point, it should be recalled that Article 41(1) of the Charter states, inter alia, that every person has the right to have his or her affairs handled impartially by the institutions, bodies, offices and agencies of the European Union.
151    In addition, it should be noted that, in the present case, the applicants allege that EIOPA infringed the right to good administration on account of its failure to have due regard to its obligation of impartiality under Article 41(1) of the Charter. In accordance with the case-law cited in paragraph 116 above, that provision constitutes a rule of law intended to confer rights on individuals. Furthermore, in accordance with the case-law cited in paragraph 80 above, the protection offered by that provision is effective as regards the applicants, in so far as it confers on them the right to have EIOPA act impartially in relation to them.
152    It must be assessed, against that backdrop, whether EIOPA committed a sufficiently serious breach of Article 41(1) of the Charter.
153    In accordance with the case-law, it is incumbent upon the institutions, bodies, offices and agencies of the European Union to comply with both components of the requirement of impartiality, which are, on the one hand, subjective impartiality, by virtue of which no member of the institution concerned may show bias or personal prejudice and, on the other, objective impartiality, under which there must be sufficient guarantees to exclude any legitimate doubt as to possible bias on the part of the institution concerned (judgments of 27 March 2019, August Wolff and Remedia v Commission, C‑680/16 P, EU:C:2019:257, paragraph 27 and of 18 December 2024, TT v Frontex, T‑787/22, not published, EU:T:2024:909, paragraph 158).
154    It is also apparent from the case-law that subjective impartiality is presumed in the absence of evidence to the contrary (see judgments of 19 October 2022, JS v SRB, T‑270/20, not published, EU:T:2022:651, paragraph 147 and the case-law cited, and of 18 December 2024, TT v Frontex, T‑787/22, not published, EU:T:2024:909, paragraph 162 and the case-law cited).
155    In the present case, it follows from paragraphs 146 to 148 above that the applicants complain, in essence, that the external investigator was subjectively biased on account of her links with EIOPA which were allegedly never severed, placing her in a conflict of interest situation and preventing her from conducting the administrative inquiry impartially.
156    In that regard, it must be held that the fact that the external investigator was a former EIOPA employee was not sufficient to exclude her automatically from the list of candidates who could be appointed by the Executive Director to that post.
157    In the first place, pursuant to Article 3(2) of the decision of the management board, the Executive Director may decide that the administrative inquiry is to be carried out either by an investigation panel or by an external investigator. First, that provision states that the investigation panel is to consist of two or three members chosen by the Executive Director from the staff of EIOPA or from another EU institution, body or agency. Second, it states that the external [investigator] must have relevant experience on the subject of the inquiry and that that [investigator] may be a former staff member of another EU institution, body or agency or an [investigator] from the national competent authorities.
158    It follows that, pursuant to Article 3(2) of the decision of the management board, the decisive factor to be taken into account by the Executive Director in choosing the external investigator is his or her experience in the area under investigation. Accordingly, provided that condition is satisfied, the Executive Director has a margin of discretion in choosing that investigator. Indeed, that provision merely states that the external investigator may be a former member of staff of another EU institution, body or agency or an investigator from a national competent authority, but does not lay down any obligation in that regard. Furthermore, that provision states that the members of the investigation panel are to be chosen by the Executive Director from the staff of EIOPA or of another EU institution, body or agency. Consequently, since members of staff working at EIOPA may form part of the investigation panel, entirely consistently, it cannot be ruled out that former members of staff of EIOPA may, depending on the circumstances, be appointed to the post of external investigator.
159    In the second place, Article 3(4) of the decision of the management board provides that the members of the investigation panel and the external [investigator] are to sign a declaration confirming that they have no interest which may conflict with the person and facts subject to the investigation. In the present case, it is apparent from the responses given by EIOPA to the EDPS in the context of the procedure which led to the EDPS’ decision, and is not disputed, that the external investigator had signed that declaration confirming the absence of any conflict of interest.
160    In the third place, it is indeed apparent from the file, and is not disputed, that the external investigator appointed on 22 July 2019 had previously worked at EIOPA and that, in August 2018, she left the agency to set up a company active in the agricultural sector. However, it is not apparent from the file that she had worked with A or that she had dealt with the question of whether there was a conflict of interest concerning A before she was appointed as an external investigator.
161    In the fourth place, the fact that the external investigator had set up her own company is not relevant in the present case. It is a company active in the agricultural sector and has no connection with the activities carried out by A in the context of and via the applicants. In addition, the applicants have adduced no evidence in support of their allegation, which moreover EIOPA disputes, that the external investigator was required to request prior authorisation from the agency to work with her company for one year from her departure from EIOPA.
162    In the light of all those factors, it is necessary to reject the second complaint of the second head of claim of unlawfulness, alleging a sufficiently serious breach of EIOPA’s obligation of impartiality under Article 41(1) of the Charter.
(c)    The third complaint of the second head of claim of unlawfulness: lack of competence
163    The applicants submit that EIOPA committed a sufficiently serious breach of Article 41 of the Charter, in so far as the external investigator appointed did not have the competence necessary to conduct the administrative inquiry.
164    EIOPA disputes the applicants’ arguments.
165    It must be stated that, according to the case-law, a lack of competence to conduct an investigation cannot be treated as equivalent to a defect of bias, for the purpose of Article 41 of the Charter (see, to that effect and by analogy, judgment of 18 June 2025, EG v Europol, T‑321/24, not published, EU:T:2025:610, paragraph 45).
166    That is explained by the fact that the question of a person’s competence, based on that person’s knowledge in a certain field, is not the same as the question of that person’s bias, which, according to the case-law cited in paragraph 153 above, consists in ascertaining whether that person has bias or personal prejudice in a case.
167    Similarly, a lack of competence to conduct an investigation cannot be treated as equivalent to a lack of diligence, for the purpose of Article 41 of the Charter.
168    Indeed, according to the case-law, the duty of diligence is inherent in the right to good administration. It applies generally to the action of the EU administration in its relations with the public and requires that administration to act with care and caution and examine, carefully and impartially, all the relevant aspects of the individual case (see, to that effect, judgments of 30 April 2019, UPF v Commission, T‑747/17, EU:T:2019:271, paragraph 160 and the case-law cited, and of 11 December 2024, FFPE Council section v Council, T‑179/23, EU:T:2024:897, paragraph 104 and the case-law cited).
169    It follows that the question of whether a person possesses the competences necessary to carry out a certain activity is different from the question whether that person acts diligently. On the one hand, even with the necessary competences, a person may not act diligently and, on the other hand, while not competent in a certain area, a person may demonstrate diligence by examining carefully and prudently all the relevant aspects of the individual case.
170    The applicants do not dispute that the external investigator acted diligently. Furthermore, in her decision dated 25 May 2023, the Ombudsman stated that, despite the complexity of the matter, the external investigator had acted with considerable diligence.
171    Accordingly, the lack of competence alleged by the applicants does not fall within the scope of the right to good administration enshrined in Article 41 of the Charter.
172    It is therefore necessary to reject the third complaint of the second head of claim of unlawfulness, alleging lack of competence, and, as a result, that head of claim of unlawfulness in its entirety. Consequently, the action must be dismissed in its entirety.
IV.    Costs
173    Under Article 134(1) of the Rules of Procedure, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings.
174    Since the applicants have been unsuccessful, they must be ordered to pay the costs, in accordance with the form of order sought by EIOPA
On those grounds,
THE GENERAL COURT (Tenth Chamber)
hereby:
1.      Dismisses the action;
2.      Orders DP and DQ to pay the costs.
Kalėda
Jaeger
Verschuur
Delivered in open court in Luxembourg on 25 March 2026.
V. Di Bucci
M. van der Woude
Registrar
President
*      Language of the case: English.