1

By his action under Article 268 TFEU, the applicant, Mr Leon Leonard Johan Veen, seeks compensation for the damage he claims to have suffered as a result of the alleged unlawful processing of his personal data by the European Union Agency for Law Enforcement Cooperation (Europol).

2

As part of an investigation following the seizure of 1.5 tonnes of methamphetamine, the Slovak police sought the assistance of Europol on the basis of Article 3(1) and Article 4(1)(a), (b) and (h) of Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on Europol and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (OJ 2016 L 135, p. 53), stating, inter alia, that the applicant was suspected of involvement in the trafficking of that substance.

3

On the basis of information supplied by the Member States and processed in accordance with Article 17(1)(a), Article 18(1), Article (2)(a), (c) and (d) and Article 31 of Regulation 2016/794, Europol carried out a cross-checking operation pursuant to Article 18(2)(a) of that regulation, then drew up a report (‘the report’).

4

The report, the confidentiality level of which was ‘Europol Unclassified – Basic Protection Level’, was communicated to only the French Republic, the Kingdom of the Netherlands, the Slovak Republic and the United States Drug Enforcement Administration.

5

In the report, which was drafted in English, the applicant’s name appears in the following paragraph:

‘Both, Leon Leonard Johan Veen and [A] came into noticed in several Dutch investigations concerning suspicious transactions. In addition, Leon Leonard Johan Veen had been reported also in a Swedish investigation concerning drugs trafficking and a Polish investigation concerning fraud.’

6

The applicant claims that the Court should:

7

Europol contends that the Court should:

8

By the present action, the applicant relies on harmful conduct on the part of Europol, as a result of unlawful data processing operations, and seeks compensation, in the sum of EUR 50000, for non-material damage resulting from that conduct, on the basis of Articles 268 and 340 TFEU and Article 50(1) of Regulation 2016/794.

9

Under Article 50(1) of Regulation 2016/794, any individual who has suffered damage as a result of an unlawful data processing operation has the right to receive compensation for damage suffered, either from Europol in accordance with Article 340 TFEU or from the Member State in which the event that gave rise to the damage occurred, in accordance with its national law.

10

As the applicant has brought an action before the Court directed against Europol, it is on the basis of Articles 268 and 340 TFUE that his action falls to be examined.

11

Europol argues that the action is inadmissible as the application is not sufficiently clear and precise.

12

Under the first paragraph of Article 21 of the Statute of the Court of Justice of the European Union, which is applicable to the procedure before the General Court by virtue of the first paragraph of Article 53 thereof, and Article 76(d) of the Rules of Procedure of the General Court, the application must contain the subject matter of the dispute, the pleas in law and arguments relied on and a summary of those pleas in law. Those details must be sufficiently clear and precise to enable the defendant to prepare its defence and the Court to rule on the action, if necessary without any other information. In order to ensure legal certainty and the proper administration of justice, it is necessary, if an action is to be admissible, that the essential points of law and fact relied on be indicated coherently and intelligibly in the application itself (see order of 11 March 2021, Techniplan v Commission, T‑426/20, not published, EU:T:2021:129, paragraph 19 and the case-law cited).

13

In order to satisfy those requirements for clarity and precision, an application for compensation for damage said to have been caused by an EU institution must indicate the evidence from which the conduct which the applicant alleges against the institution can be identified, the reasons why the applicant considers that there is a causal link between the conduct and the damage which it claims to have sustained, and the nature and extent of that damage (see, to that effect, judgment of 7 October 2015, Accorinti and Others v ECB, T‑79/13, EU:T:2015:756, paragraph 53 and the case-law cited).

14

In the present case, it is apparent from the application that the applicant is seeking compensation for damage that he considers he suffered as a result of two actions taken by Europol, the first being the inclusion of his personal details in the report (first head of claim) and the second being the addition by Europol of the report to the case file in the criminal proceedings brought against him in the Slovak Republic (second head of claim), the unlawfulness of which he argues by reference to rules of law conferring rights on individuals, including the provisions which are intended to guarantee respect for his personal data.

15

Therefore, it must be found that the subject matter of the action and the pleas in law put forward by the applicant are indicated sufficiently intelligibly in the application itself. That finding is also confirmed by the fact that Europol was able to respond to those pleas.

16

Furthermore, in so far as Europol argues, in support of its objection of inadmissibility, that the evidence submitted by the applicant of the alleged unlawful conduct and the alleged damage is insufficient, it must be held that such matters do not fall within the assessment of the admissibility of the claim for compensation, but rather the assessment of its merits (see, to that effect, judgment of 29 September 2021, Kočner v Europol, T‑528/20, not published, under appeal, EU:T:2021:631, paragraph 39).

17

It must, therefore, be held that the action satisfies the requirements laid down in Article 76(d) of the Rules of Procedure and, accordingly, that it is admissible.

18

It should be recalled from the outset that, pursuant to the second paragraph of Article 340 TFEU, in the case of non-contractual liability, the European Union, in accordance with the general principles common to the laws of the Member States, is to make good any damage caused by its institutions or by its servants in the performance of their duties.

19

First, it follows therefrom that the second paragraph of Article 340 TFEU gives jurisdiction to the EU judicature only to award compensation for damage caused by the EU institutions or by their servants in the performance of their duties or, in other words, for damage capable of giving rise to non-contractual liability on the part of the European Union (order of 9 July 2019, Scaloni and Figini v Commission, T‑158/18, not published, EU:T:2019:491, paragraph 19, and judgment of 29 September 2021, Kočner v Europol, T‑528/20, not published, under appeal, EU:T:2021:631, paragraph 59).

20

In that regard, it is settled case-law that the concept of ‘institution’ within the meaning of the second paragraph of Article 340 TFEU encompasses not only the EU institutions listed in Article 13(1) TEU but also all the EU bodies, offices and agencies that have been established by or under the Treaties and are intended to contribute to the achievement of the EU’s objectives (see judgment of 16 December 2020, Council and Others v K Chrysostomides & Co. and Others, C‑597/18 P, C‑598/18 P, C‑603/18 P and C‑604/18 P, EU:C:2020:1028, paragraph 80 and the case-law cited), including agencies of the European Union and, therefore, Europol (see, to that effect, judgment of 29 September 2021, Kočner v Europol, T‑528/20, not published, under appeal, EU:T:2021:631, paragraph 60).

21

Secondly, the European Union may incur non-contractual liability under the second paragraph of Article 340 TFEU only if three cumulative conditions are fulfilled, namely the unlawfulness of the conduct alleged against the EU institution, the fact of damage and the existence of a causal link between the conduct of the institution and the damage complained of (see judgment of 16 December 2020, Council and Others v K Chrysostomides & Co. and Others, C‑597/18 P, C‑598/18 P, C‑603/18 P and C‑604/18 P, EU:C:2020:1028, paragraph 79).

22

Since those three conditions for the incurring of liability are cumulative, failure to meet one of them is sufficient for a claim for damages to be dismissed (judgment of 25 February 2021, Dalli v Commission, C‑615/19 P, EU:C:2021:133, paragraph 42).

23

It is in the light of the aforementioned principles that each of the two heads of claim must be examined.

24

The applicant seeks compensation for the non-material damage which he claims to have suffered as a result of the inaccurate and unsubstantiated statement by Europol in its report that he had been the subject of a drug-trafficking investigation in Sweden and a fraud investigation in Poland when in fact there is not, nor has there been, any investigation in those States relating to him.

25

The inclusion of that inaccurate and unsubstantiated information about him constitutes unlawful processing of personal data, infringing his right to respect for his private and family life, his right to the protection of personal data concerning him and the principle of the presumption of innocence, all of which are guaranteed by the Charter of Fundamental Rights of the European Union (‘the Charter’). In effect, that information presented him as a person who indulged in drug trafficking or fraud.

26

According to the applicant, the infringement is even more unlawful in that he had no opportunity to be heard in relation to the information contained in the report, no court ruling or decision of an independent administrative authority preceded the report and Europol had no evidence of the accuracy of the information about him.

27

This caused him to experience a sense of injustice and harmed his good name, his reputation and his private life, in particular his relationship with his partner and his son.

28

Europol disputes the applicant’s arguments.

29

In the first place, as regards the condition pertaining to the unlawfulness of the conduct alleged against Europol, it must be noted that the applicant’s claim that the report unlawfully mentioned two investigations concerning him in Sweden and Poland results from an incorrect reading of that report.

30

Contrary to what the applicant alleges, the contentious paragraph of that report, although worded clumsily in English and notwithstanding the manner in which the applicant interpreted it, does not state that the applicant was the subject of two investigations carried out in Sweden and Poland, but only that his name had been reported in the context of those two investigations, as is clear from the following wording in the report: ‘In addition, Leon Leonard Johan Veen had been reported also in a Swedish investigation concerning drugs trafficking and a Polish investigation concerning fraud.’ Furthermore, in its defence, Europol explained that, when it wishes to indicate in a report addressed to national police authorities that a person is or was a suspect in an investigation, it does so expressly and unequivocally, for example by the use of terms such as ‘suspect’ or ‘subject of an investigation’.

31

Accordingly, the applicant is wrong to claim that, in the report, Europol unlawfully stated that he had been the subject of two investigations in Sweden and Poland and, therefore, that he had been identified as having taken part in drug trafficking or fraud.

32

In any event, the inclusion in a Europol report of personal information about an individual, whose surname or personal details were collected or are stored by Europol, does not in itself constitute an unlawful act such as to incur liability on Europol’s part.

33

It is apparent from Article 3(1) of Regulation 2016/794, read in conjunction with recitals 12 and 13 of that regulation, that Europol is to act as a hub for exchanging criminal intelligence between the law enforcement agencies of the Member States in order to support and strengthen action by competent authorities of the Member States and their mutual cooperation in preventing certain forms of serious crime affecting two or more Member States.

34

In order to achieve those objectives and pursuant to Article 4(1)(a) and (b) of Regulation 2016/794, Europol’s task is, inter alia, to collect, store, process, assess and exchange information, including criminal intelligence, and to notify the Member States without delay of any information and connections between criminal offences concerning them, such notification being compulsory under Article 22 of that regulation.

35

To that end, Article 18(1) and (2) of Regulation 2016/794, read in conjunction with recitals 24 and 25 of that regulation, authorises Europol to process information, including personal data, inter alia by carrying out cross-checking aimed at identifying connections or other relevant links between information related to different categories of data subjects.

36

Nonetheless, Article 18(4) of Regulation 2016/794 requires Europol to comply with the data protection safeguards provided for in the regulation. It is apparent from Chapter VI of the regulation, entitled ‘Data protection safeguards’, and from recital 40 of the regulation, that that protection is autonomous and adapted to the specificity of personal data processing in the law enforcement context, which is permitted by Declaration No 21 on the protection of personal data in the fields of judicial cooperation in criminal matters and police cooperation, attached to the TEU and the TFEU, recognising the specificity of personal data processing in the law enforcement context.

37

Against that background, Article 38(2), (4), (5) and (7) of Regulation 2016/794, read in conjunction with recital 47 of the regulation, specifies how responsibility in personal data protection matters is to be attributed between, inter alia, Europol and the Member States.

38

Accordingly, Europol assumes responsibility for compliance with the general principles of data protection, referred to in Article 28 of that regulation, with the exception of the requirement for data to be accurate and up to date, and responsibility for all data processing operations that it carries out, with the exception of the bilateral exchange of data using Europol's infrastructure. Meanwhile, the Member States are responsible for the quality of the personal data that they provide to Europol and for the legality of such transfers.

39

In the present case, the applicant has not provided any evidence capable of establishing that, as regards the inclusion of his name or personal data in the report, Europol failed to meet any of the obligations imposed on it by Regulation 2016/794 and for which it can be held responsible under Article 38 of that regulation, read in conjunction with Article 50(1).

40

To that effect, the applicant neither alleges, nor, a fortiori, has shown that, by cross-checking the information it had about him, and then communicating it under a confidential procedure to a limited number of law enforcement agencies, Europol went beyond the scope of Regulation 2016/794, as defined in Article 18(5), or exceeded the powers devolved to it inter alia by Article 18(2) of that regulation.

41

In so far as the applicant implies that the information about him in the report is incorrect, it must be noted that he has not asserted that his name did not appear in the context of the investigations in question.

42

Even supposing that the information in question is incorrect, he has failed to show that Europol could be held responsible for that inaccuracy. As explained in paragraph 38 above, Europol cannot be held responsible for any inaccuracies in data supplied by a Member State. The applicant has not submitted any evidence or prima facie evidence that could even suggest that Europol had altered the information supplied by the Swedish and Polish authorities.

43

Lastly, in so far as the applicant criticises Europol for not giving him the opportunity to be heard before including his personal data in the report and for processing that data without prior authorisation from a court or independent administrative authority, it is sufficient to note that Regulation 2016/794 does not contain any such obligations.

44

In particular, to impose an obligation on Europol to give any individual the opportunity to be heard before personal data about him or her is included in a report intended solely for given police authorities and law enforcement agencies could undermine the practical effect of Regulation 2016/794 and the actions of those authorities and enforcement agencies that the regulation is intended to support and strengthen.

45

In addition, the arguments alleging infringement of Articles 7, 8 and 48(1) of the Charter concerning, respectively, respect for private and family life, protection of personal data and the presumption of innocence, must be rejected.

46

As regards the alleged infringement of Articles 7 and 8 of the Charter, it must be recalled that Article 52(1) of the Charter provides that any limitation on the exercise of the rights and freedoms recognised by the Charter must be provided for by law, which implies, in particular, that the legal basis which permits the interference with those rights must itself define the scope of the limitation on the exercise of the right concerned, and that legislation involving a measure which permits such an interference must lay down clear and precise rules governing the scope and application of the measure in question and impose minimum safeguards, so that the persons whose personal data is transferred have sufficient guarantees that that data will be effectively protected against the risk of abuse (see judgment of 24 February 2022, Valsts ieņēmumu dienests (Processing of data for tax purposes), C‑175/20, EU:C:2022:124, paragraphs 54 and 55 and the case-law cited).

47

As is mentioned in recital 76 of Regulation 2016/794, the regulation was drawn up with a view to guaranteeing, inter alia, respect for the right to the protection of personal data and the right to privacy as protected by Articles 8 and 7 of the Charter, whilst also pursuing the legitimate and necessary objective of effectively combating forms of serious crime affecting several Member States or even crossing the external borders of the European Union.

48

Within that context and as is made clear inter alia by Chapter VI of Regulation 2016/794, when read in conjunction with recital 50 of the regulation, the EU legislature laid down clear and precise rules on the scope of the powers devolved to Europol, made Europol’s actions subject to minimum safeguards in relation to the protection of personal data and put in place independent, transparent and accountable structures for supervision.

49

Accordingly, as the applicant has not established that, by including personal data about him in the report, Europol failed to fulfil the obligations imposed on it, there can be no finding of any infringement of Articles 7 and 8 of the Charter on that account.

50

As regards the alleged infringement of Article 48(1) of the Charter, relating to the presumption of innocence, it is not substantiated by any argument. It therefore does not meet the requirements set out in Article 76(d) of the Rules of Procedure and, accordingly, is inadmissible.

51

It follows from the foregoing that the applicant has failed to establish the existence of any unlawful conduct on the part of Europol with regard to the first head of claim.

52

In the second place and in any event, as regards the conditions pertaining to the fact of the alleged damage and the existence of a causal link between that damage and Europol’s conduct, it must be noted that the applicant merely asserts that the report was ‘accessible’ to the prosecutor, the investigator, the national court and the parties to the proceedings, whom he does not, however, identify.

53

As he has failed to establish that there was any breach of the confidentiality regime applied to the report by Europol or that any persons other than those to whom the report was addressed were able to access it, the applicant does not have any grounds for maintaining that the inclusion of his personal data in the report harmed his reputation or his good name.

54

For similar reasons and due to a lack of evidence to substantiate his allegation, the applicant has also failed to establish that the inclusion of that data in the report affected his relationship with his partner and child, who, according to the evidence submitted to the Court, did not have access to the report.

55

It follows from the foregoing that the first head of the claim for compensation must be rejected as unfounded.

56

The applicant seeks compensation for the damage which he considers that he suffered as a result of Europol adding the report to the case file in the criminal proceedings taken against him in the Slovak Republic, to the extent that the addition of the report caused him a sense of injustice and harmed his good name, his reputation and his right to family life.

57

Europol disputes the applicant’s arguments, asserting, in particular, that it did not add the report to the case file in the criminal proceedings in question.

58

In that regard, it should be noted that the applicant has not submitted any evidence, or even any prima facie evidence, capable of establishing that it was Europol that added the report to the case file for the criminal proceedings in question, rather than the Slovak law enforcement agencies.

59

In addition, it is abundantly clear from paragraph 17 of the application that, according to the applicant himself, Europol communicated the report to the Slovak police authorities.

60

That finding is also corroborated by the logic of Regulation 2016/794 and by the mission entrusted to Europol within the system for law enforcement cooperation set up by that regulation.

61

Pursuant to Article 3(1) of Regulation 2016/794, Europol’s task is to support and strengthen action by the competent authorities of the Member States, defined in Article 2(a) of that regulation as ‘all police authorities and other law enforcement services existing in the Member States which are responsible under national law for preventing and combating criminal offences’.

62

Therefore, contrary to what the applicant asserts and in view of the evidence that he submitted to the Court, the addition of the report to the case file for the criminal proceedings taken against him in the Slovak Republic cannot be ascribed to Europol.

63

Accordingly, the damage allegedly resulting from the addition of the report to the case file for the criminal proceedings is not attributable to Europol.

64

It follows from all the foregoing considerations that the second head of the claim for compensation must be rejected as unfounded and that the action must be dismissed in its entirety, without there being any need to rule on the applicant’s offers of evidence or his requests for measures of organisation of procedure and inquiry and, in particular, on their admissibility, since the Court considers that it has sufficient information available to it from the material in the file to be able to rule on the dispute.

65

Under Article 134(1) of the Rules of Procedure, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings. Since the applicant has been unsuccessful, he must be ordered to pay the costs, in accordance with the form of order sought by Europol.

On those grounds,

THE GENERAL COURT (Eighth Chamber)

hereby: