1

By its appeal, Vialto Consulting Kft. (‘Vialto’) seeks the setting aside of the judgment of the General Court of the European Union of 26 June 2019, Vialto Consulting v CommissionT‑617/17, not published, EU:T:2019:446; ‘the judgment under appeal’) by which the General Court dismissed its action seeking compensation for the damage it allegedly suffered as a result of the conduct of the European Commission and the European Anti-Fraud Office (OLAF), which was in its view unlawful, in connection with its exclusion from the contract for the provision of services bearing the reference TR2010/0311.01-02/001 (‘the contract at issue’).

2

Article 4 of Council Regulation (Euratom, EC) No 2185/96 of 11 November 1996 concerning on-the-spot checks and inspections carried out by the Commission in order to protect the European Communities’ financial interests against fraud and other irregularities (OJ 1996 L 292, p. 2.) states:

‘On-the-spot checks and inspections shall be prepared and conducted by the Commission in close cooperation with the competent authorities of the Member State concerned, which shall be notified in good time of the object, purpose and legal basis of the checks and inspections, so that they can provide all the requisite help. To that end, the officials of the Member State concerned may participate in the on-the-spot checks and inspections.

In addition, if the Member State concerned so wishes, the on-the-spot checks and inspections may be carried out jointly by the Commission and the Member State’s competent authorities.’

3

Article 7 of that regulation provides:

‘1.   Commission inspectors shall have access, under the same conditions as national administrative inspectors and in compliance with national legislation, to all the information and documentation on the operations concerned which are required for the proper conduct of the on-the-spot checks and inspections. They may avail themselves of the same inspection facilities as national administrative inspectors and in particular copy relevant documents.

On-the-spot checks and inspections may concern, in particular:

…

…

2.   Where necessary, it shall be for the Member States, at the Commission’s request, to take the appropriate precautionary measures under national law, in particular in order to safeguard evidence.’

4

Article 9 of that regulation reads as follows:

‘Where the economic operators referred to in Article 5 resist an on-the-spot check or inspection, the Member State concerned, acting in accordance with national rules, shall give Commission inspectors such assistance as they need to allow them to discharge their duty in carrying out an on-the-spot check or inspection.

It shall be for the Member States to take any necessary measures, in conformity with national law.’

5

The first subparagraph of Article 2(1) of 1999/352/EC, ECSC, Euratom: Commission Decision of 28 April 1999 establishing the European Anti-fraud Office (OLAF) (OJ 1999 L 136, p. 20) provides as follows:

‘The Office shall exercise the Commission’s powers to carry out external administrative investigations for the purpose of strengthening the fight against fraud, corruption and any other illegal activity adversely affecting the Community’s financial interests, as well as any other act or activity by operators in breach of Community provisions.’

6

Recital 1 of Commission Regulation (EC) No 718/2007 of 12 June 2007 implementing Council Regulation (EC) No 1085/2006 establishing an instrument for pre-accession assistance (IPA) (OJ 2007 L 170, p. 1) states:

‘The purpose of Regulation (EC) No 1085/2006 (hereinafter referred to as “the IPA Regulation”) is to provide pre-accession assistance to beneficiary countries and support them in their transition from Annex II to Annex I of that Regulation and through to membership of the European Union.’

7

Article 10(1) of Regulation 718/2007 provides:

‘Unless otherwise provided for in paragraph 2, 3 and 4, decentralised management, where the Commission confers the management of certain actions on the beneficiary country, while retaining overall final responsibility for general budget execution in accordance with Article 53c of Regulation (EC, Euratom) No 1605/2002 [Council Regulation of 25 June 2002 on the Financial Regulation applicable to the general budget of the European Communities (OJ 2002 L 248, p. 1)] and the relevant provisions of the EC Treaties, shall apply to the implementation of assistance under the IPA Regulation.

For the purposes of assistance under the IPA Regulation, decentralised management shall cover at least tendering, contracting and payments.

…’

8

Article 21(1) of that regulation reads as follows:

‘The beneficiary country shall designate the following different bodies and authorities:

…

…’

9

Article 28 of that regulation provides:

‘1.   For each IPA component or programme, an operating structure shall be established to deal with the management and implementation of assistance under the IPA Regulation.

The operating structure shall be a body or a collection of bodies within the administration of the beneficiary country.

2.   The operating structure shall be responsible for managing and implementing the programme or programmes concerned in accordance with the principle of sound financial management. For those purposes, it shall carry out a number of functions that include:

…

…’

10

According to Article 3 of Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999 (OJ 2013 L 248, p. 1):

‘1.   The Office shall exercise the power conferred on the Commission by Regulation (Euratom, EC) No 2185/96 to carry out on-the-spot checks and inspections in the Member States and, in accordance with the cooperation and mutual assistance agreements and any other legal instrument in force, in third countries and on the premises of international organisations.

…

2.   With a view to establishing whether there has been fraud, corruption or any other illegal activity affecting the financial interests of the Union in connection with a grant agreement or decision or a contract concerning Union funding, the Office may, in accordance with the provisions and procedures laid down by Regulation (Euratom, EC) No 2185/96, conduct on-the-spot checks and inspections on economic operators.

…’

11

Article 11 of that regulation states:

‘1.   On completion of an investigation by the Office, a report shall be drawn up, under the authority of the Director-General. That report shall give an account of the legal basis for the investigation, the procedural steps followed, the facts established and their preliminary classification in law, the estimated financial impact of the facts established, the respect of the procedural guarantees in accordance with Article 9 and the conclusions of the investigation.

The report shall be accompanied by recommendations of the Director-General on whether or not action should be taken. Those recommendations shall, where appropriate, indicate any disciplinary, administrative, financial and/or judicial action by the institutions, bodies, offices and agencies and by the competent authorities of the Member States concerned, and shall specify in particular the estimated amounts to be recovered, as well as the preliminary classification in law of the facts established.

…

3.   Reports and recommendations drawn up following an external investigation and any relevant related documents shall be sent to the competent authorities of the Member States concerned in accordance with the rules relating to external investigations and, if necessary, to the competent Commission services.

…’

12

Article 4.3 and 4.4 of the Guidelines on Digital Forensic Procedures for OLAF Staff of 15 February 2016 (‘the OLAF Guidelines’), provide:

‘3.   At the start of the digital forensic operation, the DES [(OLAF Digital Evidence Specialist)] shall: (1) document and take photographs of all digital media which shall be subject to the forensic operation, as well as the physical surroundings and layout; (2) make an inventory of the digital media. The inventory should be included in the “Digital Forensic Operation Report”, and the photographs attached to it.

4.   In general the DES should conduct a full digital forensic acquisition of the devices referred to in 4.3. If feasible, the DES and the investigator should together preview those devices to determine whether they may contain data potentially relevant for the investigation and whether a partial forensic acquisition would be appropriate. If so, the DES may instead conduct a partial forensic acquisition of the data. A short description of the contents and the case reference number added by the DES shall be recorded during the acquisition of the digital forensic image.’

13

Article 8.2 and 8.4 of the OLAF Guidelines provides:

‘2.   The DES shall transfer the digital forensic image to the forensic file server in the forensic laboratory. The file thus transferred becomes the forensic work file. The DES should inform the investigator as soon as the forensic work file is ready.

…

4   When the forensic work file is available, the investigator shall launch written requests through the CMS Intelligence Request Module to index the forensic work file and as appropriate obtain the assistance of the DES or operational analyst to identify data relevant for the investigation. The latter request should describe the aim of the search and what type of evidence and/or proof the investigator is searching for. In response to the investigator’s written request and in conjunction with the investigator the DES shall extract data matching the search criteria from the digital forensic work file for read-only access by the investigator.’

14

The background to the dispute is set out in paragraphs 1 to 23 of the judgment under appeal and, for the purposes of these proceedings, can be summarised as follows:

15

Vialto is a company incorporated under Hungarian law which provides advisory services to undertakings and entities belonging to the private and public sectors.

16

On 22 April 2011, the Commission concluded a financing agreement with the Republic of Turkey under the system of decentralised management with ex ante control, which formed part of the national programme for the Republic of Turkey under the ‘Transition Assistance and Institution Building’ component of the Instrument for Pre-Accession Assistance (IPA). The designated operating structure, within the meaning of Article 21 of Regulation No 718/2007, was the Central Finance and Contracts Unit (CFCU), a body within the Turkish administration.

17

On 17 December 2013, a restricted call for competition for the supply of external quality control services in the context of project TR2010/0311.01 ‘Digitization of Land Parcel Identification System’ (‘the project at issue’) was published in the Supplement to the Official Journal of the European Union (OJ 2013/S 244-423607) under reference EuropeAid/132338/D/SER/TR. The contracting authority designated in the call for competition was the CFCU.

18

On 19 September 2014, the contract corresponding to that call for competition was awarded to a consortium coordinated by Agrotec SpA composed of five participants, including Vialto (‘the consortium’). The consortium entered into the contract at issue with the CFCU.

19

Following the opening of an investigation on account of suspected acts of corruption or fraud committed in the context of the project at issue, OLAF decided to carry out checks and inspections at Vialto’s premises (‘the on-the-spot check’).

20

On 7 April 2016, OLAF issued two mandates designating the officials responsible for carrying out an on-the-spot check and a digital forensic technical operation. Under the terms of those mandates, the purpose of the on-the-spot check was to gather the evidence held by Vialto of its possible involvement in the acts of corruption and fraud alleged to have been committed in connection with the project at issue. The purpose of the digital forensic operation was to obtain, inter alia, digital forensic images of all Vialto’s digital assets used for management of the project at issue, the email correspondence of Vialto and its employees, the functional mailboxes used for implementation of the project at issue and any files or folders on Vialto’s network that might be relevant for the purposes of the investigation.

21

The on-the-spot check and the digital forensic operation were carried out from 12 to 14 April 2016. A report of each inspection day was drawn up by OLAF. It was noted in the report for 14 April 2016 that Vialto had refused to provide OLAF with certain information. A representative of Vialto signed each of the reports, making comments where necessary.

22

By letter of 6 May 2016, Vialto lodged a complaint with OLAF in which it disputed or commented on certain information contained in those reports. OLAF replied to its complaint by letter of 8 July 2016.

23

By letter of 14 September 2016, OLAF informed Vialto that it was considered to be a person concerned for the purposes of the investigation into the suspicions of corruption or fraud in respect of the project at issue and invited it to submit comments within 10 days.

24

By letter of 23 September 2016, Vialto submitted its observations to OLAF and stated that it had acted in accordance with the applicable rules and complied with all the conditions for legitimate access by OLAF to its data.

25

By letter of 29 September 2016, the CFCU informed Agrotec that the on-the-spot check had been conducted at Vialto’s premises and that Vialto had not consented to granting OLAF access to certain information requested by the latter in order to carry out its investigation. It added that OLAF considered that, by its conduct, Vialto had infringed Article 25 of the general conditions applicable to the contract at issue (‘the general conditions’), on checks, inspections and audits by bodies of the European Union. It also stated that OLAF was examining the situation with the relevant departments of the Commission. Taking the view that, according to the general conditions, Agrotec was its sole interlocutor for all the contractual and financial issues, the CFCU informed that company that as a precaution it was suspending payment of the invoices submitted by it, at least until the closure of OLAF’s investigation.

26

By letter of 13 October 2016, the Commission’s Directorate-General for European Neighbourhood and Enlargement Negotiations (‘DG Enlargement’) informed the CFCU of Vialto’s refusal, contrary to Article 25 of the general conditions, to cooperate in the investigation carried out by OLAF and requested it to take the necessary measures pursuant to those general conditions and, in that regard, to consider suspending performance of the contract at issue or the part of that contract performed by Vialto, as one of the possible measures under Articles 25 and 35 of the general conditions. It added that it considered that the amounts paid to Vialto under the contract at issue were not eligible for funding from the EU budget and asked the CFCU to determine the precise amounts involved.

27

By letter of 9 November 2016, OLAF informed Vialto that its investigation had been closed and that its final investigation report had been forwarded to DG Enlargement, and of the recommendations it had made to that Directorate-General (‘DG’) to take appropriate measures to ensure the application of the procedures and sanctions resulting from Vialto’s serious breach of the general conditions.

28

By letter of 11 November 2016, the CFCU informed Agrotec of the closure of OLAF’s investigation and of OLAF’s finding that Vialto had infringed Article 25 of the general conditions. The CFCU also informed Agrotec of its decision to exclude Vialto from all aspects of the contract at issue and to continue to perform that contract, instead of following the recommendation of DG Enlargement to suspend performance of the contract. Consequently, the CFCU requested that Agrotec immediately terminate Vialto’s activities and take the necessary steps to exclude it from the consortium, namely, by drafting an addendum to the contract at issue.

29

By letter of 5 December 2016 addressed to the CFCU, Vialto challenged its exclusion from the contract at issue. The CFCU rejected its arguments by letter of 10 January 2017.

30

On 13 December 2016, CFCU and Agrotec signed an addendum to the contract at issue in order to remove Vialto from the list of members of the consortium and to give effect to the resulting consequences, particularly the financial consequences.

31

By application lodged at the Registry of the General Court on 7 September 2017, Vialto brought an action seeking an order that the Commission pay it compensation of EUR 320 944.56 and EUR 150000, together with interest, for the material damage and non-material damage respectively that it claimed was caused by the allegedly unlawful conduct of the Commission and OLAF in connection with its exclusion from the contract at issue.

32

In support of that application, Vialto advanced two complaints relating to OLAF’s alleged unlawful conduct, claiming, first, an infringement of Article 7(1) of Regulation No 2185/96 and, secondly, a breach of the right to good administration and the principles of non-discrimination, proportionality and the protection of legitimate expectations. In addition, Vialto submitted a complaint relating to the Commission’s alleged unlawful conduct, claiming that it had infringed its right to be heard.

33

During the hearing before the General Court, Vialto waived its claim for compensation for material damage and reduced the sum sought in compensation for the non-material damage allegedly suffered by it to EUR 25000, together with interest.

34

By the judgment under appeal, the General Court, having held that the Commission had wrongly contested its jurisdiction and, on that ground, the admissibility of the action, dismissed all Vialto’s complaints against OLAF and the Commission.

35

The General Court held first of all, in paragraphs 69 to 73 of the judgment under appeal, that the data to which the OLAF agents requested access in the present case could be regarded as relevant to the OLAF investigation and that the production of a digital forensic image falls within the powers conferred on the Commission by virtue of Article 7(1) of Regulation No 2185/96. It concluded from the foregoing, in paragraphs 74 and 80 of the judgment under appeal, that, by requesting Vialto to grant access to those data for analysis, the OLAF agents did not commit any violation of that provision.

36

It then dismissed Vialto’s arguments relating to OLAF’s breach of the right to good administration and the principles of non-discrimination, proportionality and the protection of legitimate expectations. As regards the principle of the protection of legitimate expectations, after recalling, in paragraph 114 of the judgment under appeal, the conditions which must be satisfied for a person to rely on it, in paragraphs 116 and 117 of that judgment, the General Court found that, in the present case, it was following Vialto’s refusal to grant the OLAF agents’ lawful requests for the collection of data that those agents agreed to derogate from the procedure laid down by the OLAF Guidelines as regards the place where the data are obtained and processed and the medium used for that purpose. The General Court concluded from that fact, in paragraph 118 of that judgment, that Vialto cannot rely on a sufficiently serious breach of the principle of the protection of the legitimate expectation which it had placed in the application of a practice derogating in its favour, despite its refusal to grant the requests made by the OLAF agents in accordance with Article 7(1) of Regulation No 2185/96.

37

Finally, the General Court dismissed Vialto’s complaint relating to the Commission’s infringement of its right to be heard, finding, first, in paragraph 121 of the judgment under appeal, that, by letters addressed to OLAF, Vialto had submitted its observations on the on-the-spot check and, secondly, in paragraph 122 of that judgment, that the decision to exclude Vialto from the contract at issue had been taken by the CFCU, which was not bound by a position adopted by DG Enlargement.

38

The General Court therefore dismissed Vialto’s action in its entirety without examining the conditions relating to the existence of a sufficiently direct causal link between the alleged conduct or to the damage claimed and the existence of that damage.

39

By its appeal, Vialto claims that the Court of Justice should:

40

Vialto specifies that, were the Court to set aside the judgment under appeal, it should be a matter for the Court’s discretion to decide whether to refer the case back to the General Court for judgment on the merits.

41

The Commission claims that the Court of Justice should:

42

Vialto relies on three grounds in support of its appeal. The first two of those grounds allege that the General Court erred in dismissing the two complaints alleging, first, infringement of Article 7(1) of Regulation No 2185/96 and, secondly, a breach of the principle of the protection of legitimate expectations. The third grounds alleges that the General Court erred in dismissing the complaint alleging infringement of the right to be heard.

43

By the first and second parts of its first ground, Vialto claims that the General Court committed several errors relating to OLAF’s powers to have access to and collect data in the context of an on-the-spot check.

44

In the first place, the General Court allegedly distorted the facts in two ways before concluding, wrongly, in paragraph 80 of the judgment under appeal, that OLAF had not infringed Article 7(1) of Regulation No 2185/96 when it requested Vialto to allow it access to the data referred to in paragraph 71 of that judgment.

45

First, the case that gave rise to the judgment under appeal concerns whether Article 7(1) of Regulation No 2185/96 was infringed by OLAF’s request to collect those data, not by its request for access to them.

46

According to Vialto, that distortion caused the General Court to misapply the law, since it should have interpreted the right of access under Article 7(1) of Regulation No 2185/96 as including, on the one hand, a very broad right of investigation applying to all the categories of data referred to in that article and, on the other, a right to collect data limited to data connected with the operations undergoing the check.

47

Secondly, the General Court misconstrued the facts, failing to find, in paragraph 80 of the judgment under appeal, that Vialto had granted OLAF access to the data at issue. Specifically, the General Court should have taken into account the annex – which Vialto submitted with its application – to OLAF’s report for the third day of the check. According to Vialto, it is clear from that document the Vialto did grant OLAF full access to its accounting system and its transactions.

48

In the second place, the judgment under appeal does not substantiate the finding, made in paragraph 74 of the judgment under appeal, that the data which OLAF requested to collect in the present case related to the operations concerned and were required for the proper conduct of the on-the-spot check, within the meaning of Article 7(1) of Regulation No 2185/96. That finding is therefore, Vialto contends, arbitrary.

49

In the third place, that finding, which is repeated in paragraph 83 of the judgment under appeal, is vitiated by an error of law since, prior to any keyword search, it could not be found that all the data requested by OLAF, including all the correspondence and the contents of the computers of two employees of Vialto and the whole of its server and copies of all its transactions since 2012, were connected with the operations under investigation and were required for the investigation, with the effect that OLAF was entitled to collect them.

50

In the fourth place, the General Court misconstrued the facts by finding, in paragraph 75 of the judgment under appeal, that Vialto merely objected to those data being collected on media to be taken to OLAF’s premises, whereas according to Vialto it objected, from the outset and in general terms, to the collection of data unrelated to the project under review.

51

The Commission claims that the first and second parts of the first ground of appeal should be dismissed as unfounded.

52

First, Vialto’s argument that the General Court misconstrued the scope of the complaint advanced by Vialto in its application at first instance alleging that OLAF’s conduct was unlawful since it infringed Article 7(1) of Regulation No 2185/96, cannot succeed.

53

It must be observed that the General Court stated, in paragraph 62 of the judgment under appeal, that Vialto complains that OLAF demanded that it be able to collect data unconnected with the project at issue, in breach of that article. In addition, the General Court stated, in paragraph 75 of the judgment under appeal, that Vialto argues that it did allow the OLAF agents access to all the data requested and that it objected only to the collection of those data.

54

The General Court therefore cannot be found to have interpreted the application at first instance as meaning that the complaint in question concerned whether Article 7(1) of Regulation No 2185/96 was infringed as a result of OLAF’s request for access to those data, rather than in connection with the collection of those data.

55

Secondly, as regards Vialto’s claim that the General Court misconstrued the facts by failing to find, in paragraph 80 of the judgment under appeal, that Vialto had granted OLAF access to all the data requested, it must be observed that that paragraph concludes the General Court’s reasoning on the interpretation of Article 7(1) of Regulation No 2185/96 and contains no assessment of Vialto’s behaviour. That claim is therefore based on a misreading of that paragraph.

56

Furthermore, even assuming that, by that claim, Vialto intended to dispute the reasons that led the General Court to conclude as it did, it must be observed that paragraphs 63 to 78 of the judgment under appeal contain no finding that Vialto refused to grant OLAF access to the data referred to in paragraph 71 of the judgment under appeal.

57

By contrast, in paragraph 79 of the judgment under appeal the General Court found that when the OLAF agents ended the on-the-spot check and the digital forensic operation Vialto had not provided them with the data it considered were covered by professional secrecy or by the contractual clauses on which it relies.

58

It is important to bear in mind in that respect that, as is clear from the second subparagraph of Article 256(1) TFEU and from the first paragraph of Article 58 of the Statute of the Court of Justice of the European Union, appeals are limited to points of law. The General Court, therefore, has exclusive jurisdiction to make findings in respect of the relevant facts and to assess those facts and the evidence. Accordingly, the assessment of those facts and that evidence does not, save where it distorts those facts and evidence, constitute a point of law which is, as such, subject on appeal to review by the Court of Justice (judgment of 25 February 2021, Dalli v Commission, C‑615/19 P, EU:C:2021:133, paragraph 73 and the case-law cited).

59

Such distortion must be obvious from the documents in the Court’s file, without there being any need to carry out a new assessment of the facts and the evidence. The appellant must indicate precisely the evidence alleged to have been distorted by the General Court and show the errors of appraisal which, in its view, led to that distortion (judgment of 4 March 2020, Tulliallan Burlington v EUIPO, C‑155/18 P to C‑158/18 P, EU:C:2020:151, paragraph 102 and the case-law cited).

60

Vialto contends, in essence, that had the General Court taken into account the annex to OLAF’s report for the third day of the on-the-spot check, which contains its comments on the conduct of the check that day, it would necessarily have found that Vialto granted OLAF full access to the data requested.

61

It must be observed nevertheless that the document in question reproduces Vialto’s observations on the conduct of the check, and is therefore helpful only in establishing its point of view on that conduct. The General Court in fact stated, in paragraph 75 of the judgment under appeal, that Vialto claims that it allowed the OLAF agents access to all the data requested.

62

It therefore cannot be established, on the basis of the argument put forward by Vialto, that the General Court misconstrued the relevant facts or evidence, and that argument must therefore be dismissed as unfounded.

63

Thirdly, as regards the allegation that the finding in paragraph 74 of the judgment under appeal fails to state reasons, it must be recalled that, according to consistent case-law of the Court of Justice, the duty to state reasons does not require the General Court to provide an account which follows exhaustively and one by one all the arguments put forward by the parties to the case. The General Court’s reasoning may thus be implicit, on condition that it enables the persons concerned to know why it has not upheld their arguments and provides the Court of Justice with sufficient material for it to exercise its power of review (judgment of 25 June 2020, SatCen v KF, C‑14/19 P, EU:C:2020:492, paragraph 96 and the case-law cited).

64

In the present case, the General Court stated, in paragraphs 66 to 73 of the judgment under appeal, the reasons that led it to find that the data which OLAF requested to collect related to the operations concerned and were required for the proper conduct of the on-the-spot check, within the meaning of Article 7(1) of Regulation No 2185/96.

65

It can be seen from those paragraphs that the finding in question is based, first of all, on the wording of Article 7(1) of Regulation No 2185/96, from which it is clear, according to the General Court that, on one hand, OLAF is entitled to have access to all the information and documentation relating to the facts to which its investigation relates and to take copies of the documents required in order to carry out its on-the-spot check and, on the other hand, that OLAF has a degree of discretion to determine the data relevant for that purpose. The General Court then turned its attention to the subject matter of the investigation conducted by OLAF in the present case and to the data requested, which, according to the General Court, fell within the type of data to which Article 7(1) of Regulation No 2185/96 refers. Lastly, the General Court reviewed the specific features of digital forensic operations, including the need to index data, which involves making digital copies of the data in question, in order to identify the documents that are relevant for the investigation.

66

That statement of reasons is sufficient, on the one hand, to enable Vialto to understand why its arguments were dismissed and, on the other, for the Court of Justice to exercise its power of review. Vialto’s allegation that the statement of reasons was inadequate must therefore be dismissed as unfounded.

67

Fourthly, as regards the alleged error of law concerning the interpretation of Article 7(1) of Regulation No 2185/96, it must be observed that the General Court held, in paragraph 74 of the judgment under appeal, that the data which OLAF requested to collect in the present case related to the operations concerned and were required for the proper conduct of the on-the-spot check, within the meaning of that article. The General Court also found, in paragraph 80 of the judgment under appeal, that OLAF did not commit any violation of that provision by requesting from Vialto that it have access to those data for analysis.

68

Article 7(1) of Regulation No 2185/96 provides that Commission inspectors are to have access, under the same conditions as national administrative inspectors and in compliance with national legislation, to all the information and documentation on the operations concerned which are required for the proper conduct of the on-the-spot checks and inspections. That article specifies that they may avail themselves of the same inspection facilities as national administrative inspectors and in particular may copy relevant documents. That provision also states that on-the-spot checks and inspections may concern, in particular, computer data.

69

Furthermore, it follows from Article 2(1) of Decision 1999/352 and Article 3(1) of Regulation No 883/2013 that OLAF is to exercise the power to carry out on-the-spot checks and inspections conferred on the Commission by Regulation No 2185/96.

70

It is clear from those articles read together that, in the context of an on-the-spot check, OLAF agents have access, under the same conditions as national administrative inspectors and in compliance with national legislation, to all the information, including computer data, required for the proper conduct of the on-the-spot checks and inspections and that they can avail themselves of the same inspection facilities as national administrative inspectors and can, in particular, copy relevant documents.

71

Although, in relation to the conditions governing access to information by OLAF agents, that provision refers to the law of the Member State concerned, it must be observed that Vialto has not made any allegations that OLAF infringed the applicable rules of Hungarian law in connection with the on-the-spot check at issue, and that it has not put forward any argument to that effect.

72

Furthermore, it must be observed that Vialto has not challenged the findings of the General Court on the production of a digital forensic image, in paragraph 73 of the judgment under appeal, which refers to the explanations in paragraph 44 of that judgment. In those paragraphs, on the basis, in particular, of Articles 4 and 8 of the OLAF Guidelines, the General Court found that, in the context of such a procedure, the production of a digital forensic image of the data on a digital storage medium serves to enable the data to be indexed, which is intended in turn to enable keyword searches using specific forensic computer software in order to identify the documents relevant for the OLAF investigation.

73

Since, by its line of argument, Vialto appears to be equating the production of such a digital forensic image of all the data stored on certain digital media with copying, for the purposes of Article 7(1) of Regulation No 2185/96, all the documents saved on those media, it must be observed, as the Advocate General observes in point 78 of his Opinion, that this operation constitutes merely an intermediate step in the examination of those data (see, by analogy, judgment of 16 July 2020, Nexans France and Nexans v Commission, C‑606/18 P, EU:C:2020:571, paragraph 63).

74

Accordingly, even though the production of such an image, in technical terms, necessarily involves temporarily ‘copying’ all the data at issue, at a stage when their relevance has not yet been examined, that operation forms part of the exercise of the right of access to information, enshrined in Article 7(1) of Regulation No 2185/96, since it serves solely to identify the documents that are relevant for the investigation. It cannot be found that, by doing so, OLAF is copying all the documents concerned for the purposes of that provision. It is apparent from the wording and scheme of that article that the right available to an inspector to copy relevant documents, unlike the right to access information, relates to the fact that the inspector may keep durable copies of certain documents, among those to which the inspector had access, identified by the inspector as relevant for the purposes of the investigation and which may be used subsequently in the context of that investigation.

75

Under those circumstances, it appears that the General Court could correctly find that the production of a digital forensic image of that nature can fall within the powers conferred on OLAF under Article 7(1) of Regulation No 2185/96 to have access to the information required for the proper conduct of the on-the-spot check and to copy the relevant documents.

76

Therefore, Vialto has failed to demonstrate an error of law vitiating the General Court’s finding, in paragraphs 74 and 80 of the judgment under appeal, that the request made by OLAF to Vialto to allow it to collect the data referred to in paragraph 71 of the judgment under appeal, in order to carry out a digital forensic operation, was not contrary to Article 7(1) of Regulation No 2185/96.

77

Vialto’s allegation of an error of law in respect of that finding must therefore be dismissed as unfounded.

78

Fifthly, Vialto’s argument to the effect that the General Court distorted the facts in paragraph 75 of the judgment under appeal is based on a misreading of paragraph 75 of the judgment under appeal and must also be dismissed as unfounded. In that paragraph, the General Court merely noted that Vialto objected to the collection of data on a medium which was to be taken away from its premises, which Vialto does not contest.

79

The first and second parts of the first ground of appeal should therefore be dismissed as unfounded.

80

By the third part of its first ground of appeal, Vialto submits, first, that in paragraph 77 of the judgment under appeal, the General Court erred in law by dismissing its arguments based on respect for professional secrecy and on the clauses of contracts concluded with its commercial partners as irrelevant for the purposes of finding the European Union to have non-contractual liability. In its view, those arguments are relevant to establishing that OLAF infringed Article 7(1) of Regulation No 2185/96, as they demonstrate that the reservations expressed by Vialto with regard to the collection of data unrelated to the investigation were justified. Under the case-law of the Court of Justice, Vialto was required to prove that the making of such reservations did not constitute an abuse of rights.

81

Secondly, the General Court allegedly distorted the application at first instance by holding, in paragraph 79 the judgment under appeal, that OLAF could not be found to have compelled it to breach its professional secrecy or the terms of the contracts concluded with its commercial partners, since Vialto did not in any way claim that it had been compelled by OLAF to act in that way.

82

The Commission claims that the third part of the first ground should be dismissed as in part inadmissible and in part ineffective and, in any event, unfounded.

83

As regards the alleged error of law vitiating paragraph 77 of the judgment under appeal, it must be observed that, in that paragraph, the General Court found that Vialto’s arguments based on professional secrecy and its contractual commitments to its commercial partners were irrelevant to a finding of non-contractual liability on the part of the European Union because they were intended to justify Vialto’s refusal to provide OLAF with certain of the data to which it was requesting access, rather than to allege that OLAF or the Commission had committed a sufficiently serious infringement of a rule of law intended to confer rights on individuals.

84

In that connection, Vialto’s claim that it had been required to prove that the reservations it expressed regarding the collection of certain data by OLAF did not constitute an abuse of rights does not establish that the arguments submitted at first instance, relating to professional secrecy and the contractual commitments given to its commercial partners, are capable of establishing a sufficiently serious infringement of a rule of law intended to confer rights on individuals. That argument is therefore ineffective.

85

The same is true of the distortion of the application that Vialto alleges. Even assuming that, as Vialto suggests, the General Court did misconstrue the application at first instance by taking the view, in paragraph 79 of the judgment under appeal, that it was required to address an argument not raised by Vialto alleging that OLAF had compelled it to breach professional secrecy and commitments given to its commercial partners, such an error cannot call into question the dismissal of Vialto’s first complaint at first instance.

86

It is apparent from the settled case-law of the Court of Justice that complaints directed against a ground included in a decision of the General Court purely for the sake of completeness cannot provide any basis for annulment of that decision and are therefore ineffective (judgment of 25 February 2021, Dalli v Commission, C‑615/19 P, EU:C:2021:133, paragraph 103 and the case-law cited).

87

The third part of the first ground of appeal must therefore be dismissed as ineffective and that ground should be dismissed in its entirety.

88

By its second ground of appeal, Vialto puts forward a series of arguments seeking to establish that, in paragraph 118 of the judgment under appeal, the General Court, wrongly, found that the OLAF agents did not breach the principle of the protection of legitimate expectations in the present case.

89

First, in Vialto’s view, the judgment under appeal contains an inadequate statement of reasons, since it fails to explain in what respect one of the three conditions necessary to rely on the principle of the protection of legitimate expectations is not met in the present case.

90

Secondly, according to Vialto, paragraph 118 of the judgment under appeal is vitiated by an error of law, because it disregards the case-law according to which a lawful administrative act which confers individual rights or similar benefits cannot be withdrawn retroactively. The assurances given by the OLAF agents on the first day of the check, concerning the procedure for conducting that check, were in fact lawful. Vialto clarifies in that respect that a derogation from the OLAF Guidelines does not constitute an infringement of Regulation No 2185/96. The OLAF agents were therefore not entitled subsequently to revoke those assurances and require that the check be carried out as if those assurances had never been given.

91

Moreover, the retroactive withdrawal of an administrative act is prohibited, even if the act must be found to be unlawful.

92

Thirdly, the General Court erred in law when it held, in paragraph 118 of the judgment under appeal, that Vialto cannot rely on a breach of the legitimate expectation that a practice derogating in its favour would be applied, despite its refusal to accede to the requests by OLAF agents in accordance with Article 7(1) of Regulation No 2185/96. In particular, the manner in which that paragraph is worded, according to Vialto, gives the impression that it acted in bad faith. Furthermore, since the requests by the OLAF agents were not in conformity with that article, its refusal to grant those requests was completely lawful. Had the OLAF agents considered that, by its behaviour, Vialto had acted unlawfully or obstructed the investigation, under Articles 4 and 9 of Regulation No 2185/96, they would have been required to request the assistance of the national authorities. However, the OLAF agents decided to terminate the check without following that procedure.

93

The Commission submits that the second ground of appeal is in part ineffective and, in any event, unfounded.

94

First, as regards the allegation that the judgment under appeal fails to state reasons, it should be recalled that, according to consistent case-law of the Court of Justice, cited in paragraph 63 of the present judgment, the duty to state reasons does not require the General Court to provide an account which follows exhaustively and one by one all the arguments put forward by the parties to the case. The General Court’s reasoning may thus be implicit, on condition that it enables the persons concerned to know why it has not upheld their arguments and provides the Court of Justice with sufficient material for it to exercise its power of review.

95

In the present case, after recalling, in paragraph 114 of the judgment under appeal, the conditions which must be satisfied in order for a person to rely on the principle of the protection of legitimate expectations, in paragraph 116 of that judgment the General Court found that it was in fact following Vialto’s refusal to grant the requests by OLAF agents to be able to collect data that those agents agreed to derogate from the procedure laid down by the OLAF Guidelines as regards the place where the data are obtained and processed and the medium used for that purpose. Moreover, in paragraph 117 of that judgment, the General Court observed that OLAF was entitled, under Article 7(1) of Regulation No 2185/96, to have access to the data to which Vialto refused it access. The General Court concluded from the foregoing, in paragraph 118 of that judgment, that Vialto cannot adduce in its support a sufficiently serious breach of the legitimate expectation that a practice derogating in its favour would be applied, despite its refusal to accede to requests by OLAF agents which complied with Article 7(1) of Regulation No 2185/96.

96

Thus, it is clear from paragraphs 113 to 118 of the judgment under appeal that the General Court found that Vialto could not validly rely on a legitimate expectation that an agreement would be applied where it had decided not to comply with that agreement.

97

That statement of reasons is sufficient to enable Vialto to understand why its arguments were dismissed and for the Court to exercise its power of review. Vialto’s allegation that the statement of reasons was inadequate must therefore be dismissed as unfounded.

98

Secondly, as regards Vialto’s argument based on the case-law of the Court on the circumstances in which an act that creates rights can be withdrawn, it is sufficient to observe that Vialto did not invoke that argument at first instance.

99

The Court of Justice has consistently held that a plea raised for the first time in an appeal before it must be dismissed as inadmissible. In an appeal, the Court’s jurisdiction is confined to examining the assessment by the General Court of the pleas argued before it. To allow a party to put forward in that context a plea in law which it has not raised before the General Court would mean allowing that party to bring before the Court of Justice, whose jurisdiction in appeals is limited, a wider case than that heard by the General Court (judgment of 30 May 2017, Safa Nicu Sepahan v Council, C‑45/15 P, EU:C:2017:402, paragraph 109 and the case-law cited).

100

That argument must therefore be dismissed as inadmissible.

101

Thirdly, as regards Vialto’s argument that the General Court erred in law when it held, in paragraph 118 of the judgment under appeal, that Vialto cannot rely on a breach of the legitimate expectation that a practice derogating in its favour would be applied, despite its refusal to accede to requests by OLAF agents which complied with Article 7(1) of Regulation No 2185/96, it must be observed that, by referring in that way to Vialto’s refusal to provide certain information even though it had undertaken to provide it, the General Court necessarily, albeit by implication, held that Vialto cannot rely on a legitimate expectation that an agreement would be applied where it has decided not to comply with that agreement.

102

It should therefore be found that, by refusing to comply with the undertakings given to the OLAF agents under such an agreement, Vialto’s conduct made it impossible to apply that agreement, and it therefore cannot, subsequently, rely on a legitimate expectation that it would be applied.

103

It follows that the General Court did not err in law when it held, in paragraph 118 of the judgment under appeal, that Vialto could not validly rely on a legitimate expectation that an agreement would be applied where it had decided not to comply with that agreement.

104

Vialto’s argument to the effect that paragraph 118 of the judgment under appeal is vitiated by an error of law must therefore be dismissed as unfounded.

105

Fourthly, as regards Vialto’s argument that the wording of paragraph 118 of the judgment under appeal gives the impression that it acted in bad faith, that argument should be found to be based on a misreading of the judgment under appeal since the paragraph in question contains no appraisal to that effect, and must therefore be dismissed as unfounded.

106

Fifthly, as regards Vialto’s argument that the OLAF agents’ request to collect data was not in conformity with Article 7(1) of Regulation No 2185/96, it is clear from examination of the first ground of appeal advanced by Vialto that this argument must likewise be dismissed as unfounded.

107

Sixthly, in respect of Vialto’s argument based on Articles 4 and 9 of Regulation No 2185/96, it must be held that Vialto did not put forward any such argument at first instance and that, according to the consistent case-law of the Court cited in paragraph 99 of this judgment, it must therefore be dismissed as inadmissible.

108

In the light of the foregoing, the second ground of appeal must be dismissed as in part inadmissible and in part unfounded.

109

By its third ground of appeal, Vialto claims that the General Court committed several errors when, in paragraphs 121 to 123 of the judgment under appeal, it dismissed Vialto’s arguments on infringement of its right to be heard.

110

First, according to Vialto, the findings in paragraph 121 of the judgment under appeal, concerning the fact that Vialto was allegedly heard by OLAF, are not relevant to the examination of whether its right to be heard was infringed by DG Enlargement.

111

Secondly, in its view, the General Court misconstrued the facts by stating, in paragraphs 94 and 122 of the judgment under appeal, that the position adopted by that DG on the measures to be taken in relation to Vialto was not binding on the CFCU. It can in fact be seen from the case file that such a request was binding on the CFCU. It could not have been otherwise since that DG is financing the project and therefore signed the contract at issue.

112

Misconstruing the facts caused the General Court to apply the law incorrectly. It should have concluded that there was a duty on DG Enlargement to hear Vialto before sending the CFCU its request to adopt the necessary measures provided for in the contract at issue in view of Vialto’s breach of its contractual obligations.

113

Thirdly, Vialto’s right to be heard should also have been respected by that DG in the context of its recommendation to suspend the performance of the contract at issue or the part of the contract performed by Vialto, which it annexed to its request. Indeed, according to Vialto, it is apparent from the case-law of the Court, in particular its judgment of 4 April 2019, OZ v EIB (C‑558/17 P, EU:C:2019:289), that the right to be heard should also be respected where an EU institution makes non-binding recommendations.

114

The Commission concurs with the General Court’s analysis of the right to be heard and submits that the third ground of appeal should be dismissed as unfounded.

115

First, even if the Commission should have heard Vialto before sending its recommendation to the CFCU, such a formality would have been complied with in the present case by OLAF, as the Commission department at the origin of the recommendation.

116

Secondly, according to the Commission, the General Court found, without misconstruing the facts, that the Commission merely invited the CFCU to take the appropriate measures and made recommendations in that respect, by way of example. The position adopted by the Commission in respect of Vialto was therefore not binding on the CFCU. The fact that the Commission was financing the project did not render that position binding.

117

Thirdly, the judgment of 4 April 2019, OZ v EIB (C‑558/17 P, EU:C:2019:289), shows that the hearing before the body that makes the recommendation is secondary, emphasis being placed on the decision-making body. Furthermore, the situation to which that case related may be distinguished from that in the present case because in the present case the recommending body and the decision-making body belonged to the same administrative structure.

118

As regards the error of law allegedly committed by the General Court in paragraph 122 of the decision under appeal, it must be observed that the General Court held in that paragraph that DG Enlargement did not have a duty to hear Vialto before the CFCU adopted its decision to exclude Vialto from the contract at issue, on the grounds that in making that decision the CFCU was not bound by a position to that effect adopted by DG Enlargement.

119

Vialto disputes such a conclusion, arguing that, even assuming that the CFCU had taken that decision without being bound by a position to that effect from DG Enlargement, the latter should have heard Vialto before adopting a such a position.

120

It should be borne in mind in that respect that, according to Article 41(2)(a) of the Charter of Fundamental Rights of the European Union, , the right to good administration includes the right of every person to be heard before any individual measure which would affect him or her adversely is taken.

121

The right to be heard therefore guarantees every person the opportunity to make known their views effectively during an administrative procedure and before the adoption of any decision liable to affect their interests adversely (judgment of 4 June 2020, EEAS v De Loecker, C‑187/19 P, EU:C:2020:444, paragraph 68 and the case-law cited).

122

It is also necessary to bear in mind that the right to be heard is one of the rights of the defence, a general principle of EU law which is applicable even in the absence of any specific rules in that regard. That principle requires that the addressees of decisions which significantly affect the interests of those addressees should be placed in a position in which they may effectively make known their views with regard to the evidence on which those decisions are based (see, to that effect, judgment of 14 June 2016, Marchiani v Parliament, C‑566/14 P, EU:C:2016:437, paragraph 51 and the case-law cited).

123

Furthermore, as the Advocate General noted in point 121 of his Opinion, an infringement of the rights of the defence, which include the right to be heard, must be examined in relation to the specific circumstances of each particular case (see, to that effect, judgment of 25 October 2011, Solvay v Commission, C‑110/10 P, EU:C:2011:687, paragraph 63).

124

As regards the position in question adopted by DG Enlargement, it must be observed that, admittedly, under the general principles for implementing pre-accession aid, Article 10 of Regulation No 718/2007 provides that the Commission is to entrust the decentralised management for certain actions to the recipient country, which covers, at least, the management of tendering procedures, awards and payments. Moreover, it is clear from Article 21(1)(f) of that regulation that the recipient country is to designate an operating structure by IPA component or programme. It also follows from Article 28 thereof that the operating structure is a body or a collection of bodies within the administration of the recipient country, responsible for managing and implementing that assistance, in accordance with the principle of sound financial management, and is in charge of tendering procedures, granting procedures and the resulting contracts (see, to that effect, order of 4 July 2013, Diadikasia Symvouloi Epicheiriseon v Commission and Others, C‑520/12 P, not published, EU:C:2013:457, paragraph 32).

125

It follows that public contracts awarded by non-member countries which may benefit from assistance under the IPA, subject to the principle of decentralised management, remain national contracts and that the undertakings that submit tenders which are awarded the contract in question have legal relations only with the non-member country which is responsible for the contract (see, to that effect, order of 4 July 2013, Diadikasia Symvouloi Epicheiriseon v Commission and Others, C‑520/12 P, not published, EU:C:2013:457, paragraph 34).

126

Nevertheless, as can be seen from Article 10(1) of Regulation 718/2007, the Commission retains overall final responsibility for general budget execution and therefore has power to determine any amounts excluded from EU funding.

127

Given the Commission’s final responsibility for general budget execution, it must be found that a letter in which that institution recommends to the CFCU that it should not work with Vialto, stating that, in any event, the amounts paid to Vialto in connection with the project at issue are not eligible for funding from the EU budget, can reasonably be considered to be likely in practice to have a significant influence on the CFCU’s decision-making in respect of the measures to be taken against Vialto in relation to the contract at issue, likely to affect it adversely and which goes appreciably beyond the influence expected of a mere recommendation.

128

Accordingly, such a position adopted by the Commission is capable of having consequences for the economic operator concerned such that that person must be enabled to make observations on the conduct complained of against it and the measures to be taken against it in relation to the contract at issue before the Commission issues its position on those matters (see, by analogy, judgment of 10 July 2001, Ismeri Europa v Court of Auditors, C‑315/99 P, EU:C:2001:391, paragraph 29).

129

The position adopted by the Commission must therefore be regarded as an individual measure which adversely affects Vialto for the purposes of Article 41(2)(a) of the Charter of Fundamental Rights.

130

It must therefore be found that the General Court committed an error of law by holding, in paragraph 122 of the judgment under appeal, that the Commission did not have a duty to hear Vialto before the CFCU adopted its decision to exclude Vialto from the contract at issue.

131

Nevertheless, it is apparent from paragraphs 121 and 123 of the judgment under appeal that, when it dismissed Vialto’s argument relating to infringement by the Commission of its right to be heard, the General Court also based its reasoning on the fact that, in this case, Vialto had been heard by OLAF.

132

It must be observed in that respect that the Commission cannot, on the basis of that circumstance, regard its duty to hear the person concerned to have been satisfied.

133

On completion of the investigation, in accordance with Article 11(1) of Regulation No 883/2013, OLAF drew up an investigation report accompanied by recommendations by its Director-General on the action to be taken or not taken following the investigation. Article 11(3) of that regulation specifies that reports and recommendations drawn up following an external investigation and any relevant related documents are to be sent to the competent authorities of the Member States concerned in accordance with the rules relating to external investigations and, if necessary, to the competent Commission services.

134

It follows from the wording and scheme of those provisions that it is for the authority to whom those recommendations are made to conduct its own enquiry and to hear the person concerned before adopting a decision capable of adversely affecting that person.

135

In that context too, the structural links between OLAF and the Commission cannot relieve the Commission of that obligation with the effect that Vialto could be considered to have been heard by that institution when it was heard by the OLAF agents.

136

The third ground of appeal must therefore be upheld and the judgment under appeal must be set aside in so far as it dismissed as unfounded Vialto’s complaint relating to infringement by the Commission of its right to be heard.

137

In accordance with the first paragraph of Article 61 of the Statute of the Court of Justice of the European Union, the Court may, if it quashes the decision of the General Court, either give final judgment in the action, where the state of the proceedings so permits, or refer the case back to the General Court for it to give judgment.

138

It is apparent from the Court’s settled case-law that the EU may incur non-contractual liability under the second paragraph of Article 340 TFEU only if a number of conditions are fulfilled, namely the unlawfulness of the conduct alleged against the EU institution, the fact of damage and the existence of a causal link between the conduct of that institution and the damage complained of (judgment of 25 February 2021, Dalli v Commission, C‑615/19 P, EU:C:2021:133, paragraph 41 and the case-law cited).

139

In the present case, the proceedings are in a state where judgment can be given in so far as concerns the first of those conditions, relating to the Commission’s conduct.

140

It can be seen from the reasoning set out in the analysis of Vialto’s third ground of appeal that Vialto has demonstrated that the Commission infringed the right to be heard, which is a rule of law intended to confer rights on individuals.

141

As regards whether that infringement is sufficiently serious, Vialto claims that the Commission could not freely decide to require that Vialto be excluded from the project without giving it an opportunity to be heard and to exercise its rights of the defence.

142

In that regard, it must be borne in mind that, according to settled case-law of the Court, where an EU institution has only considerably reduced, or even no, discretion, the mere infringement of EU law may be sufficient to establish the existence of a sufficiently serious breach of EU law capable of giving rise to the European Union’s non-contractual liability (judgment of 20 January 2021, Commission v Printeos, C‑301/19 P, EU:C:2021:39, paragraph 103 and the case-law cited).

143

As can be seen from the reasoning set out in the analysis of the third ground of appeal, the Commission had a duty to hear Vialto before sending the CFCU its position on the measures to be taken in relation to Vialto in connection with the contract at issue, with the effect that the Commission had no discretion in that respect.

144

As to the remainder, the state of the proceedings does not permit final judgment to be given.

145

The other requirements for the European Union’s non-contractual liability to arise were not examined by the General Court.

146

Furthermore, it can be seen from paragraphs 25 and 26 of the judgment under appeal that at the hearing before the General Court Vialto considerably changed the extent of the damage it alleged it had suffered.

147

In the light of the foregoing, the Court is not in a position to rule, with a sufficient degree of certainty, on the existence of the damage and of a causal link between the Commission’s infringement of the right to be heard and the damage claimed.

148

It is therefore appropriate to refer the proceedings back to the General Court to rule on that matter.

149

Since the case has been referred back to the General Court, it is appropriate to reserve the costs.

On those grounds, the Court (First Chamber) hereby: