OC – Court Ruling (European Union, 2022)

An academic (the complainant) received EU funding for a research project and was discovered to have fraudulently claimed the money in personal expenses. OLAF recommended that the European Research Council Executive Agency (ERCEA) take appropriate measures to recover the sums and initiate proceedings for fraud and use of forgery. Within a year, OLAF issued a press release on the matter labelled [https://anti-fraud.ec.europa.eu/media-corner/news/olaf-investigation-uncovers-research-funding-fraud-greece-2020-05-05_en No. 13/2020.] The complainant argued that the press release identified her and in doing so OLAF had infringed Regulation (EU) 2018/1725.The Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the institutions, bodies, offices and agencies of the Union and on the free movement of such data is the version of the GDPR applicable to EU institutions. She agued that using the data contained in the press release, a reader could identify the fact that she was a Greek national woman, the amount of the funding, and the fact that her father worked at the same university. Moreover, a German Journalist had already identified her using the the press release and written an article about her. For this perceived breach, the complainant requested €1.1 million in damages. The General Court held that there was no personal data contained in the press release under Article 3(1) Regulation 2018/1725 (and 4(1) GDPR), because the applicant was not identified, and was not identifiable according to the 'means reasonably likely to be used' (Recital 16 Regulation 2018/1725 and Recital 26 GDPR). The General Court decided that whether OLAF’s press release contained personal data is tied not only to the ‘means reasonably likely to be used’ to identify the applicant but also by the ‘average or likely reader’ of said press release (para 76). The General Court therefore, disregarded the actual identification of the complainant by the German journalist. It argued that this journalist could not be considered an average reader since he was a professional with wide qualifications and an insider’s perspective due to his information network. Furthermore, the journalist appeared to be a daily reader of OLAF’s publications, which the General Court considered to be unusual (para 80). Since the General Court ruled that there was no breach, it did not go on to rule on damages.