Commission – Court Ruling (European Union, 2025)

An applicant (the data subject) participated in several EU staff selection procedures administered by the European Personnel Selection Office (EPSO), acting as controller, and created an EPSO account in the Talent system. After he successfully passed one selection procedure, EPSO also stored his data in its recruitment portal. EPSO managed recruitment through two IT systems, both of which generated access logs, although those logs contained limited technical information regarding the purpose of each access. Between 2022 and 2024, the data subject submitted several requests to EPSO under [https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng Article 17 of Regulation (EU) 2018/1725], seeking access to all personal data concerning him. He requested, in particular, full access logs, minutes of meetings, internal and external communications containing his personal data, information on data recipients, and the restoration of personal data deleted after the expiry of retention periods. EPSO stated that certain data did not exist, that it could not restore lawfully deleted data, and that it had already disclosed all available log data. After the data subject lodged a complaint, the European Data Protection Supervisor (EDPS) reconsidered the matter in light of the CJEU’s judgment in Pankki. The EDPS ordered EPSO to provide all available log data relating to consultations of the data subject’s profile. EPSO complied with that order by disclosing the available logs but withheld the identities of individual staff members who had accessed the data. EPSO later rejected further access requests submitted by the data subject. As a result, the data subject brought two actions before the General Court (Cases T-318/24 and T-362/24), seeking the annulment of EPSO’s decisions. The General Court joined the two cases and examined together all the pleas in law raised by the data subject. The General Court dismissed both actions in their entirety. It held that the controller did not infringe [https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng Article 17(1)] or [https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng (3)] of [https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng Regulation 2018/1725,] as the right of access concerns personal data undergoing processing and not documents as such, nor does it require the controller to restore lawfully deleted data. The Court confirmed that [https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng Regulation 2018/1725] contains no obligation for a controller to reinstate personal data once deleted in compliance with applicable retention rules. The Court further held that the controller had no obligation to disclose additional log data, meeting minutes, or communications where it credibly asserted that no such personal data existed. The data subject failed to rebut the presumption of legality attaching to the controller’s statements regarding the non-existence of further data. Moreover , The Court held that access logs constitute personal data to which a data subject is entitled, as they reveal the existence, frequency and purpose of processing. However, employees of a controller acting under its authority are not “recipients” within the meaning of the GDPR or [https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng Regulation 2018/1725], and controllers are not required to log or disclose their identities. Disclosure of such identities is only required if strictly necessary for the effective exercise of data protection rights and subject to safeguarding employees’ rights. Since the data subject had already been informed of the purposes and recipients of processing, the absence of staff identities or detailed purposes in the logs did not infringe the right of access. It is not further apparent from the Pankki that Article 15 GDPR requires the controller to set up a logging mechanism containing information on the identity of employees who have carried out consultation operations in respect of the personal data of a person. In addition, the Court found no infringement of the principles of lawfulness, fairness, transparency, accuracy, integrity, confidentiality, or accountability under [https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng Article 4 of Regulation 2018/1725.] The deletion of the data subject’s data after the expiry of retention periods was lawful and the data subject’s rights to restriction of processing and objection under Articles [https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng 20] and [https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng 23] were not applicable, as the deletion was based on a legal obligation rather than consent or legitimate interests.